The Daily Index — Wednesday, December 10, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

OVER 300,000 INDIVIDUALS IMPACTED BY VITAS HOSPICE DATA BREACH

Vitas Healthcare, the largest US for-profit hospice chain, reported that a compromised vendor account was used to access its systems from late September to late October, exposing data belonging to over 300,000 current and former patients. Exposed information includes contact details, identification numbers, Social Security numbers, medical and insurance data, and next-of-kin contacts. No ransomware group has claimed responsibility.

securityweek.com · 2 min

TLDR InfoSec

IVANTI WARNS OF CRITICAL ENDPOINT MANAGER CODE EXECUTION FLAW

Ivanti disclosed a critical vulnerability in its Endpoint Manager (EPM) platform that allows unauthenticated attackers with access to the EPM web service to register fake endpoints and inject malicious JavaScript into the administrative dashboard. Ivanti also patched three additional high-severity vulnerabilities, including two that could enable unauthenticated remote code execution on arbitrary systems.

bleepingcomputer.com · 2 min

TLDR InfoSec

SYSMON CONFIG CREATION FOR THE LOLRMM FRAMEWORK

A security researcher released a Sysmon configuration tailored to detect Remote Monitoring and Management (RMM) tools listed in the LOLRMM framework. The rules cover process creation, file operations, network activity, and DNS queries, derived from behavioral analysis of RMM installers executed in VirusTotal, Hybrid-Analysis, and Any.run sandboxes. By capturing file paths, registry keys, and network indicators, the configuration helps security teams spot unauthorized RMM activity even when binaries are renamed or obfuscated.

dodgethissecurity.com · 6 min

TLDR InfoSec

PROMPT INJECTION IS NOT SQL INJECTION (IT MAY BE WORSE)

The UK NCSC explains that prompt injection fundamentally differs from SQL injection because LLMs do not separate instructions from data, they simply predict tokens. As a result, techniques like parameterized queries cannot fully mitigate prompt injection. The agency recommends treating LLMs as "inherently confusable deputies" and implementing deterministic guardrails that constrain system actions outside of the model rather than relying on input filtering. Effective defenses include enforcing least privilege for LLM-driven workflows, closely monitoring tool and API usage, and acknowledging that prompt injection remains a residual architectural risk.

ncsc.gov.uk · 4 min

TLDR InfoSec

RISK-BASED ALERTING IN MICROSOFT SENTINEL

Risk-Based Alerting (RBA) allows analysts to combine multiple lower-fidelity alerts into a single higher-confidence incident by assigning risk scores to alerts that do not individually generate incidents. An incident is only created once a cumulative risk threshold is met. When assigning scores, teams should weigh potential impact, the criticality of the asset or user involved, and the confidence that the behavior reflects real malicious activity. This approach can reduce alert fatigue and improve triage efficiency.

isaacdunham.github.io · 8 min

TLDR InfoSec

breakdown

Summary unavailable

resemble.ai

TLDR InfoSec

IMPER AI (PRODUCT LAUNCH)

Imper.ai provides real-time detection and prevention of impersonation and social engineering attacks across video, voice, phone, and chat communications.

imper.ai

TLDR InfoSec

THE CURIOUS CASE OF TWIN HACKERS ACCUSED OF ERASING US GOVERNMENT DATABASES

Twin brothers Muneeb and Sohaib Akhter, federal contractors previously convicted of hacking in 2015, were arrested for allegedly deleting nearly 100 government databases containing FOIA records and sensitive investigative files. After learning of their termination from Opexus, the pair allegedly used still-active credentials to access systems. Authorities say Muneeb also stole IRS tax records of 450 individuals and attempted to erase evidence via AI-assisted log deletion queries. The case underscores the need for immediate credential revocation on termination, rigorous vetting for privileged roles, and strong backup strategies.

links.tldrnewsletter.com · 6 min

TLDR InfoSec

DANGEROUS INVITATIONS: RUSSIAN THREAT ACTOR SPOOFS EUROPEAN SECURITY EVENTS IN TARGETED PHISHING ATTACKS

Russian threat actor UTA0355 impersonated multiple prominent European security conferences, including the Belgrade Security Conference and Brussels Indo-Pacific Dialogue, to harvest Microsoft 365 credentials. The attackers created convincing replica websites and abused OAuth and Device Code authentication flows. They used rapport-building outreach on WhatsApp and Signal, leveraged compromised accounts for credibility, and selectively triggered credential theft based on targeted email domains. Defenses include user training on OAuth consent prompts, monitoring anomalous device registrations in Entra ID, and enforcing conditional access controls.

volexity.com · 6 min

TLDR InfoSec

RESEARCHERS SPOT 700% INCREASE IN HYPERVISOR RANSOMWARE ATTACKS

Security researchers report a 700% increase in ransomware attacks targeting hypervisors like Hyper-V and VMWare ESXi, with groups such as Akira leading the trend. Hypervisors often lack endpoint-style protections and offer attackers a control point over numerous VMs simultaneously. Attacks abuse built‑in tools to encrypt VM storage and misuse management utilities to disable protections.

theregister.com · 2 min

TLDR InfoSec

FINCEN SAYS RANSOMWARE GANGS EXTORTED OVER $2.1B FROM 2022 TO 2024

FinCEN reported $2.1 billion in ransomware payments across 4,194 incidents from 2022-2024, with 2024 showing a significant drop to $734 million following law enforcement disruptions of ALPHV/BlackCat and LockBit operations.

bleepingcomputer.com · 3 min

TLDR InfoSec

GEMINI ENTERPRISE NO-CLICK FLAW EXPOSES SENSITIVE DATA

Google patched a Gemini Enterprise weakness that let attackers hide prompt-injection instructions inside shared Docs, Calendar events, or emails.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

US POSTS $10 MILLION BOUNTY FOR IRANIAN HACKERS

The US is offering up to $10 million for information on two key figures in the Iranian state-linked hacking outfit now called Shahid Shushtari, previously known by several front-company names.

securityweek.com · 2 min