Parse notes
Poland's power grid faced a cyberattack in December that involved a new “DynoWiper” malware. Likely linked to Russia's Sandworm group, the attempt to disrupt electricity failed. The operation coincided with the 10th anniversary of Sandworm's landmark 2015 Ukraine blackout, and it fits a long pattern of Russian wiper use.
Attackers can still exploit a critical FortiCloud SSO authentication vulnerability in FortiOS, even on systems fully patched in December, by abusing a new SAML-based SSO attack path. Recent campaigns involve automated reconfiguration of FortiGate firewalls, the creation of backdoor admin accounts, and the theft of configuration files. Fortinet has urged customers to monitor authentication logs, restrict management exposure, and track admin changes while it develops a new fix.
A critical (CVSS 9.8) vulnerability in telnet could allow unauthenticated users to obtain root privileges on systems running InetUtils telnetd. To exploit the vulnerability, an attacker only needs to set their USER environment variable to “-f root” and pass the “-a” or “--login” flag to telnet. Experts recommend updating to the latest version of telnet or, ideally, switching to a more secure protocol such as SSH.
Kubernetes v1.35 added the ability for CSI drivers to opt-in to receiving service account tokens via the `secret` field in `NodePublishVolumeRequest`. Prior to this update, service account tokens were received via the `volume_context` field, which could lead to secrets being included in gRPC request logs if drivers did not implement custom sanitizer logic. To opt in to this feature, CSI drivers should implement the `serviceAccountTokenInSecrets' field as well as implement logic for backwards compatibility.
This technical deep dive compares C2PA (the industry standard backed by Adobe and Sony) with the emerging Content Provenance Protocol (CPP) for building tamper-proof media applications that prove content authenticity. CPP's key differentiator is its "Completeness Invariant," which uses XOR hash sums to mathematically detect deleted evidence—a critical capability for legal proceedings, insurance claims, and regulatory compliance that C2PA cannot provide architecturally. The article provides Swift and Python implementations of cryptographic patterns, including Secure Enclave signing, Merkle tree construction, RFC 3161 timestamp anchoring, and privacy-preserving human attestation without storing biometric data.
While LLMs can be a useful tool for defenders, they can also be used by attackers. WormGPT was the first malicious LLM that was released. It is still being developed. KawaiiGPT is an open-source malicious LLM. This article analyzes the efficacy of these models at producing ransomware notes, data exfiltration scripts, and lateral movement detection.
Sponsored
SO-CON 2026 (April 13–14, Arlington, VA) brings together the community shaping the future of Attack Path Management [11]. Hear from Kevin Mandia, HD Moore, JPMorgan Chase, and leading APM practitioners—plus hands-on training led by real adversary experts. Training students get a free event pass. View the full agenda here [10].
Whether you're in red teaming, blue teaming, appsec, or OSINT, this list helps you explore and leverage the best tools demonstrated live by security professionals across the world.
Security Detections MCP is an MCP server that enables LLMs to query a unified database of over 7,200 Sigma, Splunk ESCU, Elastic, and KQL security detection rules through natural language. The tool features SQLite FTS5-powered full-text search across detection fields, MITRE ATT&CK mapping, CVE coverage lookup, and process name filtering, with token-optimized analysis tools that reduce data transfer by 25x compared to traditional queries. Security teams can integrate this with Claude Desktop, Cursor IDE, or VS Code to perform coverage analysis, identify detection gaps against threat profiles, and generate ATT&CK Navigator layers directly from their AI assistant.
Bandjacks is a comprehensive Cyber Threat Intel system that quickly extracts MITRE ATT&CK techniques from threat reports, builds a knowledge graph of threat actors, and utilizes LLM response caching for faster extraction, among other features.
The FBI has obtained a warrant compelling Microsoft to hand over BitLocker recovery keys for three seized laptops, allowing agents to decrypt the drives despite full‑disk encryption. BitLocker recovery keys are often stored in Microsoft's cloud, enabling lawful access but also raising privacy and security fears if the company or its keys are compromised.
Microsoft describes a layered phishing and BEC campaign against energy companies that abuses trusted services like SharePoint and OneDrive to deliver links leading to adversary-in-the-middle credential theft pages. Attackers then use stolen credentials and session cookies to set stealthy inbox rules, launch large internal and external phishing waves, and bypass MFA using tailored phishing kits and social engineering, prompting defenders to adopt phishing-resistant MFA, conditional access, continuous access evaluation, and robust anti-phishing controls.
Ireland has announced the release of a new communications bill that seeks to provide sweeping updates to its decades-old telecommunications legislation. Among the provisions in the bill, Ireland is looking to provide law enforcement with the ability to utilize spyware as well as the ability to intercept encrypted messages. Ireland is looking to follow the framework laid out by the EU Commission in 2024.
Anthropic is preparing to launch Security Center for Claude Code, a feature that will provide users with an overview of recent security scans, detected issues, and the ability to manually initiate repository scans.
Google resolved a Gmail glitch that caused marketing and promotional emails to flood users' Primary inboxes instead of being routed to the Promotions tab.
1Password will now display pop-up warnings when users attempt to enter credentials on typosquatted or suspected malicious domains that don't match URLs stored in their vault.