TLDR INFORMATION SECURITY 2025-07-23

EXPRESSVPN BUG LEAKED USER IPS IN REMOTE DESKTOP SESSIONS

A security researcher reported a vulnerability in ExpressVPN's Windows client that caused Remote Desktop Protocol (RDP) traffic to bypass the VPN, which could lead to exposing the user's IP. ExpressVPN patched the bug, confirmed that it only impacted RDP traffic, and stated that it was introduced by debug code that was accidentally included in production builds.

HONG KONG INVESTIGATES LOUIS VUITTON DATA LEAK AFFECTING 419K CUSTOMERS

Hong Kong's privacy watchdog announced that it is investigating a data leak affecting 419,000 customers of the Hong Kong branch of Louis Vuitton. The leaked data may have included names, phone numbers, passport details, addresses, email addresses, shopping history, and product preferences, but did not include payment information.

COYOTE TROJAN FIRST TO USE MICROSOFT UI AUTOMATION IN BANK ATTACKS

The Coyote banking Trojan is notable for being the first malware to utilize Microsoft's UI Automation (UIA) framework, transitioning from a proof-of-concept to actively targeting Brazilian banking and cryptocurrency users. It exploits UIA to steal credentials from browsers and can manipulate UI elements, such as address bars, to redirect victims to phishing sites, thereby complicating detection efforts. Akamai recommends monitoring for the presence of UIAutomationCore.dll in unknown processes and scanning for interactions with UIA named pipes as early indicators of infection.

THE CYBER DECEPTION MATURITY MODEL: WHERE DOES YOUR ORGANIZATION STAND?

This post divides cyber deception into 5 levels: pre-deception, where an organization does not employ cyber deception; experimental, where an organization deploys simple deception that only succeeds at catching automated scanners; operational, where an organization can catch human threats; strategic, where an organization's deception resources mimic authentic resources and mimic high-value targets; and optimized, where deception goes beyond detection and shapes adversary behavior. Each level includes key metrics to track as well as steps to advance to the next level.

CLOUD LOGGING FOR SECURITY AND BEYOND

This is a guide on cloud logging best practices for AWS, Azure, and Google Cloud. It emphasizes the importance of balancing security, compliance, and cost when selecting logging strategies. The guide distinguishes between control plane logging (default for management) and data plane logging (which requires manual activation for service activities), categorizing logs into audit, compute, network, secrets, storage, database, and Kubernetes types. Organizations should prioritize logging based on business, regulatory, and security needs, avoiding the costly "log everything" approach.

COMMON MISTAKES IN USING CVSS

Don't rely solely on CVSS scores for prioritizing vulnerabilities, as only 17% of critical ones are exploited, while attackers target lower scores. Organizations should implement Risk-Based Vulnerability Management (RBVM) that includes threat intelligence, asset importance, business context, and metrics like EPSS. Research shows EPSS prioritization targets 3% of vulnerabilities with 65% effectiveness, unlike CVSS, which requires 57% coverage for similar results, with only 4% effectiveness.

control. Get an exclusive preview and join the waitlist.

JSON CRACK

JSON Crack is a visualization application that transforms various data formats (JSON, CSV, XML, etc) into interactive graphs.

FLOWABLE'S SUMMER 2025 UPDATE INTRODUCES GROUNDBREAKING AGENTIC AI CAPABILITIES

Flowable released version 2025.1 on July 22 with AI capabilities, including four agent types: Utility, Document, Knowledge, and Orchestrator. It now supports integrations with AWS Bedrock, Azure Foundry, and Salesforce Agentforce, and features dynamic autonomy for agents switching between AI help and deterministic workflows based on task complexity. The enterprise 'AI button' enables real-time summaries, automated customer communication, and autonomous task completion.

WAF DETECTOR

WAF Detector is a fast Rust tool that detects and tests web firewalls and CDNs. It works with CloudFlare, AWS WAF, Akamai, Fastly, and Vercel.

RING DENIES BREACH AFTER USERS REPORT SUSPICIOUS LOGINS

Many Ring users reported suspicious login activity on their devices on May 28, raising concerns of a hack. Last week, Ring clarified on its Facebook page that a bug caused all previous logins to appear as if they occurred on May 28. However, some users remain doubtful, noting login attempts from unfamiliar countries and devices.

WINDOWS 11 GETS NEW BLACK SCREEN OF DEATH, AUTO RECOVERY TOOL

As part of Microsoft's Windows Resiliency Effort, it updated the Blue Screen of Death (BSOD) to a black screen showing only the stop code and fault info for easier troubleshooting. The company also announced a Quick Machine Recovery feature that checks Windows Update for fixes when a boot issue occurs.

CONTRACT LAPSE LEAVES CRITICAL INFRASTRUCTURE CYBERSECURITY SENSOR DATA UNANALYZED AT NATIONAL LAB

Critical infrastructure cybersecurity sensor data remains unanalyzed after the DHS contract with Lawrence Livermore National Laboratory ended this weekend, leaving the CyberSentry program unfunded. The program monitors threats in operational technology networks at power plants and factories, but the lab can't process the data without government funds. This occurs amid broader Trump administration budget cuts to CISA and expired threat hunting contracts.

MICROSOFT SHAREPOINT TOOLSHELL ATTACKS LINKED TO CHINESE HACKERS

Chinese government-linked hackers exploited a Microsoft SharePoint zero-day vulnerability chain dubbed "ToolShell" to breach at least 54 organizations worldwide, prompting Microsoft to release emergency patches and CISA to add the flaw to its Known Exploited Vulnerability catalog.

DELL SAYS DATA LEAKED BY HACKERS IS FAKE

Dell got hit by the WorldLeaks ransomware group and leaked 1.3TB of data, but it claims it's mostly fake demo data from an isolated testing environment, not real customer info.

CISCO: MAXIMUM-SEVERITY ISE RCE FLAWS NOW EXPLOITED IN ATTACKS

Three critical unauthenticated RCE vulnerabilities in Cisco ISE (CVE-2025-20281, CVE-2025-20282, and CVE-2025-20337) are now being actively exploited in the wild, requiring immediate patching to ISE 3.3 Patch 7 or 3.4 Patch 2.