Parse notes
Sponsored
Microsoft reports their customers face 600 million attacks daily from cybercriminals and nation-state actors. Despite Microsoft 365 apps sharing a common authentication layer, each app within the suite presents unique security challenges. Analysis by Obsidian Security reveals 70% of integrations are inactive, yet many retain privileged access—a key vector in the Midnight Blizzard breach.
Threat intelligence firm Kela has identified a new ransomware group that started as recently as late 2024. The group offers classic ransomware, data ransom, and access monetization services with different profit sharing agreements for each. So far, Anubis has claimed responsibility for 3 hacks and lists a fourth as “New - Top secret.”
Researchers from Modat discovered 49K exposed Access Management Systems that were not correctly configured for secure authentication. Anyone could view unencrypted employee data such as names, email addresses, phone numbers, biometrics, photos, work schedules, and access logs. In some cases, Modat could even edit employee records, add fake employees, change access credentials, restrict access to legitimate employees, and grant access to malicious actors.
UK water supplier Southern Water disclosed in its financial report that a Black Basta ransomware attack from February 2024 cost the company roughly £4.5M. Leaked chat logs from the Black Basta ransomware gang show that the company offered to pay £750K after the attackers demanded $3.5M. Representatives from the company refused to clarify whether they paid the ransomware gang.
Claude 3.7 Sonnet generated a CRUD application with notably secure code but still with a potential denial-of-service vulnerability in the email validation regex, which uses greedy quantifiers that could lead to exponential processing time. Despite this issue, Claude 3.7 Sonnet outperformed previous models and competitors that generated code with XSS vulnerabilities.
Sendbird improved AWS security by utilizing a holistic cloud security model, transitioning to SSO with Okta, managing access requests for EC2 and databases, and setting up SIEM for cloud security. They also focused on secure container management and plan to continue enhancing security measures for their evolving infrastructure.
Researchers from AdaLogics experimented with using their Fuzz Introspector tool along with an LLM to generate fuzz testing harnesses. The fuzzing workflow that they created takes a project link and function name and uses Fuzz Inspector to extract the necessary data for the LLM. This data is then converted into a prompt that is sent to the LLM and then the LLM's output is extracted and manually verified for correctness.
Sponsored
Drata partnered with Wakefield Research to survey 300 U.S. IT and security professionals for the new State of GRC 2025 report [12]. The data shows that GRC programs, traditionally viewed as cost centers, are now increasingly being seen as revenue drivers. AI is poised to deliver further transformation in compliance. Read the full report →
RansomWhen is a tool to enumerate identities that can lock S3 buckets with KMS resulting in ransomware.
keycred is a tool for managing KeyCredentialLinks and certificate key pairs in Active Directory environments. It supports various authentication mechanisms and strict compliance with rules for validated writes.
Archipelo aims to improve software security and compliance by tracking the Software Development Lifecycle (SDLC) and tracking AI usage during the process.
In this post, PAN's Unit42 analyzes a sophisticated backdoor named Squidoor targeting Windows and Linux systems. The suspected Chinese threat actors exploited vulnerabilities in IIS servers to deploy web shells for persistent access and lateral movement. Squidoor allows attackers to maintain access, execute commands, and communicate stealthily with their operators across different networks using the Outlook API or tunnels over ICMP or DNS.
Amnesty International discovered that Serbian authorities covertly infected phones during police interviews using Cellebrite tools and a newly found spyware called NoviSpy. The spyware allowed for extensive surveillance, leading to Cellebrite suspending its services in Serbia and calls for independent investigations and safeguards against misuse of digital technologies.
The Department of Health and Human Services has fined Warby Parker $1.5M for HIPAA failures. The fines are levied due to a 2018 data breach in which data of 200K customers was stolen as well as two other smaller data breaches in 2020 and 2022. According to the HHS' Office of Civil Rights as of September 2024, Warby Parker still had not conducted an assessment of potential risks and vulnerabilities or taken appropriate steps to improve their security posture.
The U.S. Army soldier who admitted to leaking officials' phone records had researched countries without U.S. extradition and if hacking could be treason.
The FBI reported that North Korean hackers stole $1.5 billion from Bybit exchange on February 21 - the hackers are rapidly laundering the cryptocurrency.
Researchers have discovered a "drivethru hacking" vulnerability affecting over two dozen dashcam models.