TLDR INFORMATION SECURITY 2025-12-04

EVEREST RANSOMWARE CLAIMS ASUS BREACH AND 1TB DATA THEFT

The Everest ransomware group claimed responsibility for breaching ASUS and exfiltrating over 1TB of data allegedly containing proprietary camera source code, firmware, and drivers for devices with built-in cameras. The group issued a 21-hour deadline for ASUS to respond via Qtox encrypted messaging, following recent claimed attacks on Under Armour, Petrobras, and Iberia airline. ASUS has neither confirmed nor denied the breach, which, if verified, would mark the second significant infrastructure compromise since the 2019 ShadowHammer supply chain attack.

GMARKET SUFFERS UNAUTHORIZED PAYMENT INCIDENT AFFECTING 60 USERS AMID HACKING WOES

Financial authorities have begun an emergency on-site inspection of the Korean e-commerce platform Gmarket after reports of unauthorized mobile payments. The attackers purchased mobile gift certificates using credit cards registered with Gmarket's simple payment service. Gmarket claims that the unauthorized payments resulted from account compromise, not a data breach.

K7 ANTIVIRUS VULNERABILITY ALLOWS ATTACKERS TO GAIN SYSTEM-LEVEL PRIVILEGES

A security researcher discovered a privilege escalation vulnerability in the K7 Ultimate Security antivirus while investigating an unrelated DoS vulnerability. The vulnerability exploited named pipes with overly permissive access control lists, allowing a non-admin user to execute arbitrary code as SYSTEM during fake updates. K7 worked with the researcher to issue three patches to provide interim fixes for the vulnerability pending full ACL enforcement in a future release.

FROM ZERO TO SYSTEM: BUILDING PRINTSPOOFER FROM SCRATCH

A Windows privilege escalation technique exploits named pipes and the Print Spooler's RPC interface to elevate accounts with SeImpersonatePrivilege, such as IIS app pool identities, to SYSTEM. It exploits its lack of SQOS protection and a path-validation bug that can be bypassed by crafting backslash/forward-slash-separated pipe paths to trigger SYSTEM connections to an attacker‑controlled pipe.

68% OF PHISHING WEBSITES ARE PROTECTED BY CLOUDFLARE

Modern phishing operations increasingly rely on mainstream infrastructure like Cloudflare, major cloud providers, and popular developer-focused TLDs such as .dev and .app to appear legitimate and resist takedown. Attackers mix disposable direct-hosted servers with CDN-protected setups, often hiding behind services like Vercel, GitHub Pages, and other trusted platforms that organizations cannot simply block. Phishing-as-a-Service ecosystems now provide turnkey kits with MFA bypass, session cookie theft, and advanced evasion, heavily targeting brands like Meta, Amazon, and PayPal.

ZEROCRUMB

ZeroCrumb bypasses the Chrome Elevation Service by impersonating a Chrome instance to dump app bound protected credentials and cookies without privileges.

CYBER STARTUP FRENETIK LAUNCHES WITH PATENTED DECEPTION TECHNOLOGY THAT BETS AGAINST THE AI ARMS RACE

Maryland-based Frenetik emerged from stealth with patented "Deception In-Use" technology (US Patent 12,463,981) that continuously rotates active identities and resources across Microsoft Entra, AWS, Google Cloud, and on-premises environments to invalidate attacker reconnaissance. The approach exploits information asymmetry by ensuring defenders receive real-time change notifications through out-of-band channels while attackers operate on stale intelligence, funneling them into honeypots and decoys. A free community version is available for organizations seeking to implement active deception without extensive tuning or analyst oversight.

FLOWSINT

Flowsint is an open-source OSINT graph exploration tool designed for ethical investigation, transparency, and verification.

RESEARCHERS CAPTURE LAZARUS APT'S REMOTE-WORKER SCHEME LIVE ON CAMERA

Researchers from BCA LTD, NorthScan, and ANY.RUN captured Lazarus Group's Famous Chollima division operating live by deploying sandbox VMs disguised as developer workstations to trap operators targeting Western companies in finance, crypto, healthcare, and engineering sectors. The investigation revealed a toolkit focused on identity takeover rather than malware. Organizations should implement enhanced vetting for remote hires as attackers request full identity documents and 24/7 laptop access to infiltrate companies without deploying traditional malicious payloads.

SECURITY RESEARCHER FUMES AT LOW MACOS BUG BOUNTY REWARDS

The new Apple Security Bounty payouts devalue macOS. Full Transparency, Consent, and Control (TCC) bypasses are down from $30.5k to just $5k, while other TCC categories have been reduced from $5-$10k to just $1k. This shows an admission by Apple that it can't fix everything and is prioritizing iPhone users over Mac users.

FRAUDULENT GAMBLING NETWORK MAY ACTUALLY BE SOMETHING MORE NEFARIOUS

A long‑running online gambling operation targeting Indonesian users is built on hundreds of thousands of owned and hijacked domains, compromised WordPress/PHP sites, and malicious Android apps. Its cost, scale, and advanced tradecraft point to an APT-style, possibly state-aligned group that uses the gambling infrastructure as both a revenue stream and cover for stealthy access to Western government and industry networks.

Learn how to get started

INDIA ORDERS MESSAGING APPS TO WORK ONLY WITH ACTIVE SIM CARDS TO PREVENT FRAUD AND MISUSE

India's Department of Telecommunications directed messaging apps, including WhatsApp, Telegram, and Signal, to require account linking to an active SIM card and implement mandatory 6-hour web session logouts within 90 days to combat cross-border fraud, phishing, and "digital arrest" scams that exploit anonymous or migrated accounts.

GOOGLE PATCHES 107 ANDROID FLAWS, INCLUDING TWO BEING ACTIVELY EXPLOITED

Google's December 2025 Android Security Bulletin addressed 107 vulnerabilities, including two actively exploited high-severity framework flaws (CVE-2025-48633 and CVE-2025-48572) that enable local code execution via improper input validation on Android 13-16.

HERE'S YOUR WORST NIGHTMARE: E-TAILER CAN ONLY RESUME PARTIAL SALES 45 DAYS AFTER RANSOMWARE ATTACK

Japanese e-tailer Askul restored B2B online sales and warehouse systems after a ransomware attack in October disrupted ordering, shipping, and logistics for its brands and partners, forcing temporary reliance on fax-based ordering for critical customers.