TLDR INFORMATION SECURITY 2025-02-14

Attend live on February 25th

SCAMMERS CLONE ITALIAN DEFENCE MINISTER'S VOICE WITH AI IN RANSOM SCHEME

A group of Italian entrepreneurs reported that they were the victims of a wire fraud scheme. The entrepreneurs report that they received a call allegedly from the Italian Defense Minister Guido Corsetto requesting 1 million Euros so that they could free kidnapped journalists. Upon hearing of this scam, Corsetto posted on X about it to warn other potential victims.

HACKER LEAKS ACCOUNT DATA OF 12 MILLION ZACKS INVESTMENT USERS

In what could be the third major data breach in four years, Zacks Investment has been breached again. Have I Been Pwned (HIBP) verified 12 million unique email accounts in the leak. However, HIBP also notes that roughly 93% of the leaked email addresses were already in its database from past breaches of the same platform or other services.

ASTAROTH PHISHING KIT BYPASSES 2FA TO HIJACK GMAIL AND MICROSOFT ACCOUNTS

A new phishing kit called Astaroth can bypass two-factor authentication to steal login credentials from Gmail, Yahoo, and Microsoft accounts. Astaroth utilizes an evilnginx-style proxy to Man In The Middle user sessions to intercept authentication data, making it difficult for users to detect the attack. The sophisticated kit is sold on cybercrime networks for $2,000 and includes custom hosting options to evade detection.

DETECTION ENGINEERING AT SCALE: ONE STEP CLOSER

Part two of a series describing how Sekoia develops detection rules using Sigma to identify TTPs. Sekoia implements the Alerting and Detection Strategy Framework which focuses heavily on testing and documentation. Sekoia augments their automated documentation with comprehensive testing that tests syntax, test coverage, and both production and pre-production regression testing.

WHOAMI: A CLOUD IMAGE NAME CONFUSION ATTACK

Researchers discovered a "whoAMI" vulnerability where attackers could exploit AWS accounts by publishing malicious AMIs with specific names, targeting systems that don't specify owner verification when searching for AMIs. This post dives into this new attack.

HOW SECURITY TEAMS FAIL

Michal Zalewski discusses common pitfalls in corporate security teams, from their origins to cultural challenges and eventual breaches. Security teams often start reactively, leading keener senses on security challenges which often morph into a sense of superiority and disconnect from other departments. The cycle usually ends with a major breach that prompts a reevaluation of the team's strategy and communication.

Download the product brief →

JSCRAMBLER (PRODUCT LAUNCH)

JScrambler can prevent web supply chain attacks by monitoring script execution, preventing vulnerability exploitation, detecting modifications in third-party resources, and detecting anomalous behavior.

DATABOXER

Databoxer aims to be a lightweight cross-platform solution for file encryption. Databoxer operates based on the ChaCha20 encryption algorithm in combination with the Poly1305 universal hash function to perform its encryption operations. It claims these implementations to be safer and faster than the most popular AES algorithm used in many other similar programs.

SLACKPIRATE

SlackPirate is a tool to enumerate and exfiltrate sensitive data from Slack workspaces. It helps red-teamers identify security risks and helps blue-teamers detect and prevent sensitive data leaks.

MASSIVE BRUTE FORCE ATTACK USES 2.8 MILLION IPS TO TARGET VPN DEVICES

The Shadowserver Foundation is warning of a massive password-spraying attack targeting a wide range of networking devices. The attackers are using a botnet composed of almost 2.8 million source IP addresses. The compromised devices seem to be largely edge network devices.

TRUMP'S CYBER CHIEF PICK HAS LITTLE EXPERIENCE IN THE CYBER

Trump reportedly plans to nominate Sean Cairncross as National Cyber Director, despite his lack of cybersecurity experience. Cairncross, a lawyer, would replace Harry Coker, who had decades of CIA and NSA experience.

FEDS WANT DEVS TO STOP CODING “UNFORGIVABLE” BUFFER OVERFLOW VULNERABILITIES

Citing half a dozen CVEs, CISA and the FBI have released a scathing critique of manufacturers writing memory-unsafe code. They have urged organizations to adopt memory-safe languages such as Go, Rust, and Swift. Acknowledging that full rewrites are difficult, they have urged organizations to make plans for a phased transition and utilize memory safety flags and testing.

BARCELONA-BASED SPYWARE STARTUP VARISTON SHUTS DOWN, PER FILING

Variston finally shut down as it started crumbling after Google exposed its secretive operations in 2022.

SALT TYPHOON REMAINS ACTIVE, HITS MORE TELECOM NETWORKS VIA CISCO ROUTERS

According to a report by Recorded Future, Salt Typhoon, a Chinese threat group, continues to target global telecom networks using Cisco routers.

SCARLETT JOHANSSON WARNS OF “1000-FOOT AI WAVE” FOLLOWING VIRAL DEEPFAKE

Following a viral AI-generated post, Scarlett Johansson warns about the dangers of AI being used to create non-consensual content and urges legislators to take action to regulate AI use.