TLDR INFORMATION SECURITY 2025-08-01

EVEREST RANSOMWARE CLAIMS MAILCHIMP AS NEW VICTIM IN RELATIVELY SMALL BREACH

Everest ransomware group claims to have breached Mailchimp, stealing 767 MB of data containing 943,536 lines, including business information, domain names, company emails, and technology stack details. The leaked data appears to be structured business information from marketing or CRM exports rather than Mailchimp's internal systems, suggesting the breach may have targeted customer data rather than core infrastructure. Everest follows the double extortion model and previously breached Coca-Cola in May, though it remains a relatively obscure ransomware strain compared to major groups.

APPLE PATCHES SECURITY FLAW EXPLOITED IN CHROME ZERO-DAY ATTACKS

Apple patched CVE-2025-6558, a high-severity vulnerability in the ANGLE graphics layer that was actively exploited in Chrome zero-day attacks and allows remote code execution via malicious HTML pages. Google's Threat Analysis Group discovered the flaw in June, with Google patching Chrome on July 15 and CISA adding it to the Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by August 12. The vulnerability affects iOS 18.6, iPadOS 18.6, macOS Sequoia 15.6, and other Apple platforms, marking the sixth zero-day Apple has patched this year.

HACKERS PLANT 4G RASPBERRY PI ON BANK NETWORK IN FAILED ATM HEIST

The UNC2891 hacking group (LightBasin) physically planted a 4G-equipped Raspberry Pi on a bank's ATM network switch to create covert remote access into the internal network. The attackers used this device as a pivot point to move laterally through the bank's systems, deploying backdoors and attempting to install their Caketap rootkit to spoof ATM authorization and steal cash. The heist ultimately failed, but demonstrated advanced anti-forensics techniques, including filesystem mounting to hide malicious processes from security tools.

CHINA'S COVERT CAPABILITIES | SILK SPUN FROM HAFNIUM

SentinelOne's analysis of DOJ indictments revealed China's sophisticated tiered contractor ecosystem for cyber operations. Hafnium/Silk Typhoon operates through at least three companies directly tasked by the Shanghai State Security Bureau rather than opportunistic access brokers. Shanghai Firetech holds 10+ previously unknown patents for offensive tools, including Apple device forensics, smart home appliance control, and encrypted data recovery—capabilities far exceeding publicly attributed Hafnium TTPs and suggesting broader operational scope across multiple MSS regional offices. The research exposed critical attribution gaps where threat actor tracking focuses on behavioral clusters rather than organizational structures, with companies potentially selling capabilities to other MSS offices while remaining unattributed despite shared corporate ownership.

BALANCING SECRECY AND TRANSPARENCY IN BUG BOUNTY PROGRAMS

Bug bounty programs allow vendors to expand their security testing efforts with community hackers who can receive payment for their work. One issue with this approach is that, particularly in private programs, vendors control the disclosure timeline and may create an information gap. Government organizations should step in to regulate vulnerability disclosure with NIST drafting standards and metrics for bug bounty programs, CISA establishing a voluntary vendor accreditation program, as well as requiring federal agencies to comply with the standards, and the SEC to require publicly traded companies to report their bug bounty metrics.

Get the Guide

KALI LINUX CAN NOW RUN IN APPLE CONTAINERS ON MACOS SYSTEMS

The Kali Linux team has launched a Kali container that can be run through Apple's new container virtualization platform. The team has stated that there are some known bugs as well as limitations with hardware passthrough.

THORIUM

Thorium is a scalable file analysis and data generation platform that allows users to orchestrate arbitrary docker/vm/shell tools at scale. It was developed as a partnership between CISA and Sandia Labs.

PROTON LAUNCHES FREE STANDALONE CROSS-PLATFORM AUTHENTICATOR APP

Proton Authenticator is a free standalone 2FA app for Windows, macOS, Linux, Android, and iOS that doesn't require an account and features end-to-end encryption with cross-device syncing. The app supports easy import/export functions for TOTP seeds (including from Google Authenticator), automatic encrypted backups, and biometric/PIN locking.  Unlike competing apps, it operates without ads, trackers, or vendor lock-in. The source code will be released on GitHub within weeks.

CISA SAYS IT WILL RELEASE TELECOM SECURITY REPORT SOUGHT BY SEN. WYDEN TO LIFT HOLD ON PLANKEY NOMINATION

CISA has committed to releasing its suppressed 2022 U.S. Telecommunications Insecurity Report after Sen. Wyden blocked CISA director nominee Sean Plankey's confirmation until the document is made public. Wyden claims the report contains “shocking details” about telecom vulnerabilities that could have prevented the Salt Typhoon espionage campaign if released when written initially. The Senate passed legislation requiring the report's release within 30 days, while CISA provided no timeline beyond saying it needs “proper clearance.”

SHINNYHUNTERS BEHIND SALESFORCE DATA THEFT ATTACKS AT QANTAS, ALLIANZ LIFE, AND LVMH

Google's Threat Intelligence Group has identified a wave of data breaches as being linked to the ShinyHunters group, debunking the belief that it was associated with ScatteredSpider. In these attacks, the attackers impersonated IT support staff in targeted vishing calls to persuade employees into visiting Salesforce's connected app setup page and then entering a “connection code” that linked a malicious version of Salesforce's Data Loader OAuth app.

CAREER LONGEVITY & THE DON'T FIRE ME CHART

A common metric of security program success is how much leadership is prepared to stick with the work over the long term. Security work tends to follow a cycle in which security issues are increasing so the company hires a security engineer to fix them, the engineer begins fixing the low hanging fruit and the number of issues declines, the engineer digs deeper and implements more logging, monitoring, etc and discovers more issues, management wonders why the issues have increased and fires the engineer. This can be mitigated by communicating that the situation will get worse in the short-term before it gets better in the long-term.

Get Duo's _Ultimate Guide to MSP Operations_

A FRESH LOOK FOR THE MICROSOFT AUTHENTICATION BACKGROUND

Microsoft is rolling out a new default background image for all authentication screens (personal accounts in August, Entra work accounts September 29) as part of its Fluent design modernization effort - this requires no admin action and existing company branding overrides will be preserved.

USERS LEFT SCRAMBLING FOR A PLAN B AS DROPBOX DROPS DROPBOX PASSWORDS

Dropbox has announced that it will shut down its password manager in a phased shutdown, with the service becoming read-only at the end of August followed by the mobile app being shutdown in September, and a full shutdown in October.