TLDR INFORMATION SECURITY 2025-07-10

CimTrak's new Compliance & Configuration Remediation (CCR) module

shows you exactly HOW YOUR SYSTEMS ALIGN WITH CIS BENCHMARKS AND DISA STIGS, then lets you AUTOMATICALLY CONFIGURE THEM TO COMPLIANCE WITH ONE CLICK while maintaining COMPLETE AUDIT TRAILS.

* Get a sneak preview of the CCR module + early waitlist access

PERSONAL INFORMATION BELONGING TO CUSTOMERS OF PADDY POWER AND BETFAIR COMPROMISED IN DATA BREACH

Personal information of customers at bookmakers Paddy Power and Betfair has been compromised in a data breach. The parent company, Flutter, notified customers via email that usernames, emails, contact details, first lines of addresses, and cities or towns might have been accessed, but no passwords, ID documents, or payment data were affected.

VIRGINIA COUNTY SAYS APRIL RANSOMWARE ATTACK EXPOSED EMPLOYEE SSNS

The county of Gloucester in Virginia notified over 3,500 employees that their personal information was stolen in an April breach. The stolen data includes names, driver's license numbers, bank account information, health insurance numbers, medical information, and SSNs. The BlackSuit ransomware gang took credit for the breach but the county did not confirm this.

NEW SERVICENOW FLAW LETS ATTACKERS ENUMERATE RESTRICTED DATA

A new flaw in ServiceNow, named Count(er) Strike, allows users to view restricted data by counting records without full access. It was identified by Varonis Threat Labs in February under CVE-2025-3648. The vulnerability is particularly relevant for configurations with misconfigured or overly permissive ACLs. While ServiceNow introduced new access control frameworks in the latest versions, administrators are advised to review their tables to ensure data security.

ENFORCING LEAST PRIVILEGE IN AWS IAM WITH ACCESS ANALYZER AND LAST ACCESS DATA

This post demonstrates how to utilize AWS IAM Access Analyzer to audit external access, followed by further fine-tuning with Last Access Data to identify unused permissions. Policies can then be refined by using CloudTrail to view the actual API calls made by a role and feeding those into the IAM Policy Simulator to determine the minimum required permissions. Least privilege reviews can be automated using Lambda, and real-time detection can be enabled using CloudTrail with EventBridge.

HEY ARNOLD: A GUIDE TO ALL THE AMAZON RESOURCE IDENTIFIER FORMATS IN AWS

Fog Security conducted a comprehensive investigation to identify all the various AWS ARN formats and discovered nearly 2,000 different ARNs supported by AWS IAM. While most ARNs follow a standard format of `arn:partition:service:region:account-id:resource-id`, some omit the account-id, some require a namespace, and there are other inconsistencies and duplication. Fog released a searchable listing of all ARNs as well as JSONs of all ARN formats and all service prefixes.

BURIED IN THE LOG. EXPLOITING A 20 YEARS OLD NTFS VULNERABILITY

This research reveals a 20-year-old NTFS vulnerability (CVE-2025-49689) that can be exploited via crafted Virtual Hard Disk (VHD) files, causing an integer overflow during mounting. Malicious VHDs bypass Log File Service (LFS) validation, enabling out-of-bounds memory reads and kernel-level code execution through pointer hijacking and IO_RING primitives. It shows how legacy filesystem code remains a target, especially with modern file formats used in phishing campaigns.

Start watching 🍿

PLANTING A TRADECRAFT GARDEN

The Tradecraft Garden is a collection of projects centered around the development of position-independent DLL loaders.

INTRODUCING KINGFISHER: REAL-TIME SECRET DETECTION AND VALIDATION

MongoDB's Kingfisher is an open-source secret scanning tool built in Rust that actively validates discovered secrets against external APIs and cloud services in real-time to eliminate false positives. Unlike other scanners that simply flag potential secrets, Kingfisher uses advanced pattern matching with Hyperscan, multi-language parsing with Tree-sitter, and dynamic validation to confirm whether detected credentials are active and pose security risks. The tool runs on-premises to keep data local, supports 700+ detection rules across cloud platforms, and outperforms tools like TruffleHog and GitLeaks in MongoDB's benchmarks.

PUBLIC EXPLOITS RELEASED FOR CITRIX BLEED 2 NETSCALER FLAW, PATCH NOW

Researchers have released proof-of-concept (PoC) exploits for the critical CitrixBleed2 vulnerability in Citrix NetScaler that can be used to steal user session tokens. The vulnerability is caused by the use of the sprints function along with a format string containing the “%.*s” format string. Citrix denies active exploitation, but security researcher Kevin Beaumont and ReliaQuest argue that they have seen evidence of exploitation.

HUNTRESS AND MICROSOFT COLLABORATE TO STRENGTHEN CYBERSECURITY FOR BUSINESSES WORLDWIDE

Huntress has announced a collaboration with Microsoft to help organizations better leverage existing Microsoft security tools, such as Defender for Endpoint and Microsoft 365 licenses, through seamless integration with Huntress' EDR, ITDR, SIEM, and security awareness training capabilities. The partnership addresses the gap where over 300 million organizations use Microsoft's ecosystem but struggle to fully utilize available security features due to limited resources and expertise. Huntress provides 24/7 SOC services to maximize the value of existing Microsoft security investments, particularly targeting businesses that lack in-house cybersecurity expertise.

BITCOIN DEPOT BREACH EXPOSES DATA OF NEARLY 27,000 CRYPTO USERS

Bitcoin Depot suffered a data breach that exposed personal information of nearly 27,000 customers. The breach included data like names, addresses, and driver's license numbers.

MICROSOFT CONFIRMS WINDOWS SERVER UPDATE SERVICES (WSUS) SYNC IS BROKEN

Microsoft has confirmed that Windows Server Update Services (WSUS) is not syncing with Microsoft Update, stopping updates from being deployed.

DONOT APT EXPANDS OPERATIONS, TARGETS EUROPEAN FOREIGN MINISTRIES WITH LOPTIKMOD MALWARE

A hacking group called DoNot APT, linked to India, targeted a European foreign ministry with malware named LoptikMod, using fake emails to steal sensitive data while evading detection.

NIPPON STEEL SUBSIDIARY BLAMES DATA BREACH ON ZERO-DAY ATTACK

Nippon Steel Solutions, a Japanese IT company, experienced a data breach resulting from hackers exploiting a zero-day vulnerability.