Parse notes
Researchers have uncovered a dark web operation involved in collecting facial ID images and government-issued identity documents. The threat actor bypasses Know Your Customer (KYC) identity verification systems using these biometrics. iProov recommends the use of multi-layered verification systems to defend against these threats.
Cybercriminals have targeted Internet service providers through a campaign involving information stealers, cryptocurrency miners, and data exfiltration tools. These brute-force attacks aim to compromise systems, disable security features, steal cryptocurrency, and deploy malware.
Microsoft discovered five Paragon Partition Manager BioNTdrv.sys driver flaws, one of which was actively used by ransomware gangs in zero-day attacks to gain SYSTEM privileges in Windows. The drivers are signed by Microsoft, so they can also be used in Bring Your Own Vulnerable Driver (BYOVD) attacks. Microsoft recommends enabling the Microsoft Vulnerable Driver Blocklist to prevent BYOVD attacks.
German IT firm ERNW observed that an attacker compromised a customer who acted as a service provider that used RDP to connect to its customers' machines. ERNW extracted the Bitmap cache files from the RDP server to partially reconstruct the attacker's RDP sessions utilizing open-source tools. The post features screenshots displaying some of the images that ERNW managed to reconstruct.
Active Directory Web Services (ADWS) is a default-enabled service on Active Directory domain controllers that allows clients to interact with the local LDAP service using SOAP messages without requiring user authentication. A group of interns from X-Force Red implemented the protocol stack in a tool and Python library named SoaPy. Before this, interactions with ADWS were limited to Microsoft or .NET tools, restricting protocol usage to Windows hosts.
Google DeepMind's AI security Team has developed an evaluation framework to test an AI system's susceptibility to indirect prompt injection attacks. The framework employs a hypothetical scenario where an AI agent receives a fictitious email conversation. It uses three prompt injection methods: actor-critic, where a model generates and refines injections based on success probability; beam search; and Tree of Attacks with Pruning, which aims to make the AI violate safety protocols.
Sponsored
Nudge Security has discovered over 1,000 unique GenAI tools [11] in customer environments to date, with new ones like DeepSeek popping up daily. Download this guide [10] to learn how to take a proactive
Rogue is an advanced AI security testing agent that uses Large Language Models to discover and validate web application vulnerabilities. Unlike traditional scanners, Rogue analyzes application behavior, generates test cases, and validates findings through autonomous decision-making.
Singulr AI enables customers to discover every generative AI and obtain information on its use within the organization, identify risky AI services, approve safe AI services, and enforce AI-related policies.
RogueApps is a collection of TTPs associated with OIDC/OAuth 2.0 application attacks.
Let's Encrypt is adding a 6-day certificate option alongside the default 90-day certificate to support automation and improved certificate management.
CISA has announced that it will maintain its defense against Russian cyber threats despite a temporary pause on offensive actions by the Trump administration. The agency confirms its commitment to protecting U.S. Critical Infrastructure from cyber threats, including those from Russia.
Report on the best product that uses AI to create fixes for issues discovered in SAST.
Twitch stars Valkrae, Cinna, and Emiru were chased down in public, while Amouranth was robbed at gunpoint on the same night.
Microsoft reversed the buggy update that caused the Microsoft 365 outage and will review change management.