TLDR Index
TLDR InfoSec

TLDR INFORMATION SECURITY 2026-02-24

6 sections18 entrieslinks blockcomplete parse

Parse notes

  • Subscription/account footer truncated before parsefooter_truncated

01GENERAL

02ATTACKS & VULNERABILITIES

DISCOVERY & ANALYSIS OF CVE-2025-29969

CVE-2025-29969 is a remote code execution vulnerability in the MS-EVEN RPC protocol — enabled by default on Windows 11 and Windows Server 2025 — that allows low-privileged users to write arbitrary files remotely by exploiting a TOCTOU flaw in the EventLog backup function, effectively bypassing default C$ share limitations. The attack chain combines a hidden CreateFile primitive for remote file/directory existence checks with an arbitrary write primitive achieved by swapping an attacker-controlled EVTX file on a remote SMB share between header validation and backup, enabling code execution via Startup folder batch scripts or DLL hijacking. Microsoft patched the TOCTOU write primitive in May 2025, though the recon capabilities enabling remote file enumeration across domain-joined machines remain unpatched.

safebreach.com13 min read

US HEALTHCARE DIAGNOSTIC FIRM SAYS 140,000 AFFECTED BY DATA BREACH

Everest ransomware actors accessed Vikor Scientific (now Vanta Diagnostics) data via revenue cycle vendor Catalyst RCM, using compromised credentials to steal about 12GB of files containing names, dates of birth, payment card data, medical details, and insurance information. Roughly 140,000 individuals are currently listed as affected, but the final impact may be higher as counts from all linked entities remain unclear.

links.tldrnewsletter.com2 min read

03STRATEGIES & TACTICS

LLMS IN THE KILL CHAIN: INSIDE A CUSTOM MCP TARGETING FORTIGATE DEVICES ACROSS CONTINENTS

A misconfigured server exposed a full intrusion toolkit where a threat actor integrated LLMs directly into the attack workflow — using DeepSeek to generate attack plans from recon data and Claude Code to conduct live vulnerability assessments — while targeting FortiGate appliances across 106 countries with 2,516 identified targets. Custom tools ARXON (an MCP server bridging LLM analysis with attack scripts) and CHECKER2 (a Go-based Docker orchestrator) automated the pipeline from stolen VPN config ingestion through internal scanning to LLM-driven exploitation planning, evolving from the open-source HexStrike framework in roughly eight weeks. Defenders should audit for unauthorized VPN accounts, unexpected SSH access, and unapproved firewall policy changes, as the dual-model approach of selecting whichever LLM is most permissive for a given task lowers the skill barrier for managing concurrent intrusions at scale.

cyberandramen.net12 min read

YOUR SAMSUNG WEATHER APP IS A FINGERPRINT

Samsung's pre-installed Weather app quietly creates a highly unique fingerprint from the combination of saved location IDs (placeid) it sends to The Weather Company's API, with 96.4% of sampled devices uniquely identifiable across days. These fingerprints persist over time, survive IP and network changes, and can be resolved into precise locations using hardcoded API keys that work from any client. Requests often include both hashed placeid values and raw GPS coordinates, giving IBM's Weather Company and Samsung rich, granular location profiles that echo a broader industry pattern of monetizing weather-based location data.

buchodi.com10 min read

NOVEL TECHNIQUE TO DETECT CLOUD THREAT ACTOR OPERATIONS

Unit 42 researchers introduced a novel detection method that fingerprints cloud threat actors by linking their known MITRE ATT&CK techniques to specific alert patterns. This approach successfully distinguished Muddled Libra (Scattered Spider) and Silk Typhoon operations across 22 industries from June 2024 to June 2025, with only three shared alert signatures out of around 120, highlighting their differing tactics. Industry alert spikes correlated with publicly reported campaigns, such as a 25% rise in transportation sector alerts during Muddled Libra's aviation attacks, enabling defenders to identify threats early by investigating actor-related alerts over a 30-day window.

unit42.paloaltonetworks.com20 min read

04LAUNCHES & TOOLS

SIPER

Siper is a high-performance, XDP-based IP blacklist firewall built with Go and eBPF that drops malicious traffic at the NIC driver level before packets reach the kernel's networking stack. It supports CIDR-based blocking via BPF LPM Trie maps, persistent JSON-based rule management, and real-time drop/pass metrics. The minimalist architecture separates a Go CLI control plane from the kernel-space data plane, offering significantly lower CPU overhead than iptables or nftables under heavy DDoS conditions.

github.comGitHub repository

TRIVYSUMMARY

TrivySummary summarises Trivy scan JSON output for reporting purposes. Package vulnerabilities are collapsed down to the respective CVE, and headline counts of vulnerabilities at different priorities. As well as the vendor severity and CVSS v3 score provided by Trivy, EPSS scores can also be retrieved, allowing the exploitability and severity of all vulnerabilities to be graphed and prioritised.

github.comGitHub repository

DEPTHFIRST (PRODUCT LAUNCH)

Depthfirst is an AI security startup whose General Security Intelligence platform scans and analyzes codebases and workflows to detect issues, prevent credential exposure, and monitor open source and third‑party components for AI‑driven threats.

depthfirst.com

05MISCELLANEOUS

HACKERS HIDE PULSAR RAT INSIDE PNG IMAGES IN NEW NPM SUPPLY CHAIN ATTACK

Veracode researchers discovered a typosquatted NPM package called "buildrunner-dev" that delivers the Pulsar RAT by hiding malicious code within PNG images using steganography, extracting payloads from RGB pixel values at runtime. The attack chain employs a heavily obfuscated 1,600-line batch file with only 21 functional lines, detects and evades AV products like ESET and Malwarebytes, and uses process hollowing to inject the final payload into legitimate processes. Developers should carefully verify package names and audit dependencies, as supply chain attacks increasingly leverage image-based steganography to bypass traditional file-scanning tools.

hackread.com2 min read

INFOSEC COMMUNITY PANICS AS ANTHROPIC ROLLS OUT CLAUDE CODE SECURITY CHECKER

Anthropic's new Claude Code Security feature scans codebases for vulnerabilities, proposes patches, and claims to have surfaced hundreds of high‑severity issues in open source projects, spooking security investors and pushing stocks like CrowdStrike down. It joins Google, Microsoft, Amazon, and OpenAI in deploying AI agents for bug hunting, but all still require human review and face questions over false positives, costs, and marketing hype.

theregister.com3 min read