TLDR INFORMATION SECURITY 2025-05-19

Global Threat Intelligence Report.

The report delivers expert-curated intelligence on adversary playbooks, including the TTPs of the five major ransomware-as-a-service groups responsible for nearly half of all attacks. On the solution side, it reveals how security teams can cut critical vulnerability patching workloads by 83% [4] by focusing on exploitability rather than severity scores.

materialize. Download the 2025 Global Threat Intelligence Report

BROADCOM EMPLOYEE DATA STOLEN BY RANSOMWARE CROOKS FOLLOWING HIT ON PAYROLL PROVIDER

A September 2024 ransomware attack on Business Systems House (BSH), ADP's Middle Eastern partner, resulted in the theft of Broadcom employee data. El Dorado/BlackLock claimed responsibility. Stolen data potentially included personal information, financial details, and employment records. ADP confirmed that only a small subset of clients in the Middle East countries were affected.

PRODUCTION AT STEELMAKER NUCOR DISRUPTED BY CYBERATTACK

North American steel giant Nucor halted some production after hackers accessed its computer systems. The company is working with experts and police while restarting operations. No one has claimed responsibility for the attack, and the financial impact is still unknown.

HARD-CODED API KEY IN AI NOTE TAKING APP EXPOSED USERS' PRIVATE TRANSCRIPTS

A security researcher from Tenable discovered that a new release of its Mac desktop client included an AssemblyAI API key. This API key could be retrieved from the Electron app to enumerate and download any user's private meeting transcript. The researcher notified Granite, whose CEO responded by removing the offending API key and notifying the researcher that the vulnerability had only affected a smaller group of TestFlight users.

WHAT DOES EU'S BUG DATABASE MEAN FOR VULNERABILITY TRACKING?

The European Union's cyber agency ENISA launched the European Vulnerability Database (EUVD), a new vulnerability tracking system with a numbering format that includes CVE references. Experts debate whether this additional database will help create redundancy or further fragment the vulnerability tracking landscape.

CYBERSECURITY (ANTI)PATTERNS: BUSYWORK GENERATORS

Busywork generators are solutions that create a disproportionate amount of busywork compared to the security value they add. They can be introduced due to not fully understanding the root cause of a security issue, prioritizing the wrong solution, and lacking organization-wide mechanisms to enforce the solution. Security teams can avoid busywork generators by introducing security guardrails and adopting a reasonable threshold of acceptable alerts.

ANALYZING CVE-2025-31191: A MACOS SECURITY-SCOPED BOOKMARKS SANDBOX ESCAPE

Microsoft discovered a vulnerability in macOS that allowed applications to escape the App Sandbox without user interaction while researching macro exploit detection for Microsoft Office in April 2024. Security-scoped bookmarks are a macOS mechanism that bypasses the App Sandbox using explicit, persistent user choices. Microsoft researchers discovered that the Keychain entry used for security-scoped bookmarks can be overwritten to sign new bookmarks.

Safeguard what matters most.

GREENMASK

Greenmask is a powerful open-source utility designed for logical database backup dumping, anonymization, synthetic data generation, and restoration.

BOLTHOLE

A proof-of-concept reverse shell that abuses Windows' ClickOnce feature.

DFC

The dfc tool helps you migrate your Dockerfiles to use Chainguard Images.

FBI WARNS OF ONGOING SCAM THAT USES DEEPFAKE AUDIO TO IMPERSONATE GOVERNMENT OFFICIALS

The FBI warns of an ongoing scam where criminals use AI-generated voice deepfakes to impersonate senior US officials. The scam has targeted government officials and their contacts since April 2025. The attackers establish rapport before sending malicious links. Officials advise verifying identities independently and watching for subtle imperfections in communications.

THE KIDS ONLINE SAFETY ACT IS BACK, WITH THE POTENTIAL TO CHANGE THE INTERNET

If passed, the Kids Online Safety Act (KOSA) would hold social media platforms accountable for protecting minors from various harms. Human rights groups fear censorship implications, while companies like Apple, Microsoft, and X support the legislation. Google and Meta remain opposed.

RUSSIA-LINKED SPYPRESS MALWARE EXPLOITS WEBMAILS TO SPY ON UKRAINE

A Russian hacking group called Sednit is spying on Ukraine and its allies using email bugs and fake messages. It sends phishing emails that sneaks malware into webmail systems like RoundCube, Zimbra, and Horde.

NEW 'DEFENDNOT' TOOL TRICKS WINDOWS INTO DISABLING MICROSOFT DEFENDER

Defendnot is a tool that deceives Windows into disabling Microsoft Defender by masquerading as a legitimate antivirus using a concealed Windows feature.

COINBASE FLIPS $20M EXTORTION DEMAND INTO BOUNTY FOR INFO ON ATTACKERS

Hackers bribed Coinbase staff to steal personal data from some users, demanding $20 million, but Coinbase refused and instead offered the same amount for tips to arrest the criminals.

THE STATE OF DEVSECOPS IN THE DOD (3 HOUR READ)

DevSecOps is transforming software delivery in the Department of Defense by enhancing agility, security, and effectiveness through software factories, continuous integration, and cultural changes.