TLDR INFORMATION SECURITY 2025-06-17

Watch the video (03:13 minutes)

TREND MICRO FIXES CRITICAL VULNERABILITIES IN MULTIPLE PRODUCTS

Trend Micro has released security updates to fix multiple critical-severity remote code execution (RCE) and authentication bypass vulnerabilities in its Apex Central and Endpoint Encryption (TMEE) PolicyServer products. Trend Micro Endpoint Encryption PolicyServer is a central management server for TMEE, providing full disk and removable media encryption for Windows endpoints. The vulnerabilities include three pre-auth RCEs that stem from insecure deserializations and an auth bypass due to a broken auth implementation.

OVER 8M EXPOSED AFTER MAJOR CAR-SHARING APP BREACH

India's largest ride-sharing app, Zoomcar, has notified the SEC that it suffered a data breach that exposed the data of 8.4M individuals. Zoomcar was notified of this breach when the threat actor contacted certain employees about their unauthorized access. The breached data includes names, phone numbers, car registration numbers, personal addresses, and email addresses, but does not include financial information or plaintext passwords.

RANSOMWARE GANG EXPLOITS SIMPLEHELP RMM TO COMPROMISE UTILITY BILLING FIRM

The CISA has released an advisory that a path traversal vulnerability in the SimpleHelp Remote Management and Monitoring (RMM) tool is actively exploited. Sophos reported that the DragonForce ransomware gang is chaining this vulnerability with two other vulnerabilities to deploy ransomware across client networks. Following encryption, the threat actors employ a double extortion strategy, demanding a ransom for the data and threatening to leak the stolen data.

CALL STACKS: NO MORE FREE PASSES FOR MALWARE

Elastic's Windows endpoint telemetry analyzes call stacks to identify both the activity and the performer, enhancing malware detection. The call stacks, or "return address stacks," can be manipulated by malware using return address spoofing and stack frame crafting to conceal malicious actions. Elastic enriches these stacks with module information, applies behavioral tagging, and detects sophisticated evasion tactics like SilentMoonwalk call stack spoofing.

INSIDE THE LOCKBIT'S ADMIN PANEL LEAK: AFFILIATES, VICTIMS AND MILLIONS IN CRYPTO

On May 7, an anonymous hacker named "xoxo from Prague" breached LockBit's admin panel and leaked an SQL database containing operational data from December 2024 to April 2025. The leak revealed that LockBit earned approximately $2.3 million from ransom payments during this period, primarily targeting China and the manufacturing sector, while its registration fee claims were grossly inflated at only $10,000 to $11,000. Additionally, the leak disclosed details about 75 affiliates and their connections to other ransomware groups like RansomHUB, HellCat, and Evil Corp, with affiliates adjusting ransom demands to match company revenues and specific geographic targets.

DECEPTION FUNDAMENTALS: THE MISSING PIECE IN YOUR SECURITY STRATEGY

Current deception technologies fail against skilled attackers due to obvious fake assets that don't align with real infrastructure patterns. Attackers exploit legitimate services and trusted channels, like GitHub OAuth flows, for their own deception. Effective deception involves analyzing real asset patterns and deploying fake assets through trusted communication channels, following the formula: Deception Assets + Communication Channels = Desired Effect. The key principle is congruence—attackers engage with deceptions only when found through expected channels, and the assets match their experience, leading to methodical validation that increases their dwell time.

SHARPEYE

SharpEye is an advanced Linux intrusion detection and system security monitoring framework. It utilizes advanced analytics, machine learning, and behavior-based detections.

ZIP_SMUGGLING

zip_smuggling is a Python utility that creates zip files that contain additional data embedded within the file structure that is not displayed when the zip is examined or decompressed, but can be retrieved via PowerShell via an LNK within the zip file.

IAM-LENS

Get visibility into the IAM permissions in your AWS organizations and accounts. Use your AWS IAM policies (downloaded via iam-collect) and evaluate the effective permissions.

THE META AI APP IS A PRIVACY DISASTER

The standalone Meta AI app has a share button that shows users a preview of their posts and then publishes their conversations within the app. However, many users seem unaware of this sharing. Researchers have discovered conversations that include sensitive PII, users requesting aid with committing tax evasion, and other sensitive information. Notably, Meta does not indicate users' privacy settings when they post.

270K WEBSITES INJECTED WITH ‘JSF-CK' OBFUSCATED CODE

Nearly 270K websites have been compromised with malicious JavaScript Injectors that are obfuscated using the ‘JSF-ck method.' This method uses six ASCII characters to produce working JavaScript code by relying on JavaScript's type coercion to encode numbers and letters using crafted combinations of the characters. It leads to very long and easy-to-detect code, but is challenging to unobfuscate without specialized tools.

MACOS TAHOE BRINGS A NEW DISK IMAGE FORMAT

macOS Tahoe introduces ASIF (Apple Sparse Image Format), a new disk image format that achieves near-native speeds of 4.8-6.6 GB/s, compared to traditional encrypted sparse images that only reach 100 MB/s on Apple silicon Macs. ASIF images, being intrinsically sparse files in APFS, maintain efficient sizes regardless of the host file system, ideal for virtual machines and high-performance storage. This format can be created exclusively with Tahoe's Disk Utility or diskutil command and is designed to work with macOS Sequoia for mounting. It significantly outperforms existing disk image formats, including sparse bundles, by utilizing a single file for storage.

HACKERS SWITCH TO TARGETING U.S. INSURANCE COMPANIES

Hackers from the Scattered Spider group are targeting U.S. insurance companies by employing social engineering tactics such as phishing and fraudulent calls to deceive employees and infiltrate systems.

U.S. SEIZES $7.74M IN CRYPTO TIED TO NORTH KOREA'S GLOBAL FAKE IT WORKER NETWORK

The U.S. confiscated $7.74 million in cryptocurrency connected to North Korean IT workers who used fake identities to gain employment at American companies and funneled money back to North Korea to aid its weapons programs.

REPORT LINKS LOS POLLOS AND RICHADS TO MALWARE TRAFFIC OPERATIONS

Researchers found that some ad companies, like Los Pollos and RichAds, were secretly helping cybercrime groups spread malware.