The Daily Index — Thursday, December 11, 2025

ATTACKS & VULNERABILITIES

TLDR InfoSec

CYDOME FLAGS MIRAI VARIANT BROADSIDE, TARGETS MARITIME LOGISTICS THROUGH TBK DVR DEVICES

A Mirai variant named Broadside is actively compromising maritime logistics systems by exploiting a vulnerability in TBK digital video recorder (DVR) devices. Broadside uses a custom C2 protocol, a unique “Magic Header,” and aggressively kills competing malware. Beyond DDoS capabilities, it can harvest system credentials, posing an elevated risk to operational technology environments.

industrialcyber.co · 3 min

TLDR InfoSec

GOOGLE ADS FOR SHARED CHATGPT AND GROK GUIDES PUSH MACOS INFOSTEALER MALWARE

A phishing campaign uncovered by Kaspersky and Huntress is abusing Google ads to lure macOS users searching for troubleshooting tips. The ads lead to public ChatGPT and Grok “shared conversations” posing as legitimate guides, but instead push victims to download the AMOS infostealer.

bleepingcomputer.com · 2 min

TLDR InfoSec

DECLARATIVE BINARY PARSING FOR SECURITY RESEARCH WITH KAITAI STRUCT

Kaitai Struct enables describing binary file formats in a declarative YAML-based language and automatically generating parsers in many languages, which is very useful for reverse engineering, malware analysis, and protocol or firmware research. This example walks through designing a dummy KAISTDE binary format, manually serializing and parsing it in C and Python, then expressing the same structure in a .ksy spec so the Kaitai compiler can emit a robust parser and visualizations.

husseinmuhaisen.com · 15 min

TLDR InfoSec

AWS LAMBDA MANAGED INSTANCES: A SECURITY OVERVIEW

During re:Invent 2025, AWS announced Lambda Managed Instances, which enable Lambda functions to run on AWS-managed EC2 instances. AWS prevents users from attaching instance roles to these instances, unlike other managed instances. EKS-managed nodes do not allow direct instance access via tools like SSM or EC2 Instance Connect. The instances run AWS' container-optimized Linux distribution, Bottlerocket OS, and execute Lambda functions as containerd containers.

offensai.com · 5 min

TLDR InfoSec

NEW RANSOMWARE 01FLIP: MULTI-PLATFORM RANSOMWARE WRITTEN IN RUST

01flip is a new Rust-based ransomware family (tracked as CL-CRI-1036) that targets critical infrastructure in the Asia-Pacific region, leveraging Rust's cross-compilation capabilities to support both Windows and Linux platforms. Attackers exploited CVE-2019-11580 for initial access, deployed Sliver C2 framework for lateral movement, and used AES-128-CBC with RSA-2048 encryption while demanding one bitcoin ransom, with subsequent data leaks appearing on dark web forums. Organizations should monitor for Rust-based malware signatures, patch internet-facing applications against known vulnerabilities, and implement detection for cross-platform ransomware that uses low-level API calls and string obfuscation techniques to evade traditional security controls.

unit42.paloaltonetworks.com · 22 min

TLDR InfoSec

EQUIXLY (PRODUCT LAUNCH)

Equixly provides an AI-powered API security testing platform that continuously probes APIs like a virtual hacker to uncover technical and business-logic vulnerabilities across the SDLC, integrating into CI/CD pipelines to automate penetration testing and guide remediation.

equixly.com

TLDR InfoSec

FIL-C

Fil-C is a memory-safe implementation of the C and C++ programming languages that can compile and run a lot of software with zero or minimal changes.

fil-c.org · 1 min

TLDR InfoSec

JAPANESE FIRMS SUFFER LONG TAIL OF RANSOMWARE DAMAGE

Ransomware attacks are hitting major Japanese companies and government bodies, forcing factories, retailers, and service providers offline for months. Many Japanese organizations depend on older systems and complex supply chains, so recovery is slow and costly.

links.tldrnewsletter.com · 3 min

TLDR InfoSec

ONEDRIVE. LET'S TAKE THIS OFFLINE

Microsoft launched Offline Mode for OneDrive Business customers in April 2024, which allows users to continue using the web version of OneDrive while offline. This works by downloading file metadata and running a SharePoint web server locally. This post introduces an update to the OneDriveExplorer, which can parse the cache used for offline mode.

malwaremaloney.blogspot.com · 2 min

TLDR InfoSec

CAN LLMS DETECT IDORS? UNDERSTANDING THE BOUNDARIES OF AI REASONING

Semgrep tested Claude Code with Sonnet 4 and OpenAI Codex with GPT5's ability to detect IDOR vulnerabilities in code with four levels of increasing difficulty, from no authorization to implicit authorization through middleware. In total, the models identified 15 real, previously unknown vulnerabilities and 93 false positives, with Sonnet 4 performing best. In its test with a generic prompt, Semgrep found that the models could detect some simpler IDOR vulnerabilities but failed in more complex cases.

semgrep.dev · 10 min

TLDR InfoSec

ORGANIZATIONS CAN NOW BUY CYBER INSURANCE THAT COVERS DEEPFAKES

Cybersecurity insurer Coalition announced that it will start offering coverage for certain deepfake incidents, including those that lead to reputational harm.

cyberscoop.com · 2 min

TLDR InfoSec

HTTPS CERTIFICATE INDUSTRY PHASING OUT LESS SECURE DOMAIN VALIDATION METHODS

Chrome Root Program and CA/Browser Forum adopted Ballots SC-080, SC-090, and SC-091 to sunset 11 legacy Domain Control Validation methods relying on email, phone, fax, postal mail, and reverse DNS lookups by March 2028, pushing Certificate Authorities toward automated, cryptographically verifiable ACME-based validation to prevent fraudulent certificate issuance.

security.googleblog.com · 4 min