As part of Google's bugSWAT event, a group of security researchers managed to exfiltrate a sensitive binary from Gemini's Python Sandbox. The researchers first discovered that the sandbox provides full access to the os library which allowed them to map the sandbox's filesystem and locate the /usr/bin/entry/entry_point binary which they exfiltrated by returning 10MB chunks of base64 encoded data to the frontend. After reassembling it, the researchers found source code for the sandbox's Python interpreter and protobufs that describe how sensitive data is classified, handled, and transmitted within Google.
The Smishing Triad, based in China, is expanding rapidly and selling mobile phishing kits to target global financial institutions and a wide range of industries worldwide.
Some Microsoft 365 Family users are experiencing a licensing issue that prevents access to services, prompting reports of subscription renewals despite the fact that their subscriptions are still active.
Sponsored
Earlier this year, Microsoft made MFA mandatory on all Azure logins - but in an age of increasingly sophisticated attacks against identities, this might not be enough.
Kaspersky researchers discovered a threat actor that is using a SourceForge project page to host malware masquerading as the Microsoft Office-Addin-Scripts project. The page prompts users to download a password-protected zip file that contains an MSI file, which drops two RAR archives and downloads a batch script from GitHub. The batch script scans for antivirus and analysis tools, unpacks the archives, and runs another batch script, which sets up persistence, C2, and runs a cryptocurrency infostealer and crypto miner.
Gladinet has warned of a vulnerability in its CentreStack file-sharing software that has been under active exploitation since March. The vulnerability is a deserialization vulnerability stemming from using a hardcoded machineKey. Galdinet has recommended that customers apply patches immediately or rotate the machine keys if immediate patching is not possible.
NVIDIA's patch for CVE-2024-0132 was incomplete, leaving AI infrastructure vulnerable to attacks. Exploiting the vulnerabilities could lead to data breaches and operational disruptions.
Linux rootkits commonly share a set of capabilities such as hiding itself, hiding data, offering a reverse root shell, and establishing boot persistence. The author of this blog post discusses how to use kprobe to detect LKM rootkit registration and inline hooking. They also reflect on the process of writing an LKM in Rust during their internship, noting the lack of abstractions but also appreciating the safety guarantees of Rust as well as the typing and linting systems.
This post showcases the damage that a coding vulnerability in a Lambda function can cause using the DVSA intentionally vulnerable app as an example. The application includes a Lambda function that uploads files attached to the feedback form, which is vulnerable to OS command injection. This vulnerability can be used to extract the Lambda function's IAM credentials, which provide full access to Lambda and SES.
PCI DSS 4.0.1, exemplifies successful industry-led cybersecurity regulation by focusing on outcomes rather than methods. Unlike government regulations that awkwardly combine business security with user rights, PCI DSS was created by payment industry stakeholders collaboratively addressing threats. This commentary dives into how other existing and future regulations and frameworks can learn from PCI.
Sponsored
Managing VPN gateways, firewall rules, and security groups is time-consuming. Exposing API endpoints or using jump hosts creates security risks. Is there a better way? Watch the NetBird webinar recording [11] and learn how to securely access Kubernetes from non-Kubernetes resources, with Zero Trust access to your control plane
opkssh (OpenPubkey SSH) is a tool that enables SSH to be used with OpenID Connect identities instead of long-lived SSH keys.
Mimic is exclusively focused on thwarting the threat from ransomware gangs. It offers features to quickly detect signs of malicious data encryption and tools to hide critical assets from attackers.
Automated handling of data feeds for security teams
Anthropic has announced new updates to its Responsible Scaling Policy (RSP), which determines what level of model requires additional protections. These models include those with the capacity to potentially help a state actor develop chemical and biological weapons or if a model could be used to fully automate the role of an entry-level Anthropic researcher. Anthropic had announced in October that it would begin sweeping physical offices for hidden devices and implement other physical security measures.
A cyberattack caused computer outages at Kuala Lumpur International Airport in Malaysia back in March. Prime Minister Anwar Ibrahim refused the attackers' $10 million ransom demand. At the time, even though officials claimed airport operations continued normally, photos showed staff using whiteboards for flight information.
NIST announced all CVEs published before January 1, 2018, will be marked "deferred" in the National Vulnerability Database. This administrative change helps prioritize newer vulnerabilities but doesn't reduce the severity of older security flaws.
A hacker named "Satanic" has claimed a WooCommerce data breach affecting over 4.4 million users, including major organizations like NVIDIA and Texas.gov.
Google has launched Firebase Studio, an AI-powered integrated development environment for building full-fledged apps using prompts.
Microsoft is investigating a global outage affecting Exchange Admin Center access for IT admins worldwide.
The University of Maryland Medical Center (UMMC) is being sued by current and former employees for enabling a pharmacist to conduct cyberstalking due to a lack of security practices. The pharmacist used a keylogger and installed spyware on at least 400 computers in UMMC to obtain employees' usernames and passwords to access the accounts of about 80 female co-workers for nearly a decade. The hacker hacked victims' cloud accounts to steal private information and used internet-connected cameras to watch the victims in their homes.
A threat actor known as ToddyCat has exploited a vulnerability in ESET's antivirus scanner. The vulnerability could allow privileged attackers to plant a malicious DLL and execute it through the antivirus scanner. The attackers in this campaign are using a tool dubbed TCDSB, which seems to be an extension of EDRSandBlast, to alter key components of the OS and disable alerts.
On February 11, the OCC, the US's banking regulator, discovered unusual activity between a system admin account and user mailboxes. Unknown attackers had accessed over 150,000 emails since June 2023. Security analyst David Shipley called the intrusion "massively serious," posing a potential threat to national banking infrastructure. The OCC, which regulates all national banks, has hired third-party cybersecurity experts for a full investigation while asserting that its security controls meet or exceed NIST standards.
This post ranks key logs for cloud incident readiness as must-have, should-have, and nice-to-have for Microsoft, AWS, and Google. It uses real-life incident response cases to highlight the importance of enabling and retaining the right logs for security monitoring and analysis.
This article examines DLL Sideloading and using Direct Syscalls as evasion techniques to bypass Antivirus and EDR solutions by loading malicious DLLs via legitimate applications. Using hijacking and Direct Syscalls, the author shows how to create and execute a malicious DLL that evades static detection and executes shellcode on a victim machine. Elastic YARA rules and Havoc C2 are used for generating and testing shellcode, enhancing evasion against security defenses.
Cisco Talos is tracking an ongoing campaign targeting users in Ukraine with malicious LNK files that resemble war-related files to eventually download the Remcos backdoor. The LNK files run a PowerShell command to launch a decoy file and download the second-stage zip file containing the backdoor. The second stage payload then uses DLL side-loading to execute the Remcos payload. Cisco believes that this campaign is associated with Gamaredon.
2025.04.09·blog.talosintelligence.com·7 min read·TLDR InfoSec Sponsored
In a recent survey of enterprise end users by Bitwarden, 96% of organizations say Bitwarden has improved their security posture and 81% have reduced reused passwords. That's just another reason why Bitwarden Password Manager [11] is trusted by millions to store, share, and protect login credentials and sensitive enterprise data. Get the report [10].
The attest-build-provenance action generates signed build provenance attestations for workflow artifacts. These attestations associate an artifact with its digest to SLSA build provenance predicate in the in-toto format, accompanied by a verifiable signature from a short-lived Sigstore certificate. The attestation generation differs based on repository visibility: public repositories use the public Sigstore instance, while private repositories utilize GitHub's private Sigstore.
ghidraMCP is a Model Context Protocol server that allows LLMs to autonomously reverse engineer applications. It exposes numerous tools from core Ghidra functionality to MCP clients.
lnav is a terminal log file viewer that supports decompressing files, detecting file format, merging files based on timestamp, tailing files, and building an index of errors and warnings.
A joint investigation by the Tech Transparency Project and the Financial Times found that at least five VPN apps present in both the App Store and Google Play store had links to a company associated with the Chinese military. Three of the apps have racked up more than a million downloads. The five apps cited were Turbo VPN, VPN Proxy Master, Thunder VPN, Snap VPN, and Signal Secure VPN (unaffiliated with the messaging app).
Python pickles are a serialization format that is commonly used in AI/ML workflows in Python. Pickles that come from unsafe sources can result in arbitrary code execution due to invalidated object loading, corrupt models, exposure of sensitive data, or lead to sensitive information disclosure due to a lack of encryption. One strategy for scanning pickle files using static code analysis is to generate a list of all Python libraries that are used in your environment, validate any pre-built rules in existing static code analysis tooling, and write custom rules in tools like Semgrep to identify pickling and unpickling methods.
A security flaw (CVE-2025-30401) in WhatsApp for Windows allowed hackers to send malicious files to users, posing a risk to those interacting with attachments. The vulnerability could trick users into opening harmful code disguised as harmless files. To stay safe, users should update WhatsApp to version 2.2450.6 or later and be cautious when opening file attachments.
The Medusa ransomware gang targeted NASCAR, demanding a $4 million ransom and threatening to release internal data if unpaid.
AWS has implemented ML-KEM, a post-quantum algorithm, to strengthen TLS connections against potential quantum computing threats.
HellCat ransomware hit four companies in the US and Europe by exploiting stolen Jira credentials obtained through infostealer malware.
Sponsored
Flashpoint's Threat Intelligence Report [4] looks at +3.6 petabytes of data from the hardest-to-reach corners of the web — revealing 2.1B stolen credentials and 5,742 ransomware attacks in 2024, with five major RaaS groups responsible for nearly half.
The State Bar of Texas suffered a data breach perpetrated by the INC ransomware gang. The threat actors stole full names, case documents, and other redacted information. The State Bar of Texas is offering free credit monitoring to victims and recommends that victims consider placing credit freezes.
A hacker breached the GitLab repos of the Europcar car rental company and stole source code for the mobile apps and personal information belonging to up to 200K customers. The threat actor discovered 9,000 SQL files, which include customers' names and email addresses, and 269 .env files. Europcar has confirmed the breach but has not provided more information.
Outlaw infects systems through SSH brute-force attacks, establishes persistence via cron jobs and SSH key manipulation, and deploys a three-part payload consisting of XMRIG for cryptocurrency mining, STEALTH SHELLBOT for remote control, and BLITZ for further propagation. Despite its unsophisticated nature, Outlaw remains effective because it leverages stolen system resources for mining profit while simultaneously expanding its botnet through continuous SSH brute-forcing of nearby systems.
Techcrunch has identified a new stalkerware app that requires a password to uninstall it. The app works by requiring the person who installs it to enable a built-in Android feature that allows for overlaying content, which allows the app to display the password prompt, which requires a password set by the person who installs it to dismiss whenever the user tries to uninstall it. Users can uninstall the app without a password by booting into safe mode. The app masquerades in the installed app list as a default Android app and also installs a device admin profile.
The post dives into Mustang Panda, which is targeting various organizations worldwide. By analyzing indicators of compromise, potential overlaps between Red Delta, APT41, and Mustang Panda were identified. The investigation led to uncovering additional infrastructure and operational connections between the threat actors.
2025.04.08·intelinsights.substack.com·3 min read·TLDR InfoSec Sponsored
When you don't know what actually exists in your environment, you could easily be leaving critical gaps that leave you vulnerable. That's why better security starts with aggregating your asset inventory [11], so you can maximize the security tools you already
MORF is an advanced mobile security analysis tool that automatically discovers sensitive information within Android and iOS applications.
RamiGPT is an AI-powered offensive security agent designed to autonomously escalate privileges using OpenAI.