TLDR INFORMATION SECURITY 2025-04-16

Watch the video →

NOTORIOUS IMAGE BOARD 4CHAN HACKED AND INTERNAL DATA LEAKED

The internet forum 4chan was hacked and taken offline on Tuesday. Screenshots of internal systems circulated online, exposing moderator lists and backend code. A janitor confirmed the breach's authenticity and noted that hackers may have accessed subscriber data.

2.6 MILLION IMPACTED BY LANDMARK ADMIN, YOUNG CONSULTING DATA BREACHES

Landmark Admin and Young Consulting have reported major data breaches that affect 2.6 million individuals. A ransomware attack on Landmark via stolen VPN credentials compromised 1.6 million people's sensitive personal data, while a breach at Young Consulting affected 1 million people, exposing names, SSNs, and health information.

KIDNEY DIALYSIS FIRM DAVITA HIT BY WEEKEND RANSOMWARE ATTACK

DaVita, a major kidney care provider, reported a ransomware attack over the weekend. The firm isolated affected systems, but some operations are still disrupted. DaVita is investigating and has not disclosed which ransomware gangs may be involved or if patient data was stolen.

THREAT SPOTLIGHT: HIJACKED AND HIDDEN: NEW BACKDOOR AND PERSISTENCE TECHNIQUE

ReliaQuest discovered a sophisticated attack chain in March 2025 that targeted finance and professional services sectors. It begins with Microsoft Teams phishing but evolves into a novel persistence technique that involves Component Object Model Type Library hijacking. The attack deploys previously unseen malware with a PowerShell backdoor that uses Telegram for command and control, showing similarities to earlier campaigns attributed to the "Storm-1811" threat group known for deploying Black Basta ransomware. To defend against these tactics, organizations should restrict external Microsoft Teams communications, block specific domains at the network edge, and implement various Windows security hardening measures.

RED TEAMING WITH SERVICENOW

MDSec, a British cybersecurity consultancy, provides an overview of ServiceNow functionality and ways to abuse it for red team functionality. This post discusses some access vectors, such as the API and login.do endpoint, and details how custom actions, discovery, orchestration, the LDAP listener, and relaying can be abused.

✅ See the checklist here

👉 Get a closer look with a customized demo of Drata

NETRISE (PRODUCT LAUNCH)

NetRise's Supply Chain Detection and Response (SCDR) platform provides a Software Bill of Materials (SBOM) covering various devices, which improves vulnerability detection and remediation and helps ensure regulatory compliance.

JUSTNIFFER

Justniffer is a network traffic analysis tool that allows you to analyze and trace HTTP traffic in a network. Justniffer allows capturing network packets and decoding of HTTP data, providing detailed information about HTTP requests and responses, such as the IP address of the client and server, the requested URL, header fields, and message content.

SEMGREP MCP SERVER

An MCP server for using Semgrep to scan code for security vulnerabilities.

OPENAI SHIPS GPT-4.1 WITHOUT A SAFETY REPORT

OpenAI launched GPT-4.1 without providing a safety report, deviating from its usual practice of publishing such reports. The omission has raised concerns among safety researchers and former employees, who argue that transparency in AI safety is critical.

NEW SSL/TLS CERTS TO EACH LIVE NO LONGER THAN 47 DAYS BY 2029

The Browser Forum voted to reduce SSL/TLS certificate validity from the current 398 days to just 47 days by 2029. The phased reduction begins in March 2026 with 200-day limits, dropping to 100 days in 2027. Tech giants unanimously supported the change to enhance security by limiting abuse of compromised certificates, though sysadmins worry about increased workload without automation.

MICROSOFT BLOCKS ACTIVEX BY DEFAULT IN MICROSOFT 365, OFFICE 2024

Microsoft announced that it will begin disabling all ActiveX controls in Windows versions of Office 2024 and Microsoft 365 starting later this month. After this change goes into effect, users will see a notification at the top of content that uses ActiveX stating: "BLOCKED CONTENT: The ActiveX content in this file is blocked." ActiveX can be re-enabled via the Trust Center.

NEW RESOLVERRAT MALWARE TARGETS HEALTHCARE AND PHARMA ORGS WORLDWIDE

A new malware called ResolverRAT targets healthcare and pharmaceutical organizations through phishing emails with malicious attachments.

CHINESE ESPIONAGE GROUP LEANS ON OPEN-SOURCE TOOLS TO MASK INTRUSIONS

A Chinese hacking group, UNC5174, uses open-source tools like VShell and WebSockets to hide its malicious activities and blend in with other cybercriminals.

GOOGLE ADDS ANDROID AUTO-REBOOT TO BLOCK FORENSIC DATA EXTRACTIONS

Google is adding a new feature to Android devices that automatically reboots them after three days of inactivity to enhance security by encrypting data more often.