TLDR INFORMATION SECURITY 2025-08-14

* Measuring GRC's direct impact on revenue

* Pitching GRC as an investment to your board

Register for the free webinar → August 27, 10 AM PT

INTERLOCK RANSOMWARE GROUP LEAKS 43GB OF DATA IN CITY OF ST. PAUL CYBERATTACK

The Interlock ransomware group attacked the City of St. Paul, disrupting payments and essential services. The city refused to pay the ransom and launched Operation Secure St. Paul with support from the FBI and National Guard while investigating the breach. Interlock claims to have leaked 43GB of HR, financial, and identification documents, prompting a citywide password reset and warnings about increased phishing risks.

HACKERS LEAK 2.8M SENSITIVE RECORDS FROM ALLIANZ LIFE IN SALESFORCE DATA BREACH

Threat actors linked to ShinyHunters have leaked 2.8 million records from Allianz Life's Salesforce CRM, exposing personal details including names, addresses, birth dates, and Tax IDs of customers and business partners. The July 16 breach occurred through social engineering attacks targeting the third-party cloud CRM system, affecting the majority of Allianz Life's 1.4 million customers. The attackers have formed a joint Telegram channel with other groups, including Scattered Spider and Lapsus$, to claim credit for this and other major Salesforce-related breaches.

NEW DOWNGRADE ATTACK CAN BYPASS FIDO AUTH IN MICROSOFT ENTRA ID

ProofPoint researchers discovered a new downgrade attack on Entra ID that downgrades the MFA from FIDO to a less secure fallback. The attack uses a custom evilgnix attacker-in-the-middle module to spoof a browser agent that lacks FIDO support, such as Safari for Windows. It can be prevented by disabling fallback methods.

DETECTION ENGINEERING: PRACTICING DETECTION-AS-CODE

This is part one of an ongoing series on implementing detection-as-code (DaC). It introduces core concepts such as the detection development life cycle (DDLC) and components of DaC, such as version control, code review, testing, and CI/CD pipelines. Organizations that embrace DaC can collaborate more easily, have more consistent, efficient, and higher quality detections, have better documentation, and can scale more effectively.

WHAT THE LOCKBIT 4.0 LEAK REVEALS ABOUT RAAS GROUPS

LockBit 4.0's leaked affiliate panel exposes a fragmented, chaotic RaaS operation: inconsistent negotiations, broken decryptors, unpaid platform fees, and even hits on prohibited Russian targets. This unpredictability complicates defense and incident response. The takeaway: don't rely on negotiation—prioritize preparation (segmentation, MFA, patching, and lateral-movement monitoring), as RaaS brands splinter and attribution grows harder.

LESSONS LEARNED BUILDING AN AI HACKER

This post dives into how Theori built effective LLM agents for DARPA's AI Cyber Challenge. The agents worked by breaking problems into sub-tasks, carefully curating narrow, guarded tools and enforcing structured outputs while specialized sub-agents handled recurring jobs like source questions and PoV debugging.

LEGION (PRODUCT LAUNCH)

Legion's browser-native AI SOC learns analysts' workflows to triage alerts, reduce false positives, and automate investigations across tools.

NETMAKER

Netmaker uses WireGuard to create fast, secure, and distributed virtual networks.

LUDUSHOUND

LudusHound uses BloodHound data to create a fully functional Ludus Range for controlled Active Directory testing.

RUSSIAN GOVERNMENT HACKERS SAID TO BE BEHIND US FEDERAL COURT FILING SYSTEM HACK

Officials blame Russian government hackers for breaching the U.S. federal court filing system (PACER), reportedly searching mid-level criminal cases, including some with Russian/Eastern European surnames, with stolen data including sealed dockets and informant identities. The judiciary confirmed the cyberattack and is enhancing security.

NEW YORK CLAIMS ZELLE'S SHODDY SECURITY ENABLED A BILLION DOLLARS IN SCAMS

New York Attorney General Letitia James is suing Zelle's owner, Early Warning Services, alleging the platform's weak verification and safeguards enabled over $1 billion in scams through 2023. The suit cites lax registration, slow fraud reporting, misleading “safe” marketing, and poor scammer removal. Zelle says the suit is a political stunt and claims it has strong anti-fraud efforts.

WHY IT'S TIME FOR THE U.S. TO GO ON OFFENSE IN CYBERSPACE

The US indicated a shift from strictly defensive capabilities to increasing offensive capabilities with the allocation of $1B in funding for offensive operations that was included in the “Big Beautiful Bill.” This funding will allow the US to operationalize offensive tooling more rapidly and develop the infrastructure to support more complex operations. Defensive deterrents have not been effective enough in cyberwarfare. This shift to offensive deterrents is necessary to maintain US cyber supremacy.

MICROSOFT AUGUST 2025 PATCH TUESDAY FIXES ONE ZERO-DAY, 107 FLAWS

Microsoft released fixes for 107 vulnerabilities, including an actively exploited zero-day in Windows Kerberos.

JAVA 25 PUTS 32-BIT X86 OUT TO PASTURE, ADDS 17 SHINY NEW FEATURES

Java 25, a support release that will drop 32-bit x86 support and add 17 features, is at the release candidate stage, with general availability set for September 16.