TLDR INFORMATION SECURITY 2025-12-10

OVER 70 DOMAINS USED IN MONTHS-LONG PHISHING SPREE AGAINST US UNIVERSITIES

A coordinated phishing campaign that ran from April to November targeted at least 18 US universities using approximately 70 domains and the Evilginx adversary-in-the-middle toolkit. Attackers sent personalized emails containing TinyURL-shortened links that impersonated university SSO portals to steal MFA-bypassing session cookies. UC Santa Cruz, UC Santa Barbara, University of San Diego, Virginia Commonwealth University, and University of Michigan were among the most heavily targeted. Recommended mitigations include adopting phishing-resistant MFA (FIDO2/WebAuthn) and monitoring unusual session cookie behavior.

OVER 300,000 INDIVIDUALS IMPACTED BY VITAS HOSPICE DATA BREACH

Vitas Healthcare, the largest US for-profit hospice chain, reported that a compromised vendor account was used to access its systems from late September to late October, exposing data belonging to over 300,000 current and former patients. Exposed information includes contact details, identification numbers, Social Security numbers, medical and insurance data, and next-of-kin contacts. No ransomware group has claimed responsibility.

IVANTI WARNS OF CRITICAL ENDPOINT MANAGER CODE EXECUTION FLAW

Ivanti disclosed a critical vulnerability in its Endpoint Manager (EPM) platform that allows unauthenticated attackers with access to the EPM web service to register fake endpoints and inject malicious JavaScript into the administrative dashboard. Ivanti also patched three additional high-severity vulnerabilities, including two that could enable unauthenticated remote code execution on arbitrary systems.

SYSMON CONFIG CREATION FOR THE LOLRMM FRAMEWORK

A security researcher released a Sysmon configuration tailored to detect Remote Monitoring and Management (RMM) tools listed in the LOLRMM framework. The rules cover process creation, file operations, network activity, and DNS queries, derived from behavioral analysis of RMM installers executed in VirusTotal, Hybrid-Analysis, and Any.run sandboxes. By capturing file paths, registry keys, and network indicators, the configuration helps security teams spot unauthorized RMM activity even when binaries are renamed or obfuscated.

PROMPT INJECTION IS NOT SQL INJECTION (IT MAY BE WORSE)

The UK NCSC explains that prompt injection fundamentally differs from SQL injection because LLMs do not separate instructions from data, they simply predict tokens. As a result, techniques like parameterized queries cannot fully mitigate prompt injection. The agency recommends treating LLMs as "inherently confusable deputies" and implementing deterministic guardrails that constrain system actions outside of the model rather than relying on input filtering. Effective defenses include enforcing least privilege for LLM-driven workflows, closely monitoring tool and API usage, and acknowledging that prompt injection remains a residual architectural risk.

RISK-BASED ALERTING IN MICROSOFT SENTINEL

Risk-Based Alerting (RBA) allows analysts to combine multiple lower-fidelity alerts into a single higher-confidence incident by assigning risk scores to alerts that do not individually generate incidents. An incident is only created once a cumulative risk threshold is met. When assigning scores, teams should weigh potential impact, the criticality of the asset or user involved, and the confidence that the behavior reflects real malicious activity. This approach can reduce alert fatigue and improve triage efficiency.

breakdown

CVE POC SEARCH

This tool provides a streamlined interface for searching proof-of-concept (PoC) exploit code associated with specific CVEs. Rather than serving as a vulnerability database, it aggregates and directs users to underlying PoC sources, making it useful for quickly locating exploit references for testing, validation, or workflow integration.

IMPER AI (PRODUCT LAUNCH)

Imper.ai provides real-time detection and prevention of impersonation and social engineering attacks across video, voice, phone, and chat communications.

CRACKFTP

CrackFtp is a mass FTP checker and cracker designed to test login credentials and alert on successful logins to secure domains with Telegram notifications.

THE CURIOUS CASE OF TWIN HACKERS ACCUSED OF ERASING US GOVERNMENT DATABASES

Twin brothers Muneeb and Sohaib Akhter, federal contractors previously convicted of hacking in 2015, were arrested for allegedly deleting nearly 100 government databases containing FOIA records and sensitive investigative files. After learning of their termination from Opexus, the pair allegedly used still-active credentials to access systems. Authorities say Muneeb also stole IRS tax records of 450 individuals and attempted to erase evidence via AI-assisted log deletion queries. The case underscores the need for immediate credential revocation on termination, rigorous vetting for privileged roles, and strong backup strategies.

DANGEROUS INVITATIONS: RUSSIAN THREAT ACTOR SPOOFS EUROPEAN SECURITY EVENTS IN TARGETED PHISHING ATTACKS

Russian threat actor UTA0355 impersonated multiple prominent European security conferences, including the Belgrade Security Conference and Brussels Indo-Pacific Dialogue, to harvest Microsoft 365 credentials. The attackers created convincing replica websites and abused OAuth and Device Code authentication flows. They used rapport-building outreach on WhatsApp and Signal, leveraged compromised accounts for credibility, and selectively triggered credential theft based on targeted email domains. Defenses include user training on OAuth consent prompts, monitoring anomalous device registrations in Entra ID, and enforcing conditional access controls.

RESEARCHERS SPOT 700% INCREASE IN HYPERVISOR RANSOMWARE ATTACKS

Security researchers report a 700% increase in ransomware attacks targeting hypervisors like Hyper-V and VMWare ESXi, with groups such as Akira leading the trend. Hypervisors often lack endpoint-style protections and offer attackers a control point over numerous VMs simultaneously. Attacks abuse built‑in tools to encrypt VM storage and misuse management utilities to disable protections.

10TB of logs, your price stays the same. Get a demo

FINCEN SAYS RANSOMWARE GANGS EXTORTED OVER $2.1B FROM 2022 TO 2024

FinCEN reported $2.1 billion in ransomware payments across 4,194 incidents from 2022-2024, with 2024 showing a significant drop to $734 million following law enforcement disruptions of ALPHV/BlackCat and LockBit operations.

GEMINI ENTERPRISE NO-CLICK FLAW EXPOSES SENSITIVE DATA

Google patched a Gemini Enterprise weakness that let attackers hide prompt-injection instructions inside shared Docs, Calendar events, or emails.

US POSTS $10 MILLION BOUNTY FOR IRANIAN HACKERS

The US is offering up to $10 million for information on two key figures in the Iranian state-linked hacking outfit now called Shahid Shushtari, previously known by several front-company names.