Parse notes
Sponsored
ReversingLabs released its third annual Software Supply Chain Security Report [4], spotlighting mounting attacks on AI, Crypto, Open Source, and Commercial Software.
Hackers accessed PowerSchool's support portal months before a December 2024 data breach, potentially impacting 70 million individuals. They used compromised credentials to steal personal data, including names, contact details, birth dates, medical information, and Social Security numbers.
Cato Networks has detected a new botnet named Ballista that is targeting unpatched TP-Link Archer routers using the CVE-2023-1389 exploit. Researchers suggest the hacker is likely from Italy and that the botnet is in its early stages, with evolving malware capabilities. Unlike other DDoS-for-hire botnets, Ballista's malware can also execute arbitrary commands on remote systems.
Binary Security found undocumented Azure API Connections enabling privilege escalation. With Reader permissions, attackers can GET requests to backend resources like Key Vaults, Defender ATP, and third-party services such as Jira and Salesforce.
Attackers are using SSE-C to encrypt objects in ransomware attacks on AWS accounts. Jesse Griggs established a test environment to measure the alert response time through CloudWatch and how quickly Lambda could block the attacker or disable SSE-C. He noted alerts took about 6 minutes to arrive, while automated responses occurred immediately.
This article explores modern phishing techniques, from basic HTML pages to those that bypass multi-factor authentication. It covers attack methods such as Browser-in-the-Browser (BITB), Attacker-in-the-Middle (AITM), and WebRTC, as well as infrastructure considerations for hosting and delivery. Phishing has evolved with sophisticated techniques using cloud provider domains, making detection harder. Effective defense requires multi-layered approaches combining technical controls and human awareness.
Sponsored
Organizations have been using SIEMs for decades — but the needs of SOC leaders have changed dramatically. Move to a modern SIEM [11].
devcontainer always tries to find the best way to install the most popular tools, so they can all work seamlessly, and at the same time add security by default.
Fast Incident Response (FIR) is a cybersecurity IR management platform from the French Cert Societe Generale.
StreetCred is a tool created for Red Team operators to test default credentials and execute scripts over SSH and WinRM.
CISA's 100-member penetration testing team was terminated after Trump's DOGE unit canceled their contract, leading to cuts in another red team. The election security group EI-ISAC also shut down due to funding loss, raising concerns about cyberattack vulnerabilities.
Bybit experienced the largest cryptocurrency theft ever, totaling $1.4 billion, when attackers compromised a developer machine and injected malicious JavaScript into Safe{Wallet} UI, altering what signers saw. This off-chain attack tricked signers into approving a delegatecall that replaced the proxy implementation with the attackers' code, giving them control over all funds. The Lazarus group from North Korea executed this sophisticated attack by exploiting human verification vulnerabilities and the lack of human-readable formats for complex smart contract operations in the EIP-712 standard.
Over 110,000 iOS apps leak secrets, including sensitive data like cloud storage keys. Most apps expose at least one hardcoded secret, risking user breaches. Apple's App Store does not check for these vulnerabilities, underscoring the need for better security practices.
A criminal operation is spreading malware through fake Reddit and WeTransfer pages using the Lumma stealer.
Chinese hackers from the Volt Typhoon group breached a US electric utility in Massachusetts for over 300 days, collecting sensitive operational data.
Facebook disclosed a FreeType 2 vulnerability that could allow arbitrary code execution in all versions up to 2.13, with reports of active exploitation in attacks.