Parse notes
UChicago Medicine released a statement that the data of 38K patients may have been exposed in a July 2024 breach. The data breach was caused by a third-party debt collector's system breach. The exposed data may include SSNs, addresses, dates of birth, medical information, and financial account information.
Threat actors are exploiting Google Apps Script to create phishing pages that mimic legitimate sites, enhancing their credibility. This tactic reduces the likelihood of detection by security tools. As a result, users may be more easily deceived into providing sensitive information.
Cisco Talos has discovered three malware families—CyberLock ransomware, Lucky_Gh0$t ransomware, and Numero malware—that disguise themselves as legitimate AI tool installers for ChatGPT, InVideo AI, and NovaLeadsAI. These threats spread through SEO poisoning, social media, and messaging platforms, specifically targeting sales, technology, and marketing businesses. CyberLock demands $50,000 in Monero cryptocurrency, Lucky_Gh0$t encrypts files under 1.2GB while destroying larger ones, and Numero renders Windows systems unusable by interfering with the graphical interface.
Detection-in-depth is a detection engineering concept modeled after the principle of defense-in-depth, in which security teams create detections to catch an attacker at every step of the attack chain. Detections (including out-of-the-box detections that come with a platform) must be fine-tuned to the specific environment to reduce false positives. They should be tested using threat emulation tools such as Atomic Red Team and penetration testing activities.
In a recent engagement, a penetration tester from Neodyme tested a tool that converted HTML to PDF. The tester's first instinct was to attempt Server-Side Request Forgery (SSRF), which they succeeded in doing in a test environment. They then discovered that they could enumerate information about the engine and local files. The tester then found an exploit against the outdated Chromium browser used by the converter to render the HTML and adapted it to obtain shellcode execution on the server.
NETSCOUT analyzed TCP SYN segments from honeypots to identify network security patterns, examining source addresses, IPv4 TTL values, and TCP header lengths. The study found no source address spoofing despite expectations, discovered that TTL values varied widely from the same sources due to path diversity, and identified that many anomalies correlated with crafted packets from suspicious networks. The research demonstrates that analyzing TCP header patterns can effectively distinguish legitimate traffic from potential threats, with 20-byte headers and zero sequence numbers as strong indicators of malicious activity.
Sponsored
A leaked password gave an attacker access to an internal tool—with permissions that reached all the way to production. The root cause? No fine-grained access control. Explore what went wrong—and how to prevent it—with Oso's Nightmares of Authorization series [11].
The SOC Assessment Tool provides a comprehensive assessment tool to evaluate the maturity of a Security Operations Center (SOC). It provides actionable insights upon completion of the assessment.
A LinkedIn post by Ti3rius about 10 “hidden gem” burp extensions he commonly uses, which are not in the top 30 most popular in the BApp Store.
Monkey365 is an open-source security tool designed for conducting security configuration reviews of Microsoft 365, Azure subscriptions, and Microsoft Entra ID. It simplifies the process by eliminating the need to learn complex APIs or admin panels. The tool identifies security gaps and offers recommendations for optimal configuration to enhance the security and effectiveness of your Microsoft 365 tenant or Azure subscription.
This guide shows how to build an internal cheat for the AssaultCube game by injecting a custom DLL into the game's memory. It explains how to hook into game functions like damage and add advanced features such as aimbot and wallhacks. The project is intended to be a technical learning tool for understanding game memory and function hooking.
The U.S. Treasury Department has sanctioned Funnull Technology, a Philippines-based company facilitating numerous malicious websites. These sites are connected to cyber scams that have resulted in over $200 million in losses for Americans. The sanctions aim to disrupt the operations of this company and its role in cybercrime.
Google's Threat Intelligence Group discovered APT41 using the "TOUGHPROGRESS" malware, which exploits Google Calendar for command and control communications. The malware is delivered through spear-phishing emails containing ZIP archives hosted on compromised government websites. To evade detection, the malware uses a three-stage infection chain (PLUSDROP, PLUSINJECT, and TOUGHPROGRESS) with advanced obfuscation techniques, including 64-bit register overflow and control flow obfuscation. Google disrupted the campaign by developing custom detection signatures, terminating attacker-controlled Calendar accounts and Workspace projects, and adding malicious domains to Safe Browsing blocklists.
Microsoft Authenticator will discontinue its password autofill feature in July, prompting users to either export their passwords or switch to Microsoft Edge.
A vulnerability in Apple's Safari browser allows attackers to exploit a fullscreen trick to illicitly acquire user account credentials, prompting users to be cautious with sensitive data entry.
Two parties involved in an AI-generated robocall that mimicked then-President Joe Biden and discouraged voting in the New Hampshire Democratic primary have agreed to settle a civil lawsuit filed by voting groups.