TLDR INFORMATION SECURITY 2025-02-18

NEW FINALDRAFT MALWARE ABUSES OUTLOOK MAIL SERVICE FOR STEALTHY COMMUNICATIONS

Elastic Security is reporting on a new malware campaign that utilizes Outlook drafts for C2 communication. The campaign uses PathLoader, which contains static analysis defenses, to load the FinalDraft malware, which requests OAuth tokens from Microsoft to hide C2 communication in drafts. The malware accepts 37 unique commands that include data exfiltration, process injection, pass-the-hash attacks, network proxying, file operations, and Powershell execution.

TELEGRAM ABUSED AS C2 CHANNEL FOR NEW GOLANG BACKDOOR

Researchers at Netskope have discovered a Golang-based malware, likely Russian in origin, that uses Telegram API as a Command and Control Mechanism. It uses the "C:\Windows\Temp\svchost.exe" location to save the binary and listens to commands in a Telegram Channel. This blog post includes the IOCs in a GitHub repository as well as screenshots of decompiled code of the malware.

FINASTRA ANNOUNCES DATA BREACH FOLLOWING DISCOVERY OF NOVEMBER 2024 CYBERATTACK

Finastra reported a data breach after discovering unauthorized access in November 2024 to consumer information, including names and financial details. They are sending out notification letters to those affected by the security incident. The article suggests seeking legal guidance to protect anyone receiving notification letters and for anyone impacted to understand options following the breach.

HOW TO APPLY ENCRYPTION TECHNIQUES TO BOLSTER DATA LOSS PREVENTION

In 2024, data breaches cost businesses an average of $4.88 million globally. Data encryption has become increasingly vital and reliable, especially with growing interconnected systems and data transfers. It provides essential protection by encoding information, making it accessible only with the correct decryption key.

🚨 AWS & EXPOSED CREDENTIALS: THE MISTAKE THAT CAN RUIN YOU (AND HOW TO AVOID IT — I GOT YOU!)

Poor credential management causes 70% of cloud data breaches. Beyond passwords, companies must protect API keys, SSL certificates, authentication tokens, and federated identities. This article notes various actions one can take if credentials are compromised.

HOW TO BYPASS GITHUB'S BRANCH PROTECTION

Mercari presents 7 scenarios in which an attacker with write permissions to a branch protected GitHub repository can bypass those protections to merge malicious code without a review. For each of the first six methods mentioned, Mercari also presents a technical control to prevent the attack. However, the final scenario, which involves the attacker adding a commit to a PR that another user created using GitHub Actions and approving it, does not have a comprehensive defense mechanism built into GitHub.

Security.

BOOFUZZ

Boofuzz is a fork of and the successor to the venerable Sulley fuzzing framework. Besides numerous bug fixes, boofuzz aims for extensibility. The goal: fuzz everything.

SECTEMPLATES

Sectemplates offers Open source templates you can use to bootstrap your security programs. The templates cover preparation checklists, runbooks, security metrics, and document templates. Users can freely use the content for personal and commercial purposes, excluding products for sale or developed based on it.

HTTPTAP

httptap is a CLI program that allows users to view HTTP(S) requests made by any Linux program.

SOUTH KOREA BLOCKS DOWNLOADS OF DEEPSEEK FROM LOCAL APP STORES

South Korea has temporarily restricted downloads of Chinese AI company DeepSeek's app over data privacy concerns, specifically its transfer of user data to ByteDance. While existing users can continue using the service, they're advised against sharing personal information until DeepSeek complies with Korean privacy laws.

INVESTIGATING KERNEL MODE SHADOW STACKS ON WINDOWS

Shadow stacks are a security feature that Intel CET implements to defend against ROP attacks by shadowing and comparing the current stack against a protected, read-only copy. The “Secure Kernel” is a Windows feature that allows the kernel to run in a virtualized form by a protected Secure Kernel. This post utilizes the SourcePoint debugger to perform a novel dynamic analysis of the Windows Secure Kernel.

CHASE WILL SOON BLOCK ZELLE PAYMENTS TO SELLERS ON SOCIAL MEDIA

Chase has announced that they will begin to delay, decline, or block Zelle payments to contacts that likely originated from social media contacts. When payments are set up, Chase may request additional information such as the purpose of the payment to make this decision. This move is likely prompted by the CFPB lawsuit against Zelle as well as fraud statistics from Chase.

AI HONEYPOT DEMO (WEBAPP)

Demo of an SSH honeypot with artificial intelligence which features a terminal that simulates an Ubuntu environment, allowing you to explore and test Linux commands.

MICROSOFT TO REMOVE THE LOCATION HISTORY FEATURE IN WINDOWS

Microsoft is removing the Location History feature from Windows, which allowed Cortana to access device history.

PRO-RUSSIA COLLECTIVE NONAME057(16) LAUNCHED A NEW WAVE OF DDOS ATTACKS ON ITALIAN SITES

The pro-Russia group NoName057(16) launched DDoS attacks on Italian airports, banks, and ports in response to President Mattarella's remarks comparing Russia to the Third Reich.