TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2025-11-11

6 sections17 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

02ATTACKS & VULNERABILITIES

DATA LEAK EXPOSES CHINESE STATE-SPONSORED CYBER ARSENAL AND TARGET DATABASE

Threat actors have stolen a massive amount of data from the Chinese cybersecurity firm Knownsec. The breach includes specifications for cyber weapons, source code for proprietary hacking tools, operational details of government collaborations, and an extensive list of foreign surveillance targets. A spreadsheet within the breach details 80 overseas targets allegedly compromised by Knownsec operatives.

gbhackers.com2 min read

IMPROPER AUTHENTICATION HANDLING IN THE AMAZON WORKSPACES CLIENT FOR LINUX

Amazon identified a vulnerability in the Amazon WorkSpaces client for Linux. Under specialized circumstances, an attacker may be able to extract a valid authentication token from the client's machine and access another user's Workspace. The impacted client versions have reached end-of-support. Customers are encouraged to upgrade to a supported version.

aws.amazon.com1 min read

NEARLY 30 ALLEGED VICTIMS OF ORACLE EBS HACK NAMED ON CL0P RANSOMWARE SITE

Nearly 30 organizations, including major firms such as Logitech, The Washington Post, and Cox Enterprises, were allegedly impacted by a Cl0p ransomware campaign that exploited Oracle's E-Business Suite. Some, such as Harvard and The Washington Post, have confirmed involvement, but most have not commented on the matter.

securityweek.com3 min read

03STRATEGIES & TACTICS

CISOS MUST PROVE THE BUSINESS VALUE OF CYBER — THE RIGHT METRICS CAN HELP

CISOs struggle to demonstrate the value of security because they often rely on technical metrics, such as MITRE ATT&CK and patch statistics, rather than business-focused measures. Boards are fatigued from unclear capital allocation and lack visibility into how cybersecurity investments lower risk. Experts advise establishing enterprise risk management, calculating financial exposure in dollars, and presenting understandable metrics like industry benchmarks, risk reduction, and ROI. CISOs should align security with business goals by consulting departments, translating cyber risks into financial terms, and showing measurable risk reduction, such as a 40% decrease in cyber loss exposure.

csoonline.com8 min read

ATT&CK V18: THE DETECTION OVERHAUL YOU'VE BEEN WAITING FOR

MITRE ATT&CK v18 introduces two new components, Detection Strategies and Analytics, replacing brief detection notes with detailed, behavior-based guidance that connects techniques to platform-specific analytics, log sources, and data elements. The enterprise domain introduces 13 new techniques, covering Kubernetes, CI/CD pipeline tampering, cloud databases, and ransomware preparation activities, including backup software detection and selective file exclusion, as well as adversary monitoring of their own threat intelligence. The framework suggests splitting the Defense Evasion tactic into Stealth (altering defender visibility) and Impair Defenses (disrupting security controls), while launching an ATT&CK Advisory Council for formal community input and establishing faster CTI releases independent of biannual framework updates.

medium.com7 min read

IMPLEMENTING THE ETHERHIDING TECHNIQUE

Etherhiding is a technique used by attackers to distribute malware using public blockchains, specifically Ethereum. It works by hiding critical information, such as payloads or configuration data, within blockchain smart contracts, making them accessible while making them difficult to take down or block. This hands-on demo shows how to build a simple Ethereum smart contract using Solidity, deploy it to the Sepolia test network via MetaMask, and create a web page that retrieves and displays the hidden information from the blockchain using Infura RPC.

medium.com7 min read

04LAUNCHES & TOOLS

Sponsored

👩🎓 MAKE IT OFFICIAL: GET AN ONLINE MASTER'S IN CYBERSECURITY RISK MANAGEMENT

If you're reading this newsletter, you're interested in cybersecurity. Want to take the next step? Get up to speed and certified with Georgetown University's Online Master's Program [13] - where you'll master leading tools and techniques, understand established frameworks, and gain hands on threat detection experience with real data. To learn more, join the free webinar [14].

scs.georgetown.eduSponsor

NAKIVO INTRODUCES V11.1 WITH UPGRADED DISASTER RECOVERY AND MSP FEATURES

NAKIVO Backup & Replication v11.1 offers enhanced features, including real-time VMware replication with automated failover via Site Recovery workflows, eliminating manual setup through automatic IO Filter and Journal Service installation. It broadens Proxmox VE support with Flash VM Boot for instant recovery, VM replication, and direct tape recovery, while MSP Direct Connect enables secure, encrypted client-side connectivity supporting VMware, Hyper-V, and Proxmox VE. Additionally, the update introduces granular backup options for physical Windows and Linux systems, allowing selective folder and volume protection with flexible recovery methods such as SMB/NFS shares, all featuring encryption, immutability, and air-gapping for ransomware defense.

bleepingcomputer.com2 min read

MAD-CAT

MAD-CAT (Meow Attack Data Corruption Automation Tool) is a security testing program designed to simulate data corruption attacks on six database platforms: MongoDB, Elasticsearch, Cassandra, Redis, CouchDB, and Hadoop HDFS. It allows for both single-target tests and bulk CSV attack campaigns, with options for scenarios that include credentials or not. This enables security teams to evaluate how well their databases can withstand corruption threats. Security experts can utilize MAD-CAT to examine data integrity measures and verify backup and recovery processes across various database setups within their systems.

github.comGitHub repository

ONLYSHELL

OnlyShell is a powerful Go-based reverse shell handler that allows you to manage multiple reverse shell connections simultaneously.

github.comGitHub repository

05MISCELLANEOUS

RUSSIAN NATIONAL PLEADS GUILTY TO BREAKING INTO NETWORKS FOR YANLUOWANG RANSOMWARE ATTACKS

Aleksei Olegovich Volkov (aka "chubaka.kor") pleaded guilty to serving as an initial access broker for Yanluowang ransomware, attacking seven US businesses between July 2021 and November 2022, with total ransom demands reaching $24 million. FBI blockchain analysis traced cryptocurrency payments to accounts owned by Volkov and a co-conspirator in Indianapolis, confirming his identity and communications about attack coordination and profit-sharing. Volkov faces up to 53 years in prison and must pay $9.2 million in restitution. Victims experienced operational shutdowns, data encryption, executive harassment calls, and DDoS attacks following initial compromise through vulnerability exploitation.

cyberscoop.com3 min read

WHY A LOT OF PEOPLE ARE GETTING HACKED WITH GOVERNMENT SPYWARE

The reach of government spyware now extends far beyond its original promise of targeting only criminals and terrorists. Increasingly, journalists, activists, and minor political figures around the world are being surveilled, enabled by vendors whose scalable technology and weak oversight make widespread abuse easy. Governments, both democratic and authoritarian, face little accountability or limitation, although international moves and investigations may finally be prompting some overdue scrutiny and action.

techcrunch.com4 min read

NEW BROWSER SECURITY REPORT REVEALS EMERGING THREATS FOR ENTERPRISES

Emerging enterprise threats increasingly concentrate in the user's browser. Unmanaged AI tools, browser extensions, and non-corporate logins are key risks, as traditional security solutions can't see or manage what happens in browser sessions, enabling sensitive data exposure. Set up session-native controls and browser-level monitoring to close these critical security gaps and prevent breaches.

thehackernews.com5 min read