TLDR INFORMATION SECURITY 2025-04-11

Book a demo today with TLDR for $1,000 off.

AKIRABOT SPAMMED 80,000 WEBSITES BY EMPLOYING CAPTCHA BYPASS & NETWORK EVASION TECHNIQUES

AkiraBot has spammed 80,000+ websites since September 2024. It uses AI to create personalized messages that mention specific website content, helping bypass spam filters. The framework employs advanced CAPTCHA-bypassing techniques and rotates IP addresses to avoid detection.

US SENSOR GIANT SENSATA ADMITS RANSOMWARE DERAILED OPS

Sensor manufacturer Sensata reported a ransomware attack on April 6 that encrypted devices and disrupted operations including shipping, manufacturing, and support functions. While the company is still investigating the breach with cybersecurity experts, it doesn't expect material financial impact yet the situation is still developing.

HACKERS EXPLOIT WORDPRESS PLUGIN AUTH BYPASS HOURS AFTER DISCLOSURE

Hackers quickly exploited a security flaw in the OttoKit plugin for WordPress, allowing unauthorized access to websites. Users are urged to update to version 1.0.79 to prevent potential breaches.

THE S IN MCP STANDS FOR SECURITY

Model Context Protocol (MCP) is a new standard that defines how LLMs integrate with tools. It lacks authentication or other security integrations by default. Some risks associated with MCPs are injection risks due to poor coding practices, tool poisoning due to embedding malicious instructions inside the MCP tool's description, silently redefining tool definitions, and cross-server tool shadowing. Users and developers should continue to employ security fundamentals such as using trusted sources, employing input validation, and pinning MCP server + tool versions. Platform builders can enhance security by displaying full tool metadata, using integrity hashes for server updates, and enforcing session security.

HOW TO USE THE NEW CLOUDTRAIL NETWORK ACTIVITY EVENTS FOR VPC ENDPOINTS

AWS recently launched a new class of CloudTrail logs that track network activity events for VPC endpoints. These logs can be used to assess the impact of proposed VPC endpoint policies in organizations that don't currently use endpoint policies and to detect data exfiltration. Any organization that uses VPC endpoints should enable network activity events for VpceAccessDenied errors and evaluate further events based on cost and utility.

ENTROPY TRIAGE: A METHOD TO REPAIR FILES CORRUPTED BY FAILED RANSOMWARE ENCRYPTION

Sometimes after an organization pays a ransom and receives a decryptor, the decryption process may still fail due to the encryption process failing or being interrupted. Researchers from MOXFIVE have developed a technique called entropy triage that processes each block of a file by comparing the Shannon entropy before and after decryption and writing the lower entropy block to disk. MOXFIVE has had success with this method but notes that it requires skilled cryptographers and data to be sufficiently encrypted or decrypted for the analysis.

OCTANE SECURITY (PRODUCT LAUNCH)

Octane continuously reviews on-chain code to detect security weaknesses and recommend one-click fixes.

AGENT-WIZ

A CLI tool for threat modeling and visualizing AI agents built using popular frameworks like LangGraph, AutoGen, CrewAI, and more.

FROGPOST

FrogPost is a Chrome extension that helps developers test and analyze the security of postMessage communications between iframes, helping developers and security professionals find vulnerabilities in implementations.

UK CYBER SECURITY BREACHES SURVEY 2025 REVEALS PERSISTENT THREATS IN EVOLVING DIGITAL LANDSCAPE, BATS FOR ENHANCED CYBER RESILIENCE

The 2025 UK Cyber Security Breaches Survey shows 43% of businesses experienced cyber attacks. Phishing was the most common attack pattern while ransomware attacks doubled. Despite improved cybersecurity measures among small businesses, board-level responsibility has declined, creating gaps as threats continue to evolve.

GOOGLE EYES USER BROWSING DATA SEARCH IN NEW PATENT FILING

Google has filed a patent for a system that helps users search their digital history using natural language. This system aims to make it easier for users to find previously viewed content without remembering exact keywords. While promising convenience, concerns about data privacy and user control have been raised.

RESEARCHERS HACK SOURCE CODE FROM GOOGLE GEMINI

As part of Google's bugSWAT event, a group of security researchers managed to exfiltrate a sensitive binary from Gemini's Python Sandbox. The researchers first discovered that the sandbox provides full access to the os library which allowed them to map the sandbox's filesystem and locate the /usr/bin/entry/entry_point binary which they exfiltrated by returning 10MB chunks of base64 encoded data to the frontend. After reassembling it, the researchers found source code for the sandbox's Python interpreter and protobufs that describe how sensitive data is classified, handled, and transmitted within Google.

CHINA-BASED SMS PHISHING TRIAD PIVOTS TO BANKS

The Smishing Triad, based in China, is expanding rapidly and selling mobile phishing kits to target global financial institutions and a wide range of industries worldwide.

MICROSOFT: LICENSING ISSUE BLOCKS MICROSOFT 365 FAMILY FOR SOME USERS

Some Microsoft 365 Family users are experiencing a licensing issue that prevents access to services, prompting reports of subscription renewals despite the fact that their subscriptions are still active.