TLDR INFORMATION SECURITY 2025-12-02

PRIVILEGE ESCALATION WITH SAGEMAKER AND THERE'S MORE HIDING IN EXECUTION ROLES

Privilege escalation flaws have been discovered in AWS SageMaker. Attackers with specific permissions can inject malicious code via lifecycle configurations, mimicking EC2 user data escalation and affecting Lambda and CloudFormation. It is important to detect stop-modify-start sequences in CloudTrail and implement strict access controls.

TOP SOUTH KOREAN E-COMMERCE FIRM COUPANG APOLOGISES OVER MASSIVE DATA BREACH

South Korean e-commerce giant Coupang disclosed unauthorized access that affected 33.7 million customer accounts beginning June 24 through overseas servers, exposing names, email addresses, phone numbers, shipping addresses, and order histories. Authorities are investigating a suspected Chinese former employee. The government is examining potential personal information protection violations. This is the country's worst data breach in over a decade.

SMARTTUBE YOUTUBE APP FOR ANDROID TV BREACHED TO PUSH MALICIOUS UPDATE

The popular open-source SmartTube YouTube client for Android TV, which provides ad blocking and runs well on low-powered devices, was compromised after an attacker gained access to the developer's signing keys. The compromise was detected when multiple users reported that Play Protect blocked SmartTube. The app developer confirmed that his digital keys were compromised and stated that he had revoked the old signature and would publish a new version with a separate app ID.

BIND LINK – EDR TAMPERING

Threat actors can abuse Windows 11's Bind Link API through the bindflt.sys driver to redirect EDR installation folders to attacker-controlled directories, enabling DLL hijacking and code execution under EDR context. The EDR-Redir proof of concept uses LoadLibraryW to load bindfltapi.dll and CreateDirectoryW to create transparent folder mappings between virtual and backing paths. CrowdStrike, SentinelOne, and Carbon Black have implemented BindFlt monitoring, while Microsoft Defender for Endpoint remains vulnerable. Security teams should deploy Sysmon Event ID 7 monitoring for bindfltapi.dll image load events, validate whether legitimate bind link usage exists in their environment to reduce false positives, and investigate EDR vendor support for bindflt driver activity detection.

START USING WINDOWS AUTOPATCH

Microsoft Intune provides an endpoint management suite for Windows devices. Windows Autopatch is built into Intune and allows administrators to define groups to gradually roll out to an organization. Administrators can also configure hot patching on devices to expedite compliance.

SHAI HULUD 2.0: ANALYSIS AND COMMUNITY RESOURCES

Use code ZTWTLDR26 for $200 off your all-access pass

GUILTY-AS-YARA

Guilty-As-Yara is a Rust-based tool that generates Windows PE executables containing data patterns designed to trigger YARA rule matches for validating rules.

R2FRIDA

r2frida is a radare2 plugin that bundles Frida to instrument and analyze local or remote processes via r2 commands and scripts.

TOMIRIS SHIFTS TO PUBLIC-SERVICE IMPLANTS FOR STEALTHIER C2 IN ATTACKS ON GOVERNMENT TARGETS

Tomiris is a Kazakhstan-linked threat actor that leverages Telegram and Discord as command-and-control infrastructure while targeting foreign ministries and government entities across Russia and Central Asia through spear-phishing campaigns. The attack deploys multi-language malware, including Rust-based downloaders, Python-based backdoors like Distopia, and custom implants. Over 50% of lures use Russian-language content to blend malicious traffic with legitimate service activity. Security teams should monitor for unusual Telegram and Discord API traffic patterns, implement application control policies that restrict execution from archive files, and deploy behavioral detection to detect persistence mechanisms targeting Windows Registry modifications associated with these custom implant families.

AWS PRE:INVENT SECURITY HIGHLIGHTS: WHAT CHANGED AND WHY IT MATTERS

AWS has added a new CLI command, `aws login`, which allows users to obtain short-lived credentials for AWS even if the account isn't configured with IAM Identity Center. AWS IAM Outbound Identity Federation now allows AWS users or services to request a short-lived JWT for external services that trust your AWS account, which can replace the use of hardcoded, long-term credentials or API keys in Lambda or EC2. AWS has also enabled Attribute-Based Access Control (ABAC) for S3, which allows users to define access permissions to S3 using tags instead of listing every bucket in an IAM policy.

PURPLE TEAM MATURITY MODEL: FROM CHAOS TO CONTROLLED CHAOS

Organizations that wish to start with purple teaming can begin by defining a purple team strategy with loosely scheduled sessions, referencing MITRE ATT&CK tactics in testing, and feeding early detection gaps into detection engineering. Teams can then introduce metrics as they mature, begin using more structured purple team exercises, and map red team TTPs more closely to MITRE ATT&CK tactics and threat intel. As teams further mature, they can introduce automated adversary emulation. Eventually, purple teaming can be driven by threat-intel, continuously run fully automated attack chains, and integrate machine learning, SOAR, and XDR to power rapid detection and response.

now to get your 3 FREE INFOSEC SKILLS SEATS.

NORTH KOREAN HACKERS DEPLOY 197 NPM PACKAGES TO SPREAD UPDATED OTTERCOOKIE MALWARE

North Korean threat actors deployed 197 malicious npm packages downloaded over 31,000 times as part of the Contagious Interview campaign.

OVER 2,000 FAKE SHOPPING SITES SPOTTED BEFORE CYBER MONDAY

CloudSEK discovered over 2,000 interconnected fake shopping sites targeting Black Friday and Cyber Monday shoppers through coordinated phishing campaigns.

EUROPEAN COPS SHUT DOWN CRYPTO MIXING WEBSITE THAT HELPED LAUNDER 1.3B EUROS

Europol and partner agencies have seized Cryptomixer, a widely used crypto-mixing service linked to cybercriminal activities such as drug trafficking, arms sales, ransomware, and card fraud.