The Daily Index — Tuesday, November 11, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

IMPROPER AUTHENTICATION HANDLING IN THE AMAZON WORKSPACES CLIENT FOR LINUX

Amazon identified a vulnerability in the Amazon WorkSpaces client for Linux. Under specialized circumstances, an attacker may be able to extract a valid authentication token from the client's machine and access another user's Workspace. The impacted client versions have reached end-of-support. Customers are encouraged to upgrade to a supported version.

aws.amazon.com · 1 min

TLDR InfoSec

NEARLY 30 ALLEGED VICTIMS OF ORACLE EBS HACK NAMED ON CL0P RANSOMWARE SITE

Nearly 30 organizations, including major firms such as Logitech, The Washington Post, and Cox Enterprises, were allegedly impacted by a Cl0p ransomware campaign that exploited Oracle's E-Business Suite. Some, such as Harvard and The Washington Post, have confirmed involvement, but most have not commented on the matter.

securityweek.com · 3 min

TLDR InfoSec

CISOS MUST PROVE THE BUSINESS VALUE OF CYBER — THE RIGHT METRICS CAN HELP

CISOs struggle to demonstrate the value of security because they often rely on technical metrics, such as MITRE ATT&CK and patch statistics, rather than business-focused measures. Boards are fatigued from unclear capital allocation and lack visibility into how cybersecurity investments lower risk. Experts advise establishing enterprise risk management, calculating financial exposure in dollars, and presenting understandable metrics like industry benchmarks, risk reduction, and ROI. CISOs should align security with business goals by consulting departments, translating cyber risks into financial terms, and showing measurable risk reduction, such as a 40% decrease in cyber loss exposure.

csoonline.com · 8 min

TLDR InfoSec

ATT&CK V18: THE DETECTION OVERHAUL YOU'VE BEEN WAITING FOR

MITRE ATT&CK v18 introduces two new components, Detection Strategies and Analytics, replacing brief detection notes with detailed, behavior-based guidance that connects techniques to platform-specific analytics, log sources, and data elements. The enterprise domain introduces 13 new techniques, covering Kubernetes, CI/CD pipeline tampering, cloud databases, and ransomware preparation activities, including backup software detection and selective file exclusion, as well as adversary monitoring of their own threat intelligence. The framework suggests splitting the Defense Evasion tactic into Stealth (altering defender visibility) and Impair Defenses (disrupting security controls), while launching an ATT&CK Advisory Council for formal community input and establishing faster CTI releases independent of biannual framework updates.

medium.com · 7 min

TLDR InfoSec

IMPLEMENTING THE ETHERHIDING TECHNIQUE

Etherhiding is a technique used by attackers to distribute malware using public blockchains, specifically Ethereum. It works by hiding critical information, such as payloads or configuration data, within blockchain smart contracts, making them accessible while making them difficult to take down or block. This hands-on demo shows how to build a simple Ethereum smart contract using Solidity, deploy it to the Sepolia test network via MetaMask, and create a web page that retrieves and displays the hidden information from the blockchain using Infura RPC.

medium.com · 7 min

TLDR InfoSec

NAKIVO INTRODUCES V11.1 WITH UPGRADED DISASTER RECOVERY AND MSP FEATURES

NAKIVO Backup & Replication v11.1 offers enhanced features, including real-time VMware replication with automated failover via Site Recovery workflows, eliminating manual setup through automatic IO Filter and Journal Service installation. It broadens Proxmox VE support with Flash VM Boot for instant recovery, VM replication, and direct tape recovery, while MSP Direct Connect enables secure, encrypted client-side connectivity supporting VMware, Hyper-V, and Proxmox VE. Additionally, the update introduces granular backup options for physical Windows and Linux systems, allowing selective folder and volume protection with flexible recovery methods such as SMB/NFS shares, all featuring encryption, immutability, and air-gapping for ransomware defense.

bleepingcomputer.com · 2 min

TLDR InfoSec

RUSSIAN NATIONAL PLEADS GUILTY TO BREAKING INTO NETWORKS FOR YANLUOWANG RANSOMWARE ATTACKS

Aleksei Olegovich Volkov (aka "chubaka.kor") pleaded guilty to serving as an initial access broker for Yanluowang ransomware, attacking seven US businesses between July 2021 and November 2022, with total ransom demands reaching $24 million. FBI blockchain analysis traced cryptocurrency payments to accounts owned by Volkov and a co-conspirator in Indianapolis, confirming his identity and communications about attack coordination and profit-sharing. Volkov faces up to 53 years in prison and must pay $9.2 million in restitution. Victims experienced operational shutdowns, data encryption, executive harassment calls, and DDoS attacks following initial compromise through vulnerability exploitation.

cyberscoop.com · 3 min

TLDR InfoSec

WHY A LOT OF PEOPLE ARE GETTING HACKED WITH GOVERNMENT SPYWARE

The reach of government spyware now extends far beyond its original promise of targeting only criminals and terrorists. Increasingly, journalists, activists, and minor political figures around the world are being surveilled, enabled by vendors whose scalable technology and weak oversight make widespread abuse easy. Governments, both democratic and authoritarian, face little accountability or limitation, although international moves and investigations may finally be prompting some overdue scrutiny and action.

techcrunch.com · 4 min

TLDR InfoSec

NEW BROWSER SECURITY REPORT REVEALS EMERGING THREATS FOR ENTERPRISES

Emerging enterprise threats increasingly concentrate in the user's browser. Unmanaged AI tools, browser extensions, and non-corporate logins are key risks, as traditional security solutions can't see or manage what happens in browser sessions, enabling sensitive data exposure. Set up session-native controls and browser-level monitoring to close these critical security gaps and prevent breaches.

thehackernews.com · 5 min

TLDR InfoSec

CBP ROLLS OUT FACIAL RECOGNITION APP FOR LOCAL POLICE TO SPOT ILLEGAL IMMIGRANTS

US Customs and Border Protection deployed Mobile Identify (listed as "287 TFM" on Google Play Store), a facial recognition app enabling 555 local law enforcement agencies across 34 states participating in Section 287(g) programs to identify immigration status by scanning faces, returning reference numbers requiring ICE contact rather than direct personal information, with captured photos stored for 15 years even for US citizens.

links.tldrnewsletter.com · 1 min

TLDR InfoSec

FBI WANTS TO KNOW WHO RUNS ARCHIVE.PH

The FBI issued a federal subpoena to domain registrar Tucows demanding extensive billing records, internet session logs, payment information, and cloud computing service details to unmask the anonymous operator behind archive.today (Archive.is and Archive.ph), a web archiving service operational since 2012 that's commonly used to bypass news paywalls, though the subpoena does not specify what crime is being investigated.

hackread.com · 2 min

TLDR InfoSec

YOU'LL NEVER GUESS THE LOUVRE'S ONETIME CCTV PASSWORD. (YOU ABSOLUTELY WILL)

The French court criticized the Louvre for prioritizing art spending over security, exposing long-known weaknesses, including easy-to-guess passwords (such as "LOUVRE") and a lack of CCTV, which enabled a major jewelry heist.

edition.cnn.com · 4 min