TLDR INFORMATION SECURITY 2025-07-08

COLUMBIA UNIVERSITY STUDENT DATA STOLEN BY POLITICALLY MOTIVATED HACKER

A politically motivated hacker recently breached Columbia University's systems, locking students out of their coursework, email accounts, and video conferencing services. The hacker also stole around 460GB of data, some of which they provided to Bloomberg to showcase that the university employed discriminatory admissions practices. The data includes the Social Security Numbers of students, faculty, staff, applicants, and their families, as well as university ID numbers, citizenship status, admissions decisions, and the program to which they applied.

EU BORDER SYSTEM HAS THOUSANDS OF CRITICAL VULNERABILITIES

Thousands of vulnerabilities were discovered in the Schengen Information System II (SIS II), which is used by EU border agencies to track illegal migrants and suspected criminals. An audit by the European Data Protection Supervisor (EDPS) found that the system contained an excessive amount of accounts with administrative privileges, was vulnerable to hacker overload and unauthorized access, and that 69 external employees had access without proper clearance. The EDPS found no evidence of a breach but warned that a breach could be catastrophic.

CMS NOTIFIES 103K MEDICARE BENEFICIARIES ABOUT UNAUTHORIZED ACCOUNT CREATION

The HHS Centers for Medicare and Medicaid Services (CMS) was recently alerted that Medicare.gov accounts had been created for 103K individuals without their knowledge. The investigation determined that the accounts were created using information gathered from external sources. The unknown threat actor could use their access to view the user's Medicare beneficiary ID, coverage start date, birth date, and zip code.

THE GPS LEAK NO ONE TALKED ABOUT: UFFIZIO'S SILENT EXPOSURE

DeepSpecter exposed a five-year data breach involving Uffizio's GPS fleet management platform, leaking sensitive data from police, ambulances, and critical infrastructure across 12 countries. Despite claims of GDPR compliance and CVE disclosure, the exposure persisted through global resellers, underscoring that regulatory compliance alone does not provide adequate security protection.

ROLES HERE? ROLES THERE? ROLES ANYWHERE: EXPLORING THE SECURITY OF AWS IAM ROLES ANYWHERE

AWS IAM Roles Anywhere is a method for authenticating to AWS using certificates signed by a configured trust anchor. By default, the Roles Anywhere policy does not include any conditions, and any role attached to it could be assumed by any request signed by any trust anchor in that region. Unit 42 recommends specifying an ARN using conditions in the default policy, utilizing ACM-PCA for the trust anchor, and adhering to the principle of least privilege.

HIJACKING AMAZON EVENTBRIDGE FOR LAUNCHING CROSS-ACCOUNT ATTACKS

Attackers exploit AWS EventBridge's cross-account features using six MITRE ATT&CK attack patterns: establishing persistent backdoors via check-in events, creating bidirectional command and control channels, conducting reconnaissance by capturing all events, exfiltrating data in small chunks disguised as telemetry, lateral movement exploiting trust relationships, and exploiting vulnerable Lambda functions for unintended AWS API calls. These bypass traditional controls and evade detection because EventBridge PutEvents API calls aren't logged in CloudTrail. Defenses include Service Control Policies, specific event patterns, input validation, and monitoring CloudWatch for unusual activities.

Get a demo

REPOAUDIT

RepoAudit is a repo-level bug detector for general bugs. Currently, it supports the detection of diverse bug types (such as Null Pointer Dereference, Memory Leak, and Use After Free) in multiple programming languages (including C/C++, Java, Python, and Go).

OBJECTIVE-C HELPER

An IDA plugin that helps decompile Objective-C code by removing superfluous runtime calls related to ARC.

CARACAL

Caracal is a Rust-based implementation of eBPF techniques. It can hide target BPF programs and maps, making them invisible to tools like bpftop and bpftool. Additionally, it can conceal processes, rendering them undetectable by commands such as ps, top, and ls /proc, and is resistant to certain brute-force methods for uncovering them.

“NO HONOR AMONG THIEVES”: M&S HACKING GROUP STARTS TURF WAR

DragonForce and RansomHub, two major ransomware groups behind attacks on UK retailers like M&S and Harrods, are engaged in a turf war that could increase cyber risks for companies. The conflict began after DragonForce rebranded as a "cartel" and attacked RansomHub's site, potentially leading to double extortion of victims.

PHISHING PLATFORMS, INFOSTEALERS BLAMED AS IDENTITY ATTACKS SOAR

Identity-based cyberattacks increased 156% due to advanced phishing kits such as Tycoon 2FA and info-stealing malware. Phishing-as-a-service platforms, which cost $200-$300 monthly, make sophisticated attacks accessible, now comprising 59% of security investigations, often resulting in business email compromise (BEC) and ransomware.

POLICE IN BRAZIL ARREST A SUSPECT OVER $100M BANKING HACK

Brazilian police have arrested João Roque, an employee of C&M, for allegedly selling his credentials to hackers. This breach facilitated a cyberattack that diverted $100 million from Brazil's PIX payment system and impacted several financial institutions with fake transactions in a single night. Authorities have since frozen $50 million in assets and are pursuing four more suspects.

CALL OF DUTY TAKES PC GAME OFFLINE AFTER MULTIPLE REPORTS OF RCE ATTACKS ON PLAYERS

The makers of Call of Duty: World War 2 took the PC game offline after reports of hackers taking over players' computers during matches.

AT&T AGREED TO A $177 MILLION SETTLEMENT FOR DATA BREACHES OCCURRING IN 2019 AND 2024

AT&T has agreed to pay $177 million to settle lawsuits related to two major data breaches in 2019 and 2024, which exposed the personal and call data of millions of current and former customers.

QANTAS IS BEING EXTORTED IN RECENT DATA-THEFT CYBERATTACK

Qantas suffered a cyberattack that exposed the data of 6 million customers, with police investigating and the attackers seeking extortion.