TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-04-09

5 sections16 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01ATTACKS & VULNERABILITIES

UMMC FACING CLASS ACTION LAWSUIT FOR ENABLING CYBERSTALKING CAMPAIGN

The University of Maryland Medical Center (UMMC) is being sued by current and former employees for enabling a pharmacist to conduct cyberstalking due to a lack of security practices. The pharmacist used a keylogger and installed spyware on at least 400 computers in UMMC to obtain employees' usernames and passwords to access the accounts of about 80 female co-workers for nearly a decade. The hacker hacked victims' cloud accounts to steal private information and used internet-connected cameras to watch the victims in their homes.

links.tldrnewsletter.com2 min read

FLAW IN ESET SECURITY SOFTWARE USED TO SPREAD MALWARE FROM TODDYCAT GROUP

A threat actor known as ToddyCat has exploited a vulnerability in ESET's antivirus scanner. The vulnerability could allow privileged attackers to plant a malicious DLL and execute it through the antivirus scanner. The attackers in this campaign are using a tool dubbed TCDSB, which seems to be an extension of EDRSandBlast, to alter key components of the OS and disable alerts.

therecord.media2 min read

OCC EMAIL SYSTEM BREACH DESCRIBED AS ‘STUNNING, SERIOUS'

On February 11, the OCC, the US's banking regulator, discovered unusual activity between a system admin account and user mailboxes. Unknown attackers had accessed over 150,000 emails since June 2023. Security analyst David Shipley called the intrusion "massively serious," posing a potential threat to national banking infrastructure. The OCC, which regulates all national banks, has hired third-party cybersecurity experts for a full investigation while asserting that its security controls meet or exceed NIST standards.

csoonline.com3 min read

02STRATEGIES & TACTICS

CLOUD INCIDENT READINESS: KEY LOGS FOR CLOUD INCIDENTS

This post ranks key logs for cloud incident readiness as must-have, should-have, and nice-to-have for Microsoft, AWS, and Google. It uses real-life incident response cases to highlight the importance of enabling and retaining the right logs for security monitoring and analysis.

invictus-ir.com6 min read

COMBINING DLL SIDELOADING AND SYSCALLS FOR EVASION

This article examines DLL Sideloading and using Direct Syscalls as evasion techniques to bypass Antivirus and EDR solutions by loading malicious DLLs via legitimate applications. Using hijacking and Direct Syscalls, the author shows how to create and execute a malicious DLL that evades static detection and executes shellcode on a victim machine. Elastic YARA rules and Havoc C2 are used for generating and testing shellcode, enhancing evasion against security defenses.

medium.com4 min read

GAMAREDON CAMPAIGN ABUSES LNK FILES TO DISTRIBUTE REMCOS BACKDOOR

Cisco Talos is tracking an ongoing campaign targeting users in Ukraine with malicious LNK files that resemble war-related files to eventually download the Remcos backdoor. The LNK files run a PowerShell command to launch a decoy file and download the second-stage zip file containing the backdoor. The second stage payload then uses DLL side-loading to execute the Remcos payload. Cisco believes that this campaign is associated with Gamaredon.

blog.talosintelligence.com7 min read

03LAUNCHES & TOOLS

Sponsored

THE (PROVEN) IMPACT OF PASSWORD MANAGEMENT ON ENTERPRISE SECURITY

In a recent survey of enterprise end users by Bitwarden, 96% of organizations say Bitwarden has improved their security posture and 81% have reduced reused passwords. That's just another reason why Bitwarden Password Manager [11] is trusted by millions to store, share, and protect login credentials and sensitive enterprise data. Get the report [10].

bitwarden.comSponsor

ATTEST-BUILD-PROVENANCE

The attest-build-provenance action generates signed build provenance attestations for workflow artifacts. These attestations associate an artifact with its digest to SLSA build provenance predicate in the in-toto format, accompanied by a verifiable signature from a short-lived Sigstore certificate. The attestation generation differs based on repository visibility: public repositories use the public Sigstore instance, while private repositories utilize GitHub's private Sigstore.

github.comGitHub repository

GHIDRAMCP

ghidraMCP is a Model Context Protocol server that allows LLMs to autonomously reverse engineer applications. It exposes numerous tools from core Ghidra functionality to MCP clients.

github.comGitHub repository

LNAV - THE LOGFILE NAVIGATOR

lnav is a terminal log file viewer that supports decompressing files, detecting file format, merging files based on timestamp, tailing files, and building an index of errors and warnings.

github.comGitHub repository

04MISCELLANEOUS

FIVE VPN APPS IN THE GOOGLE PLAY AND APP STORE HAD LINKS TO CHINESE MILITARY

A joint investigation by the Tech Transparency Project and the Financial Times found that at least five VPN apps present in both the App Store and Google Play store had links to a company associated with the Chinese military. Three of the apps have racked up more than a million downloads. The five apps cited were Turbo VPN, VPN Proxy Master, Thunder VPN, Snap VPN, and Signal Secure VPN (unaffiliated with the messaging app).

9to5mac.com2 min read

ENHANCING CLOUD SECURITY IN AI/ML: THE LITTLE PICKLE STORY

Python pickles are a serialization format that is commonly used in AI/ML workflows in Python. Pickles that come from unsafe sources can result in arbitrary code execution due to invalidated object loading, corrupt models, exposure of sensitive data, or lead to sensitive information disclosure due to a lack of encryption. One strategy for scanning pickle files using static code analysis is to generate a list of all Python libraries that are used in your environment, validate any pre-built rules in existing static code analysis tooling, and write custom rules in tools like Semgrep to identify pickling and unpickling methods.

aws.amazon.com4 min read

WHATSAPP FOR WINDOWS FLAW COULD LET HACKERS SNEAK IN MALICIOUS FILES

A security flaw (CVE-2025-30401) in WhatsApp for Windows allowed hackers to send malicious files to users, posing a risk to those interacting with attachments. The vulnerability could trick users into opening harmful code disguised as harmless files. To stay safe, users should update WhatsApp to version 2.2450.6 or later and be cautious when opening file attachments.

hackread.com2 min read