Parse notes
Sponsored
Phishing has gone beyond email. Today's attackers use AI-generated voices, videos, and interactive deepfakes of company executives. They can fool anyone - including you and your coworkers.
Eclypsium researchers discovered that Microsoft-signed UEFI shells on approximately 200,000 Framework laptops contain dangerous "mm" (memory modify) commands that can completely bypass Secure Boot protections by overwriting security handler pointers in memory. The attack leverages the implicit trust model, where signed components are automatically trusted, allowing attackers to disable signature verification and load arbitrary malicious code while the system still reports Secure Boot as enabled. Security professionals should prioritize updating UEFI revocation lists (DBX), implementing BIOS passwords, and conducting firmware vulnerability assessments, as commercial cheat providers are already exploiting this technique and could be weaponized by nation-state actors for pre-OS persistence.
F5 Networks revealed that government-backed hackers accessed its systems for an extended period, stealing source code and customer data. The intrusion impacted key product development areas and exposed sensitive customer configurations. While F5 acted to contain the breach and released security patches, over 1,000 companies, including many Fortune 500 firms, may be at risk.
Reliaquest researchers uncovered a Chinese hacking campaign that targeted critical infrastructure across Asia and North America. The attackers used spear phishing to access the networks, then downloaded geo-mapping malware that disguised itself as a software component. The malware masked its network traffic to blend in with routine traffic and managed to avoid detection for at least 12 months.
Mario Candela used Beelzebub's LLM network honeypot to detect cryptojacking malware that collected system data, then stopped other miners and started XMR mining via c3pool. The operation earned around $4,126 from 20 XMR across 95 servers. Attackers used 'validator/qwerty' credentials for initial access, then changed root passwords and established persistence. Security experts should note the value of LLM honeypots for behavioral analysis and coordinated disruption, as the author neutralized the threat by reporting the wallet to c3pool, which removed all infected miners.
Adversis developed grpc-scan to automate service discovery on gRPC endpoints when reflection is disabled and documentation is minimal, exploiting how different gRPC implementations return distinct error codes (UNIMPLEMENTED vs NOT_FOUND) to differentiate between non-existent services and valid services with invalid methods. The tool systematically tests thousands of service/method combinations using common naming patterns and leverages HTTP/2 multiplexing for efficient scanning, revealing common security anti-patterns like legacy services with weaker authentication, method proliferation where newer methods bypass security checks, and "internal" services exposed on public endpoints. Security professionals should recognize that gRPC's opacity often creates a false sense of security through obscurity, and should implement proper service inventory management, consistent authentication across all service versions, and network segmentation rather than relying on undocumented APIs for protection.
Pliny the Liberator is a well-known LLM jailbreaker who shares their jailbreaking prompts on GitHub. Pliny's prompts make use of several techniques to effectively jailbreak LLMs, such as instruction prioritization, obfuscation and redirection, guardrail negation, cognitive overload, contextual misdirection, task tunneling, tonal misdirection, and output quantity bias. This post steps through each technique and showcases how the prompt utilizes it.
Sponsored
The Cloud Security Alliance partnered with Dropzone AI to measure what actually happens when SOC analysts use AI assistance [12]. Real analysts. Real alerts. Real results. No vendor spin. Get the independent data your board needs to make informed AI investment decisions.
trdl (which stands for "true delivery") is an open-source solution providing a secure channel for delivering updates from the Git repository to the end user.
This post presents three Rust-based IDA Pro 9.2 plugins that leverage Binarly's idalib bindings for automated vulnerability research. rhabdomancer identifies potentially insecure API function calls with severity tiers, haruspex extracts decompiled pseudocode for static analysis tools like Semgrep, and augur organizes string-related code for analysis. The tactical approach focuses on scale and automation, with these headless tools achieving blazing-fast analysis (processing 350KB binaries in under 3 seconds) while integrating with existing vulnerability research workflows through IDE compatibility and static analysis tool chains. Security researchers should adopt this methodology of combining reverse engineering automation with static analysis pipelines.
Oneleet combines attack surface management with code scanning to identify forgotten assets, expose services, and uncover vulnerabilities before they enter production.
Third-party provider 5CA has publicly denied responsibility for the Discord breach that exposed 5.5 million users' data, including over 70,000 government IDs, contradicting Discord's initial claims that blamed 5CA's Zendesk systems. The breach was carried out by Scattered LAPSUS$ Hunters who gained 58 hours of access starting September 20, stealing 1.6TB of data, including support tickets and partial payment information for 580,000 users. Security professionals should note the discrepancy between the hacker group's claim of 521,000 age-verification tickets versus Discord's reported 70,000 exposed government IDs, highlighting the importance of independent breach assessments and avoiding premature attribution in incident response.
Unit 42 assisted a manufacturer targeted by Ignoble Scorpius (BlackSuit ransomware) after attackers used voice phishing to steal VPN credentials, then executed DCSync attacks to compromise domain controllers and exfiltrate 400GB of data before deploying ransomware across 60 VMware ESXi hosts. The incident response strategy involved rapidly expanding Cortex XDR visibility from 250 to 17,000 endpoints and using automated containment through Cortex XSOAR to stop lateral movement, while implementing critical defenses including MFA enforcement, network segmentation, and EFSRPC blocking. Security professionals should prioritize proactive multi-layered defenses, including robust endpoint visibility, automated response capabilities, and strict access controls, as this case demonstrates how a single compromised credential can escalate to a $20 million ransom demand without proper preventive measures.
Over 550 sensitive secrets, including AWS and GitHub tokens, were exposed in public VSCode extensions. This was primarily due to insecure file handling, which attackers could exploit to push malicious updates and launch supply chain attacks. In response, platforms revoked compromised tokens, notified publishers, and improved scanning.
Sponsored
Malware monsters. Defender superheroes. Epic battles for your data. Veeam is making cybersecurity as entertaining as your favorite Halloween movie. Real lessons, zero boredom [20]. October 30th, 2-3pm
Capita was fined £14 million for a cyberattack in 2023 that exposed the data of 6.6 million people, caused a 58-hour response delay, and involved significant security failures affecting hundreds of organizations.