TLDR INFORMATION SECURITY 2025-08-04

Download the full report from Flashpoint

CL-STA-0969 INSTALLS COVERT MALWARE IN TELECOM NETWORKS DURING 10-MONTH ESPIONAGE CAMPAIGN

Chinese state-sponsored threat actor CL-STA-0969 conducted a 10-month espionage campaign that targeted Southeast Asian telecom networks. The campaign used custom malware, including AuthDoor, GTPDOOR, and ChronosRAT, to enable remote control and location tracking. The group deployed advanced evasion techniques, including DNS tunneling and traffic routing through compromised mobile operators, while maintaining high operational security. There was no evidence of data exfiltration despite the attackers installing multiple backdoors and scanning tools across critical telecommunications infrastructure.

CRITICAL ALERT: AKIRA RANSOMWARE SURGE TARGETS SONICWALL FIREWALLS

Akira ransomware attacks targeting SonicWall SSL VPN connections have surged since July. Exploiting CVE-2024-40766 (CVSS 9.3) and unpatched SonicOS devices with disabled MFA, attackers rapidly escalate from VPN access to system encryption within hours, affecting hundreds of thousands of devices across multiple SonicWall generations. Organizations must immediately patch to the latest firmware, enable MFA on all VPN accounts, and restrict firewall management access to trusted IP ranges.

ATTACKERS EXPLOIT LINK-WRAPPING SERVICES TO STEAL MICROSOFT 365 LOGINS

Cloudflare's Email Security team observed a new campaign in which threat actors abuse link-wrapping services from Proofpoint and Intermedia to phish users for Microsoft 365 credentials. Attackers abused Proofpoint link-wrapping in various ways, including multi-tiered redirect abuse with URL shorteners via compromised accounts. In the Intermedia campaign, threat actors sent a message impersonating a “Zix” secure message notification or a Teams notification that would redirect users to a fake login page to harvest Teams credentials.

EXPLOITING TRUST: HOW SIGNED KERNEL DRIVERS FUEL MODERN KERNEL LEVEL ATTACKS ON WINDOWS

An emerging pattern in kernel level attacks is to use a signed kernel loader to load a signed second stage kernel driver or reflectively load an unsigned kernel driver. These signed drivers are often signed via the Windows Hardware Compatibility Program (WHCP). The WHCP requires an extended validation (EV) certificate, which is designed to increase the security of the program. However, the EV certificate application process requires little human interaction, and there are dark web sellers of EV code-signing certificates.

KUBERNETES SECURITY FUNDAMENTALS: AUTHORIZATION

Kubernetes handles authorization by utilizing multiple authorization providers in the cluster requested in the order specified to the kube-server as flags on startup. Each provider can explicitly approve or deny the request or respond with “no opinion.” If all providers respond “no opinion,” the request is denied. Providers include AlwaysAllow and AlwaysDeny, which allow or deny every request; Node Authorizer, which restricts the access of the kubelet user; Attribute-Based Access Controls (ABAC), which enables cluster-admins to define authorization rules based on the request's characteristics statically; Role-Based Access Controls (RBAC), which is the most commonly used provider and maps permissions to roles; and Webhook, which is widely used in cloud provider clusters like AKS, GKE, and EKS.

SILENT PUSH CEO ON CYBERCRIME TAKEDOWNS: 'IT'S AN ONGOING CAT-AND-MOUSE GAME'

In this interview, Silent Push CEO Ken Bagnall discusses tracking Funnull, a Philippines-based company providing infrastructure for financial scams that cost US victims $200 million. The firm maps criminal networks for law enforcement but faces challenges when groups adapt to surveillance. Bagnall compares state-tolerated cybercrime to historical privateering, requiring national-level responses.

COMPOSE YOUR WAY WITH PROVIDER SERVICES

Docker Compose has announced the release of Provider services, which enables users to extend the capabilities of Docker Compose files by calling provider plugins that can interact with external services. This post includes an example of how to use the Telepresence traffic manager for a Kubernetes cluster.

ECHO (PRODUCT LAUNCH)

Echo offers CVE-free container base images in a similar space to Chainguard or recently Wiz. Customers simply need to replace their Dockerfile base image with Echo's secure version without any other changes.

PLAYBOOK-NG

Playbook-NG is a stateless web-based application that matches incident findings with countermeasures for adversary containment and eviction. Users can export the results in numerous formats such as JSON, Microsoft Word, Excel, and Markdown. The application does not save information about the users or their inputs. Work is cleared when the user browses off or clears the playbook.

ANTHROPIC SAYS OPENAI ENGINEERS USING CLAUDE CODE AHEAD OF GPT-5 LAUNCH

Anthropic revoked OpenAI's access to the Claude API after discovering ChatGPT engineers were using Claude Code tools ahead of GPT-5's expected launch next week. The incident highlights competitive tensions in AI development, with Anthropic's spokesperson noting that Claude Code has become the “go-to choice for coders everywhere,” including OpenAI's technical staff. Whether OpenAI used Claude Code to enhance GPT-5's coding capabilities remains unclear, but the timing suggests potential competitive intelligence gathering.

SEX TOY MAKER LOVENSE THREATENS LEGAL ACTION AFTER FIXING SECURITY FLAWS THAT EXPOSED USERS' DATA

Lovense fixed two security vulnerabilities that exposed user emails and enabled account takeovers. CEO Dan Liu is considering legal action over disclosure reports, claiming no data was compromised despite the security hole.

WHEN PUBLIC PROMPTS TURN INTO LOCAL SHELLS: ‘CURXECUTE' – RCE IN CURSOR VIA MCP AUTO‑START

Aim Labs has discovered "CurXecute," a high-severity vulnerability (CVE-2025-54135, 8.6 rating) in Cursor IDE that enables remote code execution through prompt injection. While fixed in version 1.3, earlier versions remain vulnerable, and attackers can exploit developer privileges via poisoned MCP data for ransomware, theft, or AI manipulation.

SENATE CONFIRMS SEAN CAIRNCROSS TO BE NATIONAL CYBER DIRECTOR

In a 59-35 Senate vote, Sean Cairncross has been confirmed as the Trump administration's first Senate-approved cyber official.

NEW 'SHADE BIOS' TECHNIQUE BEATS EVERY KIND OF SECURITY

Shade BIOS is a UEFI malware technique that runs entirely in BIOS memory after OS startup, bypassing all security software, and operates as a parallel system.