Search the archive

Start with a free trial

(ThreatSpike typically identifies 20 issues during the trial period)

SUBGROUP OF RUSSIA'S SANDWORM COMPROMISING US AND EUROPEAN ORGANIZATIONS, MICROSOFT SAYS

Microsoft has revealed that a subgroup of Sandworm has been conducting a multi-year campaign targeting strategic organizations across the U.S. and Europe. The "BadPilot campaign" focuses on sectors like energy and telecommunications, exploiting vulnerabilities to maintain access and support Russia's military objectives.

TRUMP HOTELS GUEST INFORMATION LEAKED ON HACKER FORUM

A hacker leaked a dataset containing over 150k records from guests at Trump Hotel properties. The leaked dataset includes details of the stays including email addresses and full names of the guests. The post also includes a link to a tool to check if your name was part of the leak as well as next steps for the ones affected.

HACKERS EXPLOITING BUG IN POPULAR TRIMBLE CITYWORKS TOOL USED BY LOCAL GOVERNMENTS

CISA is warning of a vulnerability in the Trimble Cityworks asset management software that is commonly used by local and federal governments. The vulnerability allows for a malicious actor to potentially achieve RCE against a customer's IIS server. CISA warns that the vulnerability is being actively exploited and has mandated that federal civilian agencies patch it by February 28.

CYBERCRIME: A MULTIFACETED NATIONAL SECURITY THREAT

Mandiant has done an analysis of what cybercrime entails as cybercrime dominates online threats, with four times more criminals than state-backed intrusions in 2024. The impact of cybercrime is particularly noticeable in healthcare where data leaks have doubled. The post dives into the analysis.

HOW WE HACKED A SOFTWARE SUPPLY CHAIN FOR $50K

The blog post describes the journey of Lupin with fellow hacker Snorlhax on bug bounties and aiming for “The Exceptional Vulnerability” that would be their big payout worth $50,500. They found a way to backdoor a private npm package, potentially compromising multiple environments and systems, highlighting the importance of securing all aspects of the development process.

MANAGE DEV TUNNELS WITH GROUP POLICIES

Dev Tunnels are a popular tunneling service used by developers via Visual Studio, VS Code, or the devtunnel CLI. Microsoft has added the ability to control certain aspects of Dev Tunnels via Group Policy Administrative Templates. The supported policies allow admins to limit tunnel access to selected Microsoft Entra tenant ID, disable anonymous access, or fully disable Dev Tunnels.

SGNL (PRODUCT LAUNCH)

SGNL provides a Privileged Identity Management platform that decouples credentials from identity and enables real-time, context-aware access decisions using AI.

WINDOWS EVENT FORWARDING GUIDANCE

A repository for setting up Windows Event Forwarding on a Windows server in an Active Directory environment. The repository includes GPOs, WEF subscriptions, and WEC channels.

LEMON

LEMON is a Linux memory dump tool that utilizes eBPF to capture the entire physical memory of a system and save it in LiME format, compatible with forensic tools like Volatility 3. Currently, LEMON supports only CO-RE kernels and on-disk memory dumps.

UK, US, OZ BLAST HOLES IN LOCKBIT'S BULLETPROOF HOSTING PROVIDER ZSERVERS

Russian hosting provider Zservers, linked to LockBit ransomware operations, has been sanctioned by the US, UK, and Australia after providing hosting services to cybercriminals and marketed explicitly to illicit actors.

MACOS FLEXIBLEFERRET | FURTHER VARIANTS OF DPRK MALWARE FAMILY UNEARTHED

The Ferret family of malware is used by the Contagious Interview campaign targeting developers using macOS. The campaign involves victims being sent a link to communicate with an interviewer that throws an error and prompts the user to download a trojanized virtual meeting software which installs a Go backdoor and stealer. The newest variant uses a valid Apple Developer signature and Team ID, evades the current XProtect signatures, and masquerades as a Zoom application.

EXPLORING A VPN APPLIANCE: A RESEARCHER'S JOURNEY

An Akamai researcher discovered multiple vulnerabilities in Fortinet's FortiOS VPN appliance, including an out-of-bounds write, wild copy vulnerability, and denial-of-service issues. The vulnerabilities stemmed from an outdated Apache library (libapreq) from 2000 that was used to handle form data processing. While some vulnerabilities could crash the system or lead to potential information disclosure, no critical remote code execution exploits were confirmed, though the findings highlight the importance of examining VPN security.

ITALIAN GOVERNMENT DENIES IT SPIED ON JOURNALISTS AND MIGRANT ACTIVISTS USING PARAGON SPYWARE

Regarding a spyware campaign by Paragon that Meta's WhatsApp detected, the Italian government denies spying on journalists and activists with spyware but will investigate vulnerabilities found after seven phones were hacked.

MASSIVE 1.17TB DATA LEAK EXPOSES BILLIONS OF IOT GROW LIGHT RECORDS

Billions of records from a Chinese IoT grow light company were exposed in a massive 1.17 TB data leak.

GAO TELLS COAST GUARD TO IMPROVE CYBERSECURITY OF MARITIME TRANSPORTATION SYSTEM

The Government Accountability Office (GAO) found gaps in the US Coast Guard's cybersecurity efforts for the Maritime Transportation System (MTS) and has made five recommendations to improve cybersecurity, including better incident reporting and competency needs for personnel.

👉 Get the guide

CYBERATTACK ON LEE ENTERPRISES CAUSES DISRUPTIONS AT DOZENS OF NEWSPAPERS

Lee Enterprises experienced a cyberattack on February 3 causing widespread disruptions to newspapers, subscriptions, and internal services. While it is likely it was ransomware, no group has claimed responsibility. Investigations and system restoration are still ongoing.

CROOKS USE GOOGLE TAG MANAGER SKIMMER TO STEAL CREDIT CARD DATA FROM A MAGENTO-BASED E-STORES

Threat actors are using Google Tag Manager (GTM) to install credit card skimmer malware on Magento-based e-stores, according to Sucuri researchers. The malware hides in a website's database and steals credit card information entered during the checkout process, sending it to the attackers' server. This sophisticated attack demonstrates how criminals are using legitimate platforms like GTM to deploy malicious code that is difficult to detect.

NEW HACK USES PROMPT INJECTION TO CORRUPT GEMINI LONG-TERM MEMORY

Many of the major LLMs have protections against basic prompt injection however researcher Johann Rehberger unveiled a new indirect prompt injection technique that utilizes delayed tool injection. In Rehberger's attack, Gemini is instructed to download and summarize a website, the summary that Gemini creates includes a covert request to take specific actions if the user responds with specific trigger words, once the user replies with the trigger word the instruction is saved to Gemini's long term memory. Google has responded that it will not fix the issue.

BUILD YOUR OWN OFFENSIVE SECURITY LAB A STEP-BY-STEP GUIDE WITH LUDUS

This is a guide for building a red team security lab using Ludus, which simplifies creating Active Directory environments with XDR/SIEM integration. Ludus' key advantages are its template system and YAML configuration for easy customization and sharing.

SECURE SANITIZATION AND DISPOSAL OF STORAGE MEDIA

Guidance from the UK's NCSC on how to properly sanitize or dispose of storage media for non-classified data. For devices that can be sanitized, if the device is encrypted (such as with FileVault or BitLocker) disposing of the cryptographic keys may be sufficient whereas devices that are unencrypted should be overwritten with a fixed value and then have the value read back after reboot. For devices that cannot be sanitized, they should be physically destroyed to pieces of a size smaller than 6nm.

LEVELDB WAL LOG - EXTRACTING CHATGPT CONVERSATIONS

The ChatGPT desktop app makes use of LevelDB's write ahead log (WAL) to temporarily cache conversation history. This article examines and dissects the binary structure of the WAL file. The author uses the insights that they gained while researching this to create a generic parser for ChatGPT WAL files.

interactive tour to see Flashpoint's data in action

7AI (PRODUCT LAUNCH)

7ai provides autonomous ‘swarming agents' that can categorize threat alerts and then dispatches the appropriate agents that are capable of investigating the threat using data from multiple sources within the enterprise environment.

GOSEC

Gosec inspects source code for security problems by scanning the Go Abstract Syntax Tree (AST) and Static Single Assignment (SSA) code representation.

STS SAML DRIVER

STS SAML Driver provides a local server which will receive SAML assertions from an IdP and attempts to assume the role. This allows users to retrieve temporary SAML credentials without interacting with an embedded browser.

APPLE AND GOOGLE TAKE DOWN MALICIOUS MOBILE APPS FROM THEIR APP STORES

Apple and Google removed 20 apps containing SparkCat malware discovered by Kaspersky researchers. The malware, active since March 2024, used OCR to scan for cryptocurrency wallet recovery phrases and personal data throughout the phone.

GOOGLE WILL NOW AUTOMATICALLY REVOKE PERMISSIONS FROM HARMFUL ANDROID APPS

Google's Play Protect will now automatically revoke permissions from apps that it detects to be potentially malicious. Users will be able to re-enable the permissions but will need to acknowledge an additional warning. This is part of Google's push to increase Play Protect's capabilities along with capabilities to automatically block known malicious apps.

AWS IAM IDENTITY CENTER NOW OFFERS IMPROVED ERROR MESSAGES AND AWS CLOUDTRAIL LOGGING

AWS has updated AWS Identity Center to now emit logs to CloudTrail for provisioning errors to aid in troubleshooting. Users can also build automated monitoring and auditing for these log messages.

FEBRUARY PATCH TUESDAY DELIVERS 57 PACKAGES

After January's deluge of patches, February's Patch Tuesday included 57 updates addressing various vulnerabilities in Microsoft products with two critical Windows issues were actively exploited, with additional vulnerabilities expected to be targeted in the next 30 days.

OPENAI WAS NOT BREACHED, SAY RESEARCHERS

Threat intelligence firm that investigated claims of millions of breached OpenAI accounts has concluded that these accounts came from existing infostealer malware logs rather than a direct breach.

GCORE DDOS RADAR REVEALS 56% YOY INCREASE IN DDOS ATTACKS

Gcore's latest report shows a 56% increase in DDoS attacks, with the largest hitting 2 Tbps with as well as financial services saw a 117% rise in attacks.

INFORMATION OF 120,000 STOLEN IN RANSOMWARE ATTACK ON GEORGIA HOSPITAL

Memorial Hospital in Georgia suffered a ransomware attack in November that affected 120,000 patients' personal and medical data. The Embargo group has claimed responsibility and leaked 1.15TB of data online. The hospital has offered affected individuals free identity protection and credit monitoring services.

APPLE FIXES ZERO-DAY EXPLOITED IN ‘EXTREMELY SOPHISTICATED' ATTACKS

Apple has pushed out security updates for iOS, iPadOS, and macOS. Specifically called out was an attack that could allow sophisticated attackers with access to a device to disable USB Restricted mode on a locked device. This vulnerability was reported by Citizen Lab and is being actively exploited.

OVER 12,000 KERIOCONTROL FIREWALLS EXPOSED TO EXPLOITED RCE

KerioControl firewalls provide a network security suite for small and medium sized businesses. The ShadowServer Foundation reports that over 12K devices are currently exposed to attacks leveraging a 1-click RCE vulnerability. The vulnerability was caused by improper sanitization of a GET parameter which led to Reflected XSS and resulted in a 1-click RCE.

JOOKI - TAKING CONTROL OF A FORGOTTEN DEVICE

This post explores how to revive the abandoned Jooki children's audio players through firmware analysis and discovering exploits after the company's bankruptcy left devices non-functional. The solution uses Mender for software updates and can be controlled through a web interface, enabling customization and potential security risks. The author notes that by understanding its firmware, access points, and potential vulnerabilities, users can interact with Jooki more effectively and securely.

YOU'RE THINKING ABOUT PASSKEYS WRONG

Some in the security community have argued that passkeys have failed at their promise of passwordless authentication and should instead be used as a second factor due to complexities such as account recovery on a new device. The author of this post argues that this reflects an improper way of thinking about passkeys and presents a login/registration flow that uses magic links for new device/registration and then uses passkeys for subsequent access.

FOUNDATIONS FOR MODERN DEFENSIBLE ARCHITECTURE

The Australian Signals Directorate (ASD) has published a modern defensible architecture framework based on zero trust principles ("never trust, always verify," "assume breach," and "verify explicitly") and five key pillars (Identity, Devices, Networks, Applications/Workloads, and Data), emphasizing that organizations should prepare for "when" not "if" a cyber incident occurs. These principles, based on zero trust and secure-by-design practices, aim to enhance cyber resilience and protect critical assets. Organizations can use the Foundations to build a strong security framework adaptable to evolving technologies and threats.

MINIJAIL

Minijail is a sandboxing and containment tool used in ChromeOS and Android. It provides an executable that can be used to launch and sandbox other programs and a library that can be used by code to sandbox itself.

FRIDA-CODESHARE-SCRIPTS

This repository contains a curated collection of useful FRIDA scripts and resources for dynamic instrumentation and reverse engineering.

RAINK

Raink is a tool that solves general ranking problems using LLMs. It can be used to have an LLM answer questions such as determining which fix might best address a given security advisory.

UK'S SECRET APPLE ICLOUD BACKDOOR ORDER IS A GLOBAL EMERGENCY, SAY CRITICS

The UK government allegedly secretly ordered Apple to create a backdoor in its encrypted iCloud storage, potentially affecting users worldwide. Critics and privacy advocates warn this sets a dangerous precedent as Apple may respond by discontinuing its Advanced Data Protection feature in the UK rather than compromise global security.

THE RISKS OF USER IMPERSONATION

This article dives deep into user impersonation risks and mitigations, which is a common way to allow logging in as another user. This feature is often implemented by changing the sub property of a JWT but is inherently problematic as it requires maintaining an admin list and securing the feature, is insecure by design, and also muddies audit trails. One possible solution is to add a new claim to the JWT but this is error prone and instead advocates for using DOM recording to collect as much sanitized data about a user's session as possible instead.

AMAZON REDSHIFT ENHANCES SECURITY BY CHANGING DEFAULT BEHAVIOR

The Amazon Redshift team has announced changes to the default settings for new Redshift clusters and those restored from snapshots. These clusters will now block public access and encrypt data at rest and in transit by default. Existing clusters will not be affected but Amazon recommends users implement the changes regardless.

EXCITING UPDATES TO THE COPILOT (AI) BOUNTY PROGRAM: ENHANCING SECURITY AND INCENTIVIZING INNOVATION

Microsoft has expanded its Copilot AI Bounty Program by integrating online services vulnerability classifications, offering up to $5,000 for moderate severity cases.

HACKER PLEADS GUILTY TO SIM SWAP ATTACK ON US SEC X ACCOUNT

A man in Alabama admitted to hacking the SEC's account to post a fake Bitcoin ETF approval announcement - he now faces 5 years in prison for identity theft and fraud.