TLDR INFORMATION SECURITY 2025-08-13

NETHERLANDS: CITRIX NETSCALER FLAW CVE-2025-6543 EXPLOITED TO BREACH ORGS

The Netherlands' National Cyber Security Centre (NCSC) warns that a critical Citrix NetScaler vulnerability (CVE-2025-6543) has been actively exploited to breach critical organizations in the country. The flaw allows attackers to compromise NetScaler appliances and gain unauthorized access to organizational networks. Organizations using Citrix NetScaler are urged to apply patches immediately to prevent exploitation.

NORTH KOREAN KIMSUKY HACKERS EXPOSED IN ALLEGED DATA BREACH

Two hackers have breached the North Korean state-sponsored hacking group Kimsuky and leaked 8.9GB of data. The data includes phishing logs, data stolen from South Korea, phishing toolkits, unknown binary archives and executables, Chrome history and configs, and Bash history files. The hackers allegedly hacked Kimsuky for ideological reasons.

MANPOWER FRANCHISE DISCLOSES DATA THEFT AFTER RANSOMHUB POSTS ALLEGED STOLEN DATA

Manpower is notifying 144,189 people of a data breach after attackers accessed its network between December 29, 2024, and January 12, 2025. RansomHub claims 500GB of data was stolen, including client and corporate data.

I BUILT AN AI HACKER. IT FAILED SPECTACULARLY

In this post, the author talks about how they built an autonomous AI pentester chaining tools like Nmap and Burp. It underperformed—few real vulnerabilities, many false results, high costs, and slow runs. Key lessons: LLMs plan well but evaluate poorly, autonomy drifts, and human validation and hybrid AI-assisted workflows outperform pure agentic hacking.

MAKING FILE ENCRYPTION FAST AND SECURE FOR TEAMS WITH ADVANCED KEY MANAGEMENT

Dropbox describes how it solved for Hardware Security Module (HSM)-backed, team-based file encryption, where files are encrypted at rest and access can be removed instantly while also prioritizing usability at scale. End-to-end encryption would make it impossible for Dropbox to offer file content search, and traditional team-based key management, where a top-level key is used to derive unique keys for each file, would be prohibitively slow due to Dropbox's file storage architecture. To solve this problem, Dropbox introduced namespace encryption keys, which are derived from an HSM-backed top-level key and are used to derive team encryption keys. When sharing files, Dropbox can temporarily share the namespace encryption key while it reencrypts the blocks with team encryption keys.

PERSISTENT RISK: XZ UTILS BACKDOOR STILL LURKING IN DOCKER IMAGES

Binarly warns that the XZ Utils backdoor (CVE-2024-3094) still lurks in Debian-based Docker Hub images from March 11, 2024, propagating into derivative images. It found 35+ affected tags, and the risk persists via inherited bases and CI pipelines. Recommendations: avoid those tags, rebuild from patched bases, and scan for the issue in your images.

explore more SANS training and resources.

GO GET 'EM: UPDATES TO VOLEXITY GOLANG TOOLING

Volexity's GoStringExtractor is a plugin utility for IDA Pro and Ghidra that helps analyze string data in Go binaries for reverse engineering and detection purposes. The tool addresses challenges in analyzing Go binaries where strings are stored in contiguous tables without individual termination, and includes data from all linked packages. This enhancement aids security researchers in better understanding malware behavior and developing detection signatures for Go-based threats.

CYATA (PRODUCT LAUNCH)

Cyata continuously scans desktop and SaaS environments for AI identities and their permissions, and creates detailed audit trails of their activity, including by requiring them to justify their reasoning in real time.

VEIL

Verified Entity Identity Lock exposes hidden trust paths in your AWS IAM setup before they become security risks.

JUSTICE DEPARTMENT ANNOUNCES COORDINATED DISRUPTION ACTIONS AGAINST BLACKSUIT (ROYAL) RANSOMWARE OPERATIONS

The Justice Department conducted coordinated disruption actions against the BlackSuit (Royal) ransomware group on July 24, seizing four servers and nine domains. Law enforcement also recovered approximately $1 million in laundered proceeds from the ransomware operations. This represents a significant enforcement action against one of the active ransomware groups targeting organizations worldwide.

HOW TOOL CALLING WORKS IN LLMS

LLMs use tools, external functions, or APIs when a user makes a request that the model cannot fulfill given its internal knowledge base. During inference, an LLM is provided with a series of tool definitions as part of its input prompt or context window, much like providing a human with a series of external functions and their documentation. When the LLM detects that a tool must be called, it ranks potential tools based on their relevance to the task and then calls the appropriate tool to address the user's query.

MUDDYWATER'S DARKBIT RANSOMWARE CRACKED

Cybersecurity firm Profero has cracked the Iranian-backed MuddyWater's DarkBit ransomware, allowing clients to recover their data without paying a ransom. Profero found that the key generation method that DarkBit uses is weak and can be brute-forced. It also discovered that VMDK files on ESXi servers are sparse, and much of the content that its clients needed could be recovered without needing to brute-force the decryption. Profero is not publicly releasing its decryptor but urges victims to contact them.

GITHUB HEAD ANKLES AS MICROSOFT TAKES BIZ BY THE HAND

GitHub CEO Thomas Dohmke is departing the company, with Microsoft choosing not to appoint a successor as the code hosting platform is becoming more integrated within Microsoft's CoreAI division.

FCC TIGHTENS RULES ON FOREIGN FIRMS BUILDING UNDERSEA CABLES, CITING SECURITY

The FCC has implemented stricter licensing requirements for foreign companies building undersea cables, citing national security concerns and the need to protect critical data infrastructure from potential foreign sabotage.

HYUNDAI WANTS IONIQ 5 OWNERS TO PAY TO FIX A KEYLESS ENTRY SECURITY HOLE

Hyundai has offered UK Ioniq 5 owners a £49 “optional” security upgrade to stop thieves using a Game Boy‑like device that cracks keyless entry.