Search the archive

CHINA-LINKED APT SILK TYPHOON TARGETS IT SUPPLY CHAIN

The China-backed APT Silk Typhoon targets global IT supply chains by exploiting IT solutions and cloud app vulnerabilities.

US SANCTIONS IRANIAN ADMINISTRATOR OF NEMESIS DARKNET MARKETPLACE

The US imposed sanctions on an Iranian person for managing the illegal Nemesis Market, a darknet platform for drug and cybercrime trading.

FORMER TOP NSA CYBER OFFICIAL: PROBATIONARY FIRINGS ‘DEVASTATING' TO CYBER, NATIONAL SECURITY

Countering Chinese hacking of critical infrastructure will require top-level cybersecurity talent at the NSA and other agencies.

IPROOV DISCOVERS MAJOR DARK WEB IDENTITY SCAM

Researchers have uncovered a dark web operation involved in collecting facial ID images and government-issued identity documents. The threat actor bypasses Know Your Customer (KYC) identity verification systems using these biometrics. iProov recommends the use of multi-layered verification systems to defend against these threats.

OVER 4,000 ISP IPS TARGETED IN BRUTE-FORCE ATTACKS TO DEPLOY INFO STEALERS AND CRYPTOMINERS

Cybercriminals have targeted Internet service providers through a campaign involving information stealers, cryptocurrency miners, and data exfiltration tools. These brute-force attacks aim to compromise systems, disable security features, steal cryptocurrency, and deploy malware.

RANSOMWARE GANGS EXPLOIT PARAGON PARTITION MANAGER BUG IN BYOVD ATTACKS

Microsoft discovered five Paragon Partition Manager BioNTdrv.sys driver flaws, one of which was actively used by ransomware gangs in zero-day attacks to gain SYSTEM privileges in Windows. The drivers are signed by Microsoft, so they can also be used in Bring Your Own Vulnerable Driver (BYOVD) attacks. Microsoft recommends enabling the Microsoft Vulnerable Driver Blocklist to prevent BYOVD attacks.

JIGSAW RDPUZZLE: PIECING ATTACKER ACTIONS TOGETHER

German IT firm ERNW observed that an attacker compromised a customer who acted as a service provider that used RDP to connect to its customers' machines. ERNW extracted the Bitmap cache files from the RDP server to partially reconstruct the attacker's RDP sessions utilizing open-source tools. The post features screenshots displaying some of the images that ERNW managed to reconstruct.

SOAPY: STEALTHY ENUMERATION OF ACTIVE DIRECTORY ENVIRONMENTS THROUGH ADWS

Active Directory Web Services (ADWS) is a default-enabled service on Active Directory domain controllers that allows clients to interact with the local LDAP service using SOAP messages without requiring user authentication. A group of interns from X-Force Red implemented the protocol stack in a tool and Python library named SoaPy. Before this, interactions with ADWS were limited to Microsoft or .NET tools, restricting protocol usage to Windows hosts.

HOW WE ESTIMATE THE RISK FROM PROMPT INJECTION ATTACKS ON AI SYSTEMS

Google DeepMind's AI security Team has developed an evaluation framework to test an AI system's susceptibility to indirect prompt injection attacks. The framework employs a hypothetical scenario where an AI agent receives a fictitious email conversation. It uses three prompt injection methods: actor-critic, where a model generates and refines injections based on success probability; beam search; and Tree of Attacks with Pruning, which aims to make the AI violate safety protocols.

approach to mitigating AI risks. Get the guide

ROGUE

Rogue is an advanced AI security testing agent that uses Large Language Models to discover and validate web application vulnerabilities. Unlike traditional scanners, Rogue analyzes application behavior, generates test cases, and validates findings through autonomous decision-making.

SINGULR AI (PRODUCT LAUNCH)

Singulr AI enables customers to discover every generative AI and obtain information on its use within the organization, identify risky AI services, approve safe AI services, and enforce AI-related policies.

ROGUEAPPS

RogueApps is a collection of TTPs associated with OIDC/OAuth 2.0 application attacks.

LET'S ENCRYPT TO OFFER 6-DAY CERTIFICATES!

Let's Encrypt is adding a 6-day certificate option alongside the default 90-day certificate to support automation and improved certificate management.

CISA MAINTAINS STANCE ON RUSSIAN CYBER THREATS DESPITE POLICY SHIFT

CISA has announced that it will maintain its defense against Russian cyber threats despite a temporary pause on offensive actions by the Trump administration. The agency confirms its commitment to protecting U.S. Critical Infrastructure from cyber threats, including those from Russia.

GOOGLE MESSAGES IS USING AI TO DETECT SCAM TEXTS

LATIO - ACTUALLY USEFUL PRODUCT GUIDE - AI AUTO FIXING [PDF]

Report on the best product that uses AI to create fixes for issues discovered in SAST.

POPULAR TWITCH STARS UNDER SIEGE

Twitch stars Valkrae, Cinna, and Emiru were chased down in public, while Amouranth was robbed at gunpoint on the same night.

MICROSOFT LINKS RECENT MICROSOFT 365 OUTAGE TO BUGGY UPDATE

Microsoft reversed the buggy update that caused the Microsoft 365 outage and will review change management.

INDIAN STOCK BROKER ANGEL ONE DISCLOSES DATA BREACH

Indian Stock Broker Angel One reported a data breach in its AWS account, which was discovered through a dark web alert on February 27. It changed passwords, launched an investigation, and assured clients their funds and securities weren't affected.

SPYZIE STALKERWARE IS SPYING ON THOUSANDS OF ANDROID AND IPHONE USERS

A phone surveillance operation called Spyzie has compromised more than 500,000 Android devices and thousands of iPhones and iPads. Spyzie suffered a breach due to a vulnerability that impacted the Cocospy and Spyic stalkerware apps. The leaked data includes the emails of Spyzie customers as well as data that was exfiltrated by the apps.

ZAPIER SAYS SOMEONE BROKE INTO ITS CODE REPOSITORIES AND MAY HAVE ACCESSED CUSTOMER DATA

Zapier has informed customers that an unauthorized individual accessed specific Zapier code repositories but that there was no production infrastructure or data breach. Notably, the repositories contained some customer data that was inadvertently copied for debugging. Zapier stated that the attacker accessed the repositories because of a 2FA misconfiguration on an employee's account.

EARTH PRETA MIXES LEGITIMATE AND MALICIOUS COMPONENTS TO SIDESTEP DETECTION

Trend Micro's Threat Hunting team analyzed a new technique from the Earth Preta APT group, Earth Preta, and found that its attack chain begins with the IRSetup.exe dropper, which drops a collection of legitimate decoy files and malicious components and opens a decoy PDF. In the background, the malware launches a legitimate EA Origin application to sideload a modified variant of the TONESHELL backdoor that injects shell code via Microsoft Application Virtualization Injector (MAVInject.exe) if ESET anti-malware is detected or directly into the processes if it is not.

THE CAT AND MOUSE GAME: EXPLOITING STATISTICAL WEAKNESSES IN HUMAN INTERACTION ANTI-EVASIONS

Sandboxing is a common malware analysis technique that shifts the burden of detection onto attackers who must detect that their malware is executing in a sandbox and then evade malware detection. Researchers from Check Point Research devised a sandbox evasion technique in which their malware emulates a random mouse walk to simulate a human and evade sandbox detection. Check Point Research has provided an in-depth implementation of a counter-evasion algorithm to detect this evasion.

OPEN SOURCE RESEARCH NOTEBOOKS

Research notebooks such as Jupyter enable open-source investigations by simplifying code experimentation and data analysis. Platforms like Google Colab, which hosts Jupyter Notebooks, offer easy accessibility, security, and replicability for running notebooks online. Notebooks provide a user-friendly way to interact with code, making them valuable research tools.

and no prompt required. Get a demo

CLOUDSMITH (PRODUCT LAUNCH)

Cloudsmith is an artifact repository that scans dependencies for vulnerabilities, licensing issues, and malware before exposing these packages to developers in their coding environments.

CTF WRITEUPS SEARCH

CTF Writeup Search is a fast and efficient search engine containing over 25,000 CTF writeups and solutions.

LINK DUMPER

Link Dumper is a Python-based web crawler that scans websites for URLs and extracts JavaScript, text, JSON, and XML files.

GOVERNMENTS CAN'T SEEM TO STOP ASKING FOR SECRET BACKDOORS

End-to-end encryption cannot be weakened for authorities without compromising user security. UK and Sweden's anti-encryption initiatives are misguided as criminals will use uncompromised options such as Signal, and the answer lies in transparent, free open source software, leaving fewer places for criminals to hide.

AS SKYPE SHUTS DOWN, ITS LEGACY IS END-TO-END ENCRYPTION FOR THE MASSES

Skype pioneered end-to-end encryption in communication apps, promising unprecedented privacy. Despite governments worldwide finding ways to circumvent this security—through hacking tools such as FinFisher, China's surveillance enhancements, and later NSA access—Skype's revolutionary approach to secure communications laid the groundwork for today's encrypted messaging apps like Signal and WhatsApp.

MODERN APPROACH TO ATTRIBUTING HACKTIVIST GROUPS

Checkpoint Research has introduced a novel method for attributing hacktivist groups by employing language-based machine learning models and linguistic analysis to examine thousands of public messages. Its technique integrates topic modeling to reveal key subjects discussed by these groups and stylometric analysis to identify connections between groups based on their writing styles. This strategy shows that many state-sponsored entities disguise themselves as hacktivists, with the analysis effectively linking various hacktivist personas to individual operators and tracking how their focus shifts in response to geopolitical events.

SECURING LATIN AMERICA IN 2025: HOW AI AND CYBER THREAT INTELLIGENCE ARE RESHAPING THE CYBER SECURITY LANDSCAPE

Latin America is facing an onslaught, with companies experiencing an average of 2,569 attacks per week — nearly 40% higher than the global average of 1,848.

CISOS SHOULD ADDRESS IDENTITY MANAGEMENT ‘AS FAST AS THEY CAN' SAYS CROWDSTRIKE EXEC

CISOs must enhance identity and access management to avert cyber-attacks.

BLACK BASTA LEADER ESCAPES FROM COURTROOM IN ARMENIA WHILE AWAITING JUDGE'S DECISION

Oleg Nefedov, leader of the Black Basta ransomware gang, escaped a courtroom in Armenia while awaiting a judge's decision on his detention.

for free. Get your copy here

VO1D BOTNET EVOLVES AS IT ENSNARES 1.6 MILLION ANDROID TV BOXES

The Vo1d botnet has grown to infect 1.3 million Android TV boxes worldwide, with daily activity from 800,000 IPs and a peak of 1.6 million. It evolved to this size thanks to enhanced encryption, anti-detection features, and improved resilience against takedowns.

NEARLY 12K API KEYS AND PASSWORDS FOUND IN AI TRAINING DATA

Researchers at Truffle Security scanned 400TB of data from the Common Crawl December 2024 archive. Common Crawl is a non-profit that regularly publishes massive crawled web data datasets frequently used to train LLMs. The researchers identified 219 distinct secret types, including valid AWS, MailChimp, and WalkScore API keys.

NEW TGTOXIC BANKING TROJAN VARIANT EVOLVES WITH ANTI-ANALYSIS UPGRADES

TgToxic is an Android malware first documented in early 2023 as a banking Trojan capable of stealing credentials and funds from crypto wallets and finance apps. Later analysis identified that it has evolved with new anti-analysis and C2 domain generation capabilities. Google has stated that it did not detect TgToxic in any apps in the Google Play store.

HOW TO GAIN CODE EXECUTION ON MILLIONS OF PEOPLE AND HUNDREDS OF POPULAR APPS

This author discovered a critical vulnerability in ToDesktop, an electron app bundler service used by popular applications, including ClickUp, Cursor, Linear, and Notion Calendar. The vulnerability allowed the author to exploit a Firebase database, gaining access to the deployment pipeline and enabling code execution capabilities. ToDesktop promptly fixed the issue by separating the signing step into a separate sidecar container.

WALLBLEED: A MEMORY DISCLOSURE VULNERABILITY IN THE GREAT FIREWALL OF CHINA (1 HOUR READ)

Wallbleed was a vulnerability in China's Great Firewall that leaked memory during DNS query censorship, revealing internal operations. It was partially patched in November 2023 and fully resolved by March 2024. This report outlines how researchers discovered the vulnerability and the ethics of exploiting and disclosing such vulnerabilities.

SUBSTACK DOMAIN TAKEOVER

Substack allows writers to use custom domains for their blogs by creating a CNAME record pointing to Substack's servers. However, Substack does not authenticate that a customer owns a domain at this step. Attackers can potentially hijack inactive custom domains previously connected to Substack blogs, even though Substack charges a $50 fee for the feature.

DREADNODE (PRODUCT LAUNCH)

Dreadnode's platform offers a simulated environment where AI agents can be trained and tested in realistic cybersecurity attack scenarios. It essentially serves as a practice sandbox for offensive security skills.

KICS

KICS finds security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle of your infrastructure-as-code. The modular architecture allows quick support for new Infrastructure as Code solutions.

FOCA

FOCA is a tool used mainly to find metadata and hidden information in scanned documents. These documents may be on web pages and can be downloaded and analyzed with FOCA.