TLDR INFORMATION SECURITY 2025-04-24

and Agentic AI, in one unified platform.

With SentinelOne, AI isn't just a buzzword—it's the unifying force and underlying strategy that gives you holistic autonomous protection.

Read more about SentinelOne Cloud Security

TEXAS CITY TAKES SYSTEMS OFFLINE AFTER CYBERATTACK

Abilene, Texas, suffered a cyberattack that caused server outages. Officials disconnected affected systems and hired cybersecurity experts. Emergency services remain operational, while card payment systems at government offices are currently unavailable. A complete recovery is expected to take several weeks.

SK TELECOM REVEALS CYBERATTACK, CUSTOMER USIM DATA STOLEN COULD BE USED IN ATTACKS

SK Telecom detected a malware attack targeting customer USIM data in mid-April. The company quickly isolated affected systems, notified authorities, and implemented security measures to prevent USIM swaps and suspicious authentication attempts. No data has appeared on the dark web, and no group has claimed responsibility for the incident.

GOOGLE FIXES CLOUD COMPOSER PRIVILEGE ESCALATION VULNERABILITY

Google has fixed a privilege escalation vulnerability impacting the Cloud Composer 2 managed workflow orchestration service. Cloud Composer allows any user with edit permissions to install a package from PyPi, which is then installed by Cloud Build. Prior to this fix, Cloud Build used the highly privileged default Cloud Build service account. An attacker could install a malicious PyPi package that exfiltrates the sensitive Cloud Build credentials.

HOW I MADE $64K FROM DELETED FILES — A BUG BOUNTY STORY

Security researcher Sharon Brizinov earned $64,000 by discovering secrets in deleted GitHub repository files. His research highlighted how Git retains copies of all files in its commit history, even after they are deleted from the working directory. Completely removing sensitive files requires specific tools, such as git filter-branch or git-filter-repo, as Git maintains references in its object storage for several weeks before performing garbage collection.

MCP: BUILDING YOUR SECOPS AI ECOSYSTEM

MCPs offer a standardized way for LLMs to interact with various tools, which can significantly aid SecOps teams in leveraging disparate security tools for investigations. AI Agents can currently perform specialized automations to complete tasks that require minimal human intervention, whereas MCPs can facilitate flexible workflows guided by humans. In the future, we may see vendors create more MCPs for their tooling, as well as a convergence between agents and MCPs.

GAINING LONG-TERM AWS ACCESS WITH CODEBUILD AND GITHUB

Attackers can exploit AWS CodeBuild and GitHub for persistent access after compromising an AWS account. They can modify an IAM role's trust policy to allow CodeBuild to assume it, link CodeBuild to an attacker-controlled GitHub repository, and create GitHub Actions workflows that execute commands using the permissions of the assumed role. This technique is more discreet than creating new IAM users with admin privileges, as the activity appears as legitimate CodeBuild operations from AWS infrastructure IPs, not external ones.

TERRA SECURITY (PRODUCT LAUNCH)

Terra uses AI agents for continuous web app pen testing tailored for an organization's environment and that adapts in real-time and autonomously runs tests when new vulnerabilities are discovered.

BUGFISH-NUKE

Bugfish-nuke is a Windows tool for emergency privacy that instantly deletes sensitive data and active logins to protect information during unexpected searches or warrantless seizures.

TEMPEST

Tempest is a C2 framework written entirely in Rust. It is designed for research and educational purposes.

GOOGLE WON'T DITCH THIRD-PARTY COOKIES IN CHROME AFTER ALL

Google has abandoned plans to replace third-party cookies with its Privacy Sandbox initiative after years of development struggles. Initially proposed in 2019, the company's alternatives, like FLoC and Topics API, faced criticism and delays. Google will now maintain cookie support indefinitely while continuing to develop privacy features for Incognito.

DPRK HACKERS STEAL $137M FROM TRON USERS IN SINGLE-DAY PHISHING ATTACK

North Korean hackers are targeting cryptocurrency organizations to generate funds amid international sanctions. Google's Mandiant identified multiple threat groups using custom malware tools across Windows, Linux, and macOS to infiltrate Web3 companies and steal large amounts of TRON.

OUTSIDE EXPERTS PICK UP THE SLACK ON TESTING OPENAI'S NEWEST MODEL RELEASE

AI red teaming company SplxAI chose to publish its own testing after OpenAI failed to publish a safety report for GPT-4.1 as it did for 4.0. SplxAI used the same prompts from its 4.0 testing to simulate a financial advisor and evaluate its safety in 11 categories across 1,000 simulated tests. GPT-4.1 performed 3x worse than GPT-4.0. Following OpenAI's guidance that 4.1 may require more explicit prompting, the SplxAI team developed a 1,400-word prompt over 5 hours of iterating that performed better than their initial prompt.

RANSOMWARE SURGE HITS US HEALTHCARE: AOA, DAVITA, AND BELL AMBULANCE BREACHED

Healthcare organizations in the US, including AOA, DaVita, and Bell Ambulance, were hit by ransomware attacks in 2025, affecting over 245,000 individuals and compromising sensitive patient data.

RUSSIAN HACKERS EXPLOIT MICROSOFT OAUTH TO TARGET UKRAINE ALLIES VIA SIGNAL AND WHATSAPP

Russian hackers are employing social engineering tactics, including impersonation and the use of messaging apps, to access Microsoft 365 accounts belonging to individuals and organizations associated with Ukraine.

1.33M OUTDATED DEVICES TURNED INTO THE LARGEST EVER BOTNET ATTACK

A huge botnet of 1.33 million outdated devices is wreaking havoc on global cybersecurity by executing unprecedented DDoS attacks.