Parse notes
Sponsored
Forget the idea that email is fading. Nearly 9 IN 10 IT LEADERS say direct email is still critical to how their business communicates—more than Slack, Teams, or even collaboration tools. Why? Because email is auditable, reliable, and built for messages that matter.
There is an actively exploited zero-day vulnerability affecting systems with exposed Administrator Control Panel (ACP). Hackers have exploited it since August 21, compromising servers and affecting thousands of SIP extensions, allowing attackers to run commands as the Asterisk user. Sangoma has released emergency EDGE module fixes. It recommends blocking ACP access, restoring from pre-August 21 backups if compromised, and rotating all credentials.
Hackers accessed the personal data of over 4.4 million TransUnion customers through a breach in a third-party application, although the credit data itself was not compromised. Stolen information included names, birth dates, and Social Security numbers. This incident is part of a recent wave of major corporate data breaches in the US. Companies like Google and Allianz Life were also affected.
Attackers are increasingly using Microsoft Teams for the delivery of malware. Impersonating IT support, they send direct messages or calls from fake or compromised accounts, tricking users into installing remote access tools or running malicious PowerShell payloads. These sophisticated campaigns leverage social engineering, exploit the trust in Teams' internal messaging, and use advanced techniques to steal credentials, maintain persistence, and evade detection. Defenders are advised to remain vigilant for unusual Teams activity and impersonation attempts and to recognize the signs of such malware attacks for improved response and mitigation.
This post provides an overview of how to utilize CloudTrail, VPC Flow Logs, GuardDuty, ALB Logs, and AWS Config for threat detection in AWS. It lists sample alerts for each data source, as well as cross-service alerts, and demonstrates how these alerts can inform automated enforcement actions. Continuous validation is important for ensuring that rules remain consistent with an organization's environment.
Threat hunting follows the scientific method in which analysts observe logs, develop hypotheses, test the hypotheses, and iterate, but this model is crumbling under the vast amount of logs present in modern environments. To augment security teams, AI agents can be used to monitor vast amounts of logs and develop initial hypotheses to augment security teams. SOCs can begin leveraging agentic AI by developing explicit hypotheses, pairing with AI for investigations, centralizing data in a SIEM or data lake, setting appropriate guardrails for the agents, and then automating repetitive tasks.
Real Intelligence Threat Analytics (RITA) is a framework for detecting command and control communication through network traffic analysis.
The Azure Tenant Enumeration and Attribution Module (ATEAM) is a reconnaissance tool that discovers Azure services and attributes tenant ownership based on their responses.
pyghidra-mcp is a headless Model Context Protocol (MCP) server for Ghidra that enables LLMs to perform project-wide analysis across multiple interconnected binaries in a single session, moving beyond traditional single-file reverse engineering. The tool demonstrates ecosystem-aware analysis by tracing function calls across entire application stacks, such as following a file creation operation from notepad.exe through kernel32.dll to ntdll.dll and the Windows kernel. Built for automation and CI/CD integration, pyghidra-mcp leverages Ghidra's project management capabilities to expose entire software ecosystems for AI-powered reverse engineering workflows.
Storm-0501 has developed a sophisticated hybrid ransomware attack that exploits privileged accounts to move between on-premises and cloud environments, utilizing techniques such as DCSync attacks to gain domain control and leveraging federated domains as backdoors. The threat actor not only encrypts data, but also mass-deletes cloud resources, including backups, creating a "no-win situation" where organizations cannot recover without paying ransom. CISOs should implement least privilege access, audit on-premises environments for cloud migration opportunities, and regularly practice ransomware response playbooks to defend against this brutal attack chain.
Microsoft will start automatically saving any Word documents in OneDrive. Users will be able to change how new files are created in the Save page in the Word options. The feature was included in the latest Microsoft 365 Insiders Beta Channel update.
South Korea fined SK Telecom 134.8 billion won ($97.2 million) after a SIM data breach exposed the personal data of all customers due to poor security and delayed reporting. The breach affected 23 million users, causing significant financial losses and a decline in SKT's profit and customer base. Authorities ordered audits and improvements as SKT invests heavily in new security systems.
An attack on Miljödata, a key IT provider for most Swedish municipalities, disrupted HR and reporting systems for over 200 councils.
There is a high-severity auth bypass in Passwordstate, used by 390K IT professionals, that allows attackers to exploit a malicious URL to access the admin area via the Emergency Access page.
Google plans to create a new cyber "disruption unit" focused on "legal and ethical disruption" of threat campaigns.