TLDR INFORMATION SECURITY 2025-03-20

Get the Guide

CALIFORNIA CRYOBANK CONFIRMA DATA BREACH

California Cryobank, one of the largest reproductive tissue banks in the world, has disclosed a data breach that affects an undisclosed number of Americans. The hackers potentially stole data that includes SSNs, driver's license numbers, financial account numbers, and health insurance information. No known threat actor has claimed responsibility for the attack.

CRITICAL AMI MEGARAC BUG CAN LET ATTACKERS HIJACK AND BRICK SERVERS

MegaRAC BMC software enables remote server management, allowing admins to troubleshoot as if present. Eclypsium researchers identified a CVSS 10 vulnerability permitting remote, unauthenticated attackers to control affected servers. AMI, the software's developer, has issued patches to OEM manufacturers for customer rollout.

USE ONE VIRTUAL MACHINE TO OWN THEM ALL — ACTIVE EXPLOITATION OF VMWARE ESX HYPERVISOR ESCAPE ESXICAPE

VMware has released patches for three zero-day vulnerabilities in ESXi, which allowed threat actors to escape the hypervisor and access critical server data. The vulnerabilities are actively being exploited in the wild, posing a significant risk to organizations using VMware environments. It is crucial to patch affected systems promptly to prevent potential security breaches.

NEW VULNERABILITY IN GITHUB COPILOT AND CURSOR: HOW HACKERS CAN WEAPONIZE CODE AGENTS

Researchers from Pillar Security have discovered a new prompt injection technique on Cursor and GitHub Copilot. These systems use rules files to guide the prompting for the LLM, which is often distributed by open-source projects or from other untrusted locations. This attack involves utilizing invisible Unicode characters to hide malicious instructions for the LLM that can be used to instruct it to poison the generated code.

TURNING THE SECURITY FLYWHEEL

This post outlines seven security flywheels: reducing costs to raise security baselines, transitioning threat intelligence from push to pull, creating digital twins through asset inventory, enhancing detection via red teaming, identifying adjacent business benefits of security measures, implementing continuous control monitoring and forming federated teams that seek assistance instead of pushing initiatives. Each flywheel creates a cycle where initial investments yield benefits that can be reinvested, ultimately easing the burden on security teams while sustaining or improving security posture.

BYPASSING WINDOWS DEFENDER APPLICATION CONTROL WITH LOKI C2

Attackers can bypass Windows Defender Application Control with LOLBINs and Electron apps using tools like Loki C2. Modifying JavaScript in trusted Electron apps enables Node.js code injection to interact with the OS, allowing the execution of malicious payloads and the creation of advanced C2 agents like Dragon.

AWS IAM POLICY VISUALIZER (WEB APP)

AWS IAM Policy Visualizer is a web app that visualizes the relations in an IAM policy in graph format. The tool also provides a search function for large policies.

CVSS-BT

cvss-bt enriches the NVD CVSS scores to include Temporal/Threat Metrics.

STRINGREAPER

StringReaper extracts strings, such as JWT tokens and credentials, from remote process memory, saving time in engagements. It can filter memory regions and includes features like listing target sections and displaying remote environment strings.

NEW AKIRA RANSOMWARE DECRYPTOR CRACKS ENCRYPTION KEYS USING GPUS

A researcher has released an open-source decryptor for Akira ransomware that brute forces encryption keys. Akira generates unique keys for each file using four timestamp seeds, hashes them through 1,500 rounds, and encrypts them with another key, appending them at the end of each file. The researcher analyzed logs to estimate when the ransomware was active and used 16 4090s via RunPod & Vast.ai to decrypt a friend's files in 10 hours.

THE GREAT CNAPP RE-BUNDLE

With Check Point and Palo Alto exiting CNAPP, the field has consolidated around Wiz and a few leaders, losing much of its previous hype. CNAPP tools will revert to their components: CSPM for vulnerability management, ASPM for secure code development, and CADR for responding to cloud alerts.

MALWARE CAMPAIGN 'DOLLYWAY' BREACHED 20,000 WORDPRESS SITES

A malware campaign called 'DollyWay' has compromised over 20,000 WordPress sites globally, redirecting users to harmful sites since 2016. The campaign has evolved to include advanced evasion techniques and monetization strategies. GoDaddy researchers have linked this operation to a larger scam redirection system named 'DollyWay World Domination.'

CAPITAL ONE HACKER PAIGE THOMPSON GOT TOO LIGHT A SENTENCE, APPEALS COURT RULES

A federal appeals court has decided that Capital One hacker Paige Thompson's sentence was too lenient for stealing data from millions of customers - the case is now going back to the district court for resentencing.

RESEARCHERS USE AI JAILBREAK ON TOP LLMS TO CREATE CHROME INFOSTEALER

Researchers used AI tools to create malware that can steal login credentials from Google Chrome by manipulating generative AI platforms in a controlled narrative environment.

HACKERS HIDE VENOMRAT MALWARE INSIDE VIRTUAL HARD DISK IMAGE FILE

Hackers are hiding VenomRAT malware in virtual hard disk image files to infect devices.