TLDR INFORMATION SECURITY 2025-02-21

Take the interactive tour to see Flashpoint's data in action

MICROSOFT FIXES POWER PAGES ZERO-DAY BUG EXPLOITED IN ATTACKS

Power Pages is a low-code web development platform that lets users create, host, and manage external business websites. Microsoft detected a high-severity privilege escalation vulnerability that it has patched at the service level. Microsoft has sent affected customers instructions to check for indications of breach.

MEDUSA RANSOMWARE GANG DEMANDS $2M FROM UK PRIVATE HEALTH SERVICES PROVIDER

The UK's HCRG Care Group has reportedly been attacked by the Medusa ransomware gang. The gang claims to have stolen 2.27 TB of data, demanding $2 million to delete or sell it, with a February 27 deadline. HCRG confirms investigating a security incident but says services continue operating normally.

SALT TYPHOON USED CUSTOM MALWARE JUMBLEDPATH TO SPY U.S. TELECOM PROVIDERS

Cisco's Talos group has noted that China-linked cyber espionage group Salt Typhoon used custom malware JumbledPath to spy on U.S. telecom providers, breaching major firms for over three years. The group exploited vulnerabilities in Cisco devices, stole credentials, and manipulated network settings to gain unauthorized access. The attacks targeted multiple countries' telecom providers, prompting security measures from companies like Lumen, AT&T, and Verizon.

FIND HIDDEN AWS RESOURCES WITH EFFECTIVE WORDLISTS

This post proposes a method for generating wordlists to enumerate resources in a target AWS account using Awseye. The process involves exporting mentions from Awseye, normalizing the account IDs and regions, and then counting and sorting the results to see the most commonly mentioned resources. The post highlights some alternatives such as parsing AWS documentation, querying Sourcegraph, or using AI-generated lists.

THE BLEEDING EDGE OF PHISHING: DARCULA-SUITE 3.0 ENABLES DIY PHISHING OF ANY BRAND

Criminals launched "darcula-suite 3.0," an advanced Phishing-as-a-Service platform, in February. Using Headless Chrome and browser automation, it allows non-technical criminals to instantly clone any legitimate website for phishing campaigns. The article dives into this PhaaS.

AN INSIDE LOOK AT NSA (EQUATION GROUP) TTPS FROM CHINA'S LENSE

Reports coming out of Chinese cybersecurity entities like Qihoo 360, Pangu Lab, and the National Computer Virus Emergency Response Center (CVERC) attributed cyber operations to the NSA's APT-C-40 group. The article goes into detail about the attribution methodology used as well as identifying tools found before the Shadow Broker's leak. The investigation revealed TAO's use of sophisticated tools like SECONDDATE and NOPEN to conduct remote control, data exfiltration, and credential harvesting.

STIFLE

Stifle is a post-exploitation tool for abusing explicit certificate mappings in ADCS for account takeover.

PPHACK

Pphack is an advanced client-side prototype pollution scanner. It utilizes chromedp, a headless Chrome browser, to identify prototype pollution vulnerabilities, a type of JavaScript vulnerability that enables attackers to add arbitrary properties to global object prototypes which may then be inherited by user-defined objects.

BLOODHOUNDVIEWER

BloodHoundViewer is a Chrome Extension that enhances the BloodHound Community Edition with features like improved layout controls, query history navigation, and support for Neo4j.

AGENTIC AI THREAT MODELING FRAMEWORK: MAESTRO

MAESTRO is a threat modeling framework that was built to address gaps in traditional threat modeling frameworks like STRIDE and PASTA related to the unique challenges that are inherent in AI systems. It is designed for multi-agent environments and is based on a seven-layer reference architecture that spans from the agent ecosystem at the top to foundational models at the bottom. The model also provides threat modeling examples of agentic architecture patterns such as single agent, multi agent, unconstrained conversational autonomy, human in the loop, and task-oriented agents.

THREATSTATS: AI VULNERABILITIES SURGE 1,025%, 99% CONNECTED TO APIS

Wallarm's researchers cataloged 439 AI-related CVEs in 2024 and released the 2025 API ThreatStats report. 99% of the vulnerabilities traced back to insecure APIs. Attackers exploit internet-exposed APIs that do not include strong authentication mechanisms to exploit injection flaws, misconfigurations, and memory corruption vulnerabilities in high-performance binary APIs.

SPANISH SPYWARE STARTUP MOLLITIAM INDUSTRIES SHUTS DOWN

A Spanish spyware company, Mollitiam Industries, is shutting down after filing for bankruptcy in January. The secretive firm developed surveillance tools called "Invisible Man" and "Night Crawler" that could hack devices and was linked to military intelligence surveillance of journalists in Colombia.

GOOGLE ADDS QUANTUM-RESISTANT DIGITAL SIGNATURES TO CLOUD KMS (2 MINUTE READS)

Google has released quantum-safe digital signatures (FIPS 204/FIPS 205) in Google Cloud Key Management Service (Cloud KMS) for software-based keys, available in preview.

BLACK BASTA RANSOMWARE GANG'S INTERNAL CHAT LOGS LEAK ONLINE

Internal chat logs from the Black Basta ransomware gang were leaked online, revealing tactics and member information.

300% INCREASE IN ENDPOINT MALWARE DETECTIONS

A new WatchGuard report found a 300% increase in endpoint malware detections in the third quarter of 2024, with threat actors using social engineering tactics to execute attacks.