Parse notes
Sponsored
Your SOC team has a ransomware playbook… but your OT engineers live in a different universe. Meanwhile, attackers exploit this gap daily—with 45% of ICS compromises starting in IT networks before crossing into industrial systems. At $4.73M per incident, that's an expensive disconnect!
Ascension, the second-largest private healthcare system in the US, suffered a data breach that exposed the personal and health information of 437,329 patients through a former partner's compromise. In December 2024, the partner faced a security incident due to a vulnerability in third-party software, leading to the theft of sensitive data, including names, contact details, SSNs, and medical visit records. This marks Ascension's second major cybersecurity incident, following a Black Basta ransomware attack in May 2024, prompting the company to offer affected patients two years of free identity monitoring.
AllTrust (Valsoft Corporation) is notifying 160,000+ people of a February data breach at its subsidiary, Aspire USA. Unauthorized access occurred February 12-15, with security teams interrupting an in-progress file transfer. Potentially compromised data includes names, driver's licenses, Social Security numbers, and financial details. No misuse has been reported.
SK Telecom suffered a massive cyberattack in April 2025 that compromised the personal data of 23 million South Koreans. This article navigates the timeline, highlighting potential losses of $5 billion if cancellation fees are waived. The malware was found in SKT's home subscriber server.
This tutorial shows how to use BallisKit tools (ShellcodePack and MacroPack Pro) to deploy Sliver C2 implants while evading security measures. It demonstrates how to set up a Sliver server on Linux, generate implant types, and weaponize them with ShellcodePack to bypass EDRs. It also explains how to create initial access payloads like LNK files and ClickOnce applications to deploy the obfuscated Sliver implants on target Windows machines.
This blog post explains how Google's Project Zero created a custom fuzzing harness to identify vulnerabilities in macOS's CoreAudio system by targeting Mach IPC messages, using a "knowledge-driven fuzzing" approach that merges automation with reverse engineering. Through iterative enhancements to the harness, including proper system initialization, API call chaining for stateful operations, mocking out problematic functionality, and refining message structures, the author identified a type confusion vulnerability (CVE-2024-54529) in the CoreAudio daemon. This vulnerability arose because several message handlers did not verify object types before function calls, allowing arbitrary code execution via crafted Mach messages sent from a sandboxed process.
Sponsored
This white paper outlines a DevSecOps maturity model [13] based on Datadog's work with thousands of organizations. The model maps key competencies and practices across culture, development, testing, deployment, operations, and incident response - with clear definitions that help you understand where you are today, and where you should aim
NomadScanner is a stealthy Windows port scanner designed for red teamers and penetration testers. It operates in-memory to avoid leaving disk artifacts and sends randomized HTTP probes for maximum stealth.
Valarian's platform, ACRA, segments data and communications into tightly controlled “compartments” to enforce environment isolation.
vAPI is a Vulnerable Adversely Programmed Interface, a Self-Hostable API that mimics the OWASP API's Top 10 scenarios through exercises.
The Bluetooth Special Interest Group (SIG) has announced Bluetooth Core Specification 6.1, which includes key improvements to the wireless communication protocol. One new feature is increased device privacy through randomized Resolvable Private Addresses (RPA) updates. The SIG states that varying the timing of address changes significantly complicates third parties' ability to monitor or relate device activities over time.
Law enforcement dismantled a 20-year-old botnet behind Anyproxy and 5socks services, arresting four suspects, including three Russians. The U.S. Justice Department charged them with operating illegal proxy networks and exploiting infected routers for profit. The FBI warned about these malicious services targeting vulnerable end-of-life routers, urging users to replace compromised devices to prevent cyberattacks.
A bipartisan Senate bill from Senators Bill Cassidy (R-La.) and Jacky Rosen (D-Nev.) seeks to ban federal contractors from using DeepSeek, a Chinese-made language model whose hosted version transmits data to China. This legislation addresses national security fears about sensitive data access by the Chinese government while allowing case-by-case waivers for national security or research reasons. The bill contributes to a broader initiative to limit Chinese AI in government, complementing a House bill prohibiting DeepSeek on government devices and similar laws in Texas, New York, and Virginia.
Google has agreed to pay Texas $1.375 billion to settle privacy violation claims related to geolocation tracking and data collection, reflecting a significant increase compared to earlier settlements.
Microsoft Teams is introducing a screen capture blocking feature for meetings, ensuring sensitive information is protected - users on unsupported platforms will be switched to audio-only mode.
Cybercriminals target old routers that no longer receive updates, exploiting vulnerabilities to install malware and create botnets.