TLDR INFORMATION SECURITY 2025-06-24

MCLAREN HEALTH CARE HIT BY ANOTHER DATA BREACH, EXPOSING 743K PEOPLE'S DATA

McLaren Health Care suffered another data breach in July-August 2024, exposing the personal and medical information of 750,000 people. Hackers accessed names, Social Security numbers, driver's licenses, and health records. This follows a 2023 ransomware attack by BlackCat that affected over 2 million people.

CANADA SAYS TELCOS WERE BREACHED IN CHINA-LINKED ESPIONAGE HACKS

The Canadian government and the FBI report that China-backed Salt Typhoon hackers targeted Canadian telecoms, compromising at least one provider in February by manipulating Cisco routers for traffic collection. The group, active since 2024, previously hit U.S. telecoms and is expected to continue targeting Canadian organizations through 2027.

CYBERCRIMINALS BREACH AFLAC AS PART OF HACKING SPREE AGAINST US INSURANCE INDUSTRY

Insurance giant Aflac has announced it suffered a breach due to a social engineering attack. The breached information includes SSNs, insurance claims, and health information. Experts suspect that the attackers were the Scattered Spider ransomware group.

MITIGATING PROMPT INJECTION ATTACKS WITH A LAYERED DEFENSE STRATEGY

Google has implemented a layered security approach to protect Gemini AI from indirect prompt injection attacks. Its defenses include content classifiers detecting malicious instructions, security thought reinforcement, URL sanitization, user confirmation frameworks, and security notifications. This multi-layer strategy makes attacks more difficult and expensive while keeping users informed about threats.

THE RISE OF RESIDENTIAL PROXIES AS CYBERCRIME ENABLERS

Residential proxy providers offer millions of IP addresses from residential devices such as laptops, set-top boxes, and IoT smart devices. Residential proxies can provide cybercriminals with many IPs to cycle through while blending in with legitimate user traffic. Defenders should use JA4+ fingerprinting or other session-based defenses.

SPYING ON SCREEN ACTIVITY USING CHROMIUM BROWSERS

By default, Chromium-based browsers require users to consent to screen sharing and choose a screen to share to allow websites to capture a user's screen. However, these security researchers developed an attack that uses the `-- auto-select-desktop-capture-source` command line flag to enable screen sharing automatically. This attack can be chained with a headless browser or a small browser launched off-screen to hide the window from a user.

to Automation_

NPQ

NPQ is a security tool that audits npm/yarn packages before installation, running safety checks like vulnerability scans, package age verification, download count analysis, and malicious script detection. It prompts users for confirmation if issues arise, then allows npm or yarn to proceed with installation.

CLOUDREC

CloudRec is an open-source, multi-cloud security posture management (CSPM) platform.

NEW AI JAILBREAK BYPASSES GUARDRAILS WITH EASE

"Echo Chamber" is a new AI jailbreak technique that manipulates LLM context through progressive "poisoning" with acceptable prompts. Unlike direct attacks, it plants innocent "steering seeds" that gradually guide models toward prohibited responses. Testing showed over 90% success rates for generating harmful content across major AI models.

IRAN'S INTERNET: A CENSYS PERSPECTIVE

Iran faced a near-total internet blackout from June 18, hitting its lowest visibility on June 21 before gradually recovering. Some networks, like AS25124 (DATAK) and AS1756 (HAMYAR-AS), recovered slowly, while others, such as AS42337 (RESPINA-AS) and AS50810 (MOBINNET-AS), were fully restored. The Telecommunication Infrastructure Company (TIC) acts as a key bottleneck, providing transit for all networks with the weakest recovery.

NEW INFOGRAPHIC: PCI DSS VULNERABILITY MANAGEMENT PROCESSES

A high-level infographic from PCI outlining the new PCI DSS vulnerability management processes.

RUSSIAN COURT RELEASES SEVERAL REVIL RANSOMWARE GANG MEMBERS

A Russian court found four REvil gang members guilty of fraud and crimes but released them after serving time since their 2022 arrests, confiscating luxury assets worth hundreds of thousands of dollars.

APT28 HACKERS USE SIGNAL CHATS TO LAUNCH NEW MALWARE ATTACKS ON UKRAINE

Russian hackers from APT28 are leveraging Signal chats to distribute malware named BeardShell and SlimAgent, aiming to steal data and capture screenshots from Ukrainian government targets.