TLDR INFORMATION SECURITY 2025-07-29

gathered the top questions (and answers) about GenAI in SecOps

from CISO's and security leaders such as:

AEROFLOT AEROFLOPS OVER 'IT ISSUES' AFTER ATTACKERS CLAIM YEAR-LONG COMPROMISE

Aeroflot canceled 49 flights on Monday due to supposed IT system failures at Moscow's Sheremetyevo Airport. Hacktivist groups Silent Crow and Cyberpartisans BY claimed responsibility, saying they compromised the airline's systems for a year and destroyed 7,000 servers.

NO PATCH FOR FLAW EXPOSING HUNDREDS OF LG CAMERAS TO REMOTE HACKING

The CISA has released an alert regarding a new authentication bypass vulnerability in LG Innotek LNV5110R cameras that could allow remote attackers to gain administrative privileges. The vulnerability allows attackers to upload an HTTP POST request to the device's non-volatile storage, potentially resulting in remote code execution. LG has stated that it will not release a patch for the vulnerability because the device has reached its end of life.

GLOBAL GROUP RANSOMWARE CLAIMS BREACH OF MEDIA GIANT ALBAVISIÓN

GLOBAL GROUP, a ransomware-as-a-service active since June, claims to have breached Spanish media giant Albavisión, stealing 400GB of data and giving 15 days to negotiate. Using AI chatbots, it has targeted 29 victims, mainly media and healthcare firms, with ransom demands of around $1 million. The group also attacked entities like RTE and Rete Toscana Classica, focusing on media companies.

A STANDARD FOR HUMAN-CENTERED INVESTIGATION PLAYBOOKS

The Human-Centered Playbook standard is a structured format for documenting investigation workflows through questions that guide analysts during the investigation. Playbooks are triggered by cues such as an attack or a suspicious artifact and progress in a series of questions that include context, log sources, and queries for the analyst. Security Onion has adopted this standard. Sample playbooks are available on the platform.

DISSECTING RDP ACTIVITY

Remote Desktop Protocol (RDP) is a common entry point for legitimate users and attackers in Windows environments. This blog post lists out event IDs and builds a timeline for an RDP session from logon to session end. It also includes a sample timeline of events for an RDP session.

ARCANUM'S AI SECURITY SCALING RUBRIC

Arcanum uses a three-stage model for scaling AI in security teams. In the first stage, AI functions as an assistant to augment teams for single, narrowly scoped tasks. The second phase involves scaling the AI to automate a complete workflow in a single domain using tools such as agents and RAG. The third stage scales the AI tooling up to automate workflows across the entire organization.

👉 Register now

ROOT EVIDENCE (PRODUCT LAUNCH)

Root Evidence offers vulnerability scanning and attack surface management technology that relies on exploitation evidence to help organizations focus on addressing those vulnerabilities that are targeted in the wild.

APPLICATIONINSPECTOR

A source code analyzer built for surfacing features of interest and other characteristics to answer the question 'What's in the code?' quickly using static analysis with a JSON-based rules engine.

MAC_APT

mac_apt is a DFIR tool that processes full disk images of Mac computers or live machines and extracts data/metadata useful for forensic investigation.

NEW YORK STATE CYBER CHIEF CALLS OUT TRUMP FOR CYBERSECURITY CUTS

The Trump administration has significantly reduced federal cybersecurity budgets and staff, including the firing of over 100 CISA employees and a $1.2 billion funding cut. New York officials, including Governor Hochul and Cyber Chief Colin Ahern, express concern that these cuts could endanger national security while they work to strengthen state-level cybersecurity independently.

DEBIAN ISN'T WAITING FOR 2038 TO BLOW UP, SWITCHES TO 64-BIT TIME FOR EVERYTHING

Debian will switch to 64-bit time on 32-bit architectures from Debian 13 "Trixie" to prevent the Y2K38 bug, where 32-bit signed integers overflow on January 19, 2038. This affects 6,429 packages and breaks ABI compatibility, but maintainers have fixed all affected libraries. The legacy i386 port keeps 32-bit time for compatibility with existing x86 binaries.

MICROSOFT UNCOVERS MACOS FLAW ALLOWING BYPASS TCC PROTECTIONS AND EXPOSING SENSITIVE DATA

Microsoft discovered CVE-2025-31199, a macOS vulnerability that allows attackers to bypass Transparency, Consent, and Control (TCC) protections by exploiting Spotlight's .mdimporter plugins to access sensitive data without user permission. The flaw enables access to protected directories, such as Downloads and Apple Intelligence cache files, which contain GPS locations, face recognition data, and device metadata that sync across iCloud-linked devices. Apple patched the vulnerability in macOS Sequoia 15.4 in March following the development of a proof-of-concept tool by Microsoft called "Sploitlight" which demonstrated the exploit.

TEA APP LEAK WORSENS WITH SECOND DATABASE EXPOSING USER CHATS

The Tea dating app breach has worsened - 1.1 million private messages have been revealed and a 59GB dataset with sensitive documents has been distributed on hacking forums.

RESEARCHERS FLAG FLAW IN GOOGLE'S AI CODING ASSISTANT THAT ALLOWED FOR ‘SILENT' CODE EXFILTRATION

There was a vulnerability in Google's Gemini CLI that allowed silent code execution and credential theft through prompt injection in context files - Google patched it on July 25 after initially deeming it low severity and later escalating it to Priority One.

NASCAR CONFIRMS PERSONAL INFORMATION STOLEN IN RANSOMWARE ATTACK

NASCAR has confirmed a ransomware attack between March 31 and April 3 that exfiltrated personal information, including names and Social Security numbers - the Medusa ransomware group claims it stole 1TB of data and has demanded a $4 million ransom.