TLDR INFORMATION SECURITY 2025-09-19

Manager by G2 + CNET. Try Bitwarden for Business, free

SYSTEMBC MALWARE TURNS INFECTED VPS SYSTEMS INTO PROXY HIGHWAY

SystemBC is a proxy botnet providing a highway for malicious traffic, with an average of 1,500 bots/day. It primarily recruits bots by compromising VPS systems with at least one vulnerability, making up over 80% of the bots. Some customers of SystemBC include REM Proxy, a Russian web-scraping service, and a Vietnamese-based proxy network.

NEARLY 250,000 IMPACTED BY DATA BREACH AT MEDICAL ASSOCIATES OF BREVARD

Medical Associates of Brevard in Florida revealed that a data breach in January affected almost 247,000 patients and exposed sensitive health and personal data. The BianLian ransomware group claimed responsibility for stealing information like emails and HR documents, but it remains unclear how the stolen data has been used.

INSIGHT PARTNERS: RANSOMWARE HIT EXPOSED DATA ON 12K PEOPLE

Venture firm Insight Partners suffered a ransomware attack that exposed data of over 12,000 staff and investors. The breach began in October 2024, leading to data encryption in January before being detected. The stolen data includes personal, banking, and tax details.

DETECT SECRETS IN GITLAB CI LOGS USING GGSHIELD AND BRING YOUR OWN SOURCE

GitGuardian demonstrates how to automatically scan GitLab CI/CD pipeline logs for secrets using ggshield and their Bring Your Own Source initiative, addressing a critical but often overlooked attack vector where sensitive data like environment variables, API responses, and temporary credentials are exposed in build logs. The solution involves creating a custom Docker image with enhanced ggshield capabilities, configuring secure token storage via HashiCorp Vault, and implementing an automated scanning script that processes all pipeline job logs and creates incidents in the GitGuardian dashboard. This approach provides comprehensive secrets detection across the entire DevOps lifecycle, catching runtime secrets that traditional source code scanning misses while maintaining zero friction for developers.

AWS AGENTCORE: THE OVERLOOKED PRIVILEGE ESCALATION PATH IN BEDROCK'S AI TOOLING

AWS Bedrock AgentCore is a collection of tools that assist in deploying and scaling AI agents. AgentCore provides the ability to launch Code Interpreters, which run code in a sandboxed environment and can be customized to have access to AWS credentials to perform actions on AWS resources. Custom Code Interpreters cannot be protected with resource policies and only emit CloudTrail data events, presenting a tempting privilege escalation vector for attackers.

LATERAL MOVEMENT - BITLOCKER

BitLocker is a full disk encryption feature for Windows that protects data at rest by encrypting full volumes. This post outlines a privilege escalation or lateral movement technique that uses Windows Management Instrumentation (WMI) to hijack specific COM objects of BitLocker using remote manipulation of BitLocker registry keys to execute code under the user's context on a target host. The post also discusses detection opportunities for this attack and Sigma and Windows Defender for Endpoint queries to detect them.

YASA

YASA (Yet Another Static Analyzer) is an open-source static program analysis project. Its core innovation lies in a unified intermediate representation called the Unified Abstract Syntax Tree (UAST), designed to support multiple programming languages. Built on top of UAST, YASA provides a highly accurate static analysis framework. Users can extend its capabilities by writing custom checkers to perform various program analysis tasks—such as AST queries, data flow analysis, and function call graph analysis—and expose functionality through SDK, declarative query language (QL), or MCP.

PYARMOR

Pyarmor is a command-line tool designed for obfuscating Python scripts, binding obfuscated scripts to specific machines, and setting expiration dates for obfuscated scripts.

INBOXFUSCATION

Inboxfuscation is an advanced inbox rule obfuscation framework for Microsoft Exchange environments. The tool provides sophisticated Unicode-based obfuscation techniques to create stealthy inbox rules that can evade basic detection while maintaining functionality.

CHECK POINT ACQUIRES LAKERA TO BUILD A UNIFIED AI SECURITY STACK

Check Point has announced plans to acquire AI security platform Lakera in Q4 2025 to strengthen enterprise defenses against emerging AI threats like prompt injection attacks, data leaks through LLMs, and model manipulation as organizations rapidly adopt generative AI and autonomous agents. Lakera's AI-native runtime protection technology boasts 98% detection rates with sub-50ms latency and less than 0.5% false positives, addressing gaps that traditional cybersecurity tools cannot handle in real-time AI environments.

WATCHGUARD WARNS OF CRITICAL VULNERABILITY IN FIREBOX FIREWALLS

WatchGuard has released security updates to address a critical (CVSS 9.3) remote code execution vulnerability impacting its Firebox firewalls. The vulnerability is caused by an out-of-bounds write on devices configured to use IKEv2 VPN. Devices that have deleted the vulnerable configuration but still have a branch office VPN to a static gateway peer configured may also be vulnerable.

MEET SHADOWLEAK: ‘IMPOSSIBLE TO DETECT' DATA THEFT USING AI

Researchers at Radware discovered a vulnerability called ShadowLeak that exploits OpenAI's ChatGPT through indirect prompt injection attacks. Hidden email instructions can trick the AI into stealing sensitive data like credit card numbers and names from users' inboxes. The attack bypasses ChatGPT's security protections by encoding stolen data in Base64 and exfiltrating it directly through OpenAI's servers via the agent's browsing tool, making it nearly impossible to detect since it doesn't go through the client interface. This attack represents a significant escalation from previous client-side prompt injection attacks, as the data theft occurs entirely on the backend without any visible signs to the user.

INSIDE THE 2025 SECURITY OPERATIONS REPORT: WHAT 330 TRILLION DATA POINTS REVEAL ABOUT MODERN CYBER RISK

Adversaries are accelerating their tactics, with over half of security alerts now occurring outside business hours.

TRUMP ADMIN SAYS SOCIAL SECURITY DATABASE WASN'T “LEAKED, HACKED, OR SHARED”

The Trump administration denied allegations by a whistleblower that Social Security data was moved to an insecure cloud system.

JAGUAR LAND ROVER TO PAUSE PRODUCTION FOR THIRD WEEK DUE TO CYBERATTACK

Jaguar Land Rover will extend its vehicle production shutdown into a third week following a cyberattack earlier this month.