Parse notes
Sponsored
Your Google Workspace [5] or Microsoft 365 platform is where your company works, communicates, and collaborates — it's your business's critical infrastructure. Protecting it with a patchwork of native security and point solutions leaves gaps – the biggest being visibility _after_ an attacker has made it inside.
A data leak on X, possibly due to a disgruntled employee, exposed information from 2.87 billion users. The leaked data includes a wealth of profile details but does not contain email addresses. Despite the massive breach, X has not acknowledged the incident publicly.
After discovering a vulnerability on BlackLock's data leak site, Resecurity researchers have been covertly acquiring information since late 2024. The researchers exploited a Local File Inclusion vulnerability to retrieve server-side configuration details and credentials along with plain text server logs, SSH credentials, and command-line histories. Resecurity researchers utilized their position to warn law enforcement and potential victims before leaks occurred.
Researchers at Qualys have discovered three new vulnerabilities in Ubuntu 23.10 and 24.04 that could allow a local attacker to create user namespaces with full administrative privileges. The bypass mechanisms utilize aa-exec, busybox, or LD_PRELOAD. Canonical has shared that they will be treating these vulnerabilities as limitations of a defense-in-depth mechanism and shared recommended hardening steps to address them.
Apple has added a new feature called Endpoint Security events for TCC modifications in MacOS 15.4. Exposed with ES_EVENT_TYPE_NOTIFY_TCC_MODIFY flag, this feature allows security tools to detect and possibly override user decisions on granting access to protected resources. The events will provide information on when a TCC permission is granted or revoked, helping users monitor and control access to their system.
Many threat actors utilize Telegram bots as a method of establishing C2 communication. In this technique, a threat actor creates a new Telegram bot, embeds a token for the bot in their malware and deploys it, then malware then periodically polls Telegram's servers to check for new commands sent to the bot and executes any commands that are sent while relaying the results back to the Telegram server. This post deep dives into a case study in which a malware that was discovered on VirusTotal was hijacked by the author, who discovered data from the malware developer's system which they used for testing.
Use Linux Landlock to run any Linux process in a secure, unprivileged sandbox. This tool is like firejail, but lightweight, user-friendly, and baked into the kernel.
Brutespray serves as a utility for executing password spraying attacks by utilizing outputs from scanners like nmap or Nexpose.
goLAPS is a tool to retrieve LAPS passwords from an Active Directory domain.
Browser-native ransomware could target data stored in browsers, bypassing traditional security measures. This type of ransomware is hard to detect and can lead to severe consequences, such as compromising email services and stealing sensitive company files.
Malicious actors can track Android, Windows, or Linux devices through an Apple Find My network vulnerability using malware that mimics AirTag signals. They can monitor movements remotely, affecting smartphones, computers, smart TVs, etc. Apple has issued patches, and users should disable Bluetooth when not in use and keep devices updated.
Zhou Shuai is a Chinese hacker that first started hacking in his senior year of high school in 1996. Shuai's early motivations as a founding member of Green Army were idealistic as he sought to be a hacktivist vigilante. Shuai eventually ended up becoming more commercial and less idealistic and is now designated as APT27 and sanctioned by the U.S. Department of the Treasury.
The Rust project has announced that it will adopt the Ferrocene Language Specification (FLS) developed by Ferrous Systems and maintain it as part of the core project.
North Korea has opened a new research center to focus on AI-powered hacking.