Search the archive

TOLL BOOTH BANDITS CONTINUE TO SCAM VIA SMS MESSAGES

Scammers are successfully tricking North American drivers into paying fake toll fees through SMS phishing attacks.

Get the full list (XLSX)

HPE BEGINS NOTIFYING DATA BREACH VICTIMS AFTER RUSSIAN GOVERNMENT HACK

HPE is notifying individuals affected by a 2023 cyberattack attributed to Russian state hackers. The breach, affecting email and SharePoint systems, exposed sensitive personal data including Social Security numbers through the mailboxes of HPE's cybersecurity and business teams.

HOSPITAL SISTERS HEALTH SYSTEM: AUGUST 2023 DATA BREACH AFFECTED 883K INDIVIDUALS

HSHS and Prevea Health experienced a cyberattack in August 2023 that disrupted their systems. The breach has affected 882,782 individuals' personal and medical data. HSHS has offered credit monitoring and is sending notification letters to affected individuals.

430,000 IMPACTED BY DATA BREACHES AT NEW YORK, PENNSYLVANIA HEALTHCARE ORGANIZATIONS

Over 430,000 people's data was exposed in breaches at two healthcare organizations, University Diagnostic Medical Imaging (UDMI) and Allegheny Health Network (AHN). UDMI's November breach affected 138,080 individuals' medical data, while AHN reported that 292,773 patients were impacted by an October cyberattack on their contractor IntraSystems.

BITLOCKER STALE RECOVERY KEY CLEANUP: NO MORE SILENT ENCRYPTION FAILURES

The author discusses how they discovered a new unannounced BitLocker feature in a Windows Insider Preview build that automatically cleans up stale recovery keys when the 200-key limit is reached in Microsoft Entra ID. Using IDA Pro to analyze the fveskybackup.dll file, along with Fiddler and ETL traces for monitoring API calls, the author uncovered two critical functions that handle the automatic deletion of stale recovery keys in batches of 16. This discovery points to the resolution of a long-standing issue where silent encryption would fail when hitting the key limit, eliminating the need for manual cleanup by IT administrators once the feature reaches general availability.

IMPLEMENTING CLUSTERING WORKFLOWS IN ELASTIC TO ENHANCE SEARCH RELEVANCE

This blog post from Elastic walks through how machine learning models, particularly clustering techniques like k-means can be utilized in the ELK stack to improve search relevance by grouping similar documents together. To demonstrate this, the post uses a 20 Newsgroups dataset and OpenAI's text-embedding-ada-002 model, and demonstrates that clear cluster separation and accurate clustering results were achieved. The workflow showcased in this blog allows Elastic users to easily implement advanced clustering techniques for various applications, showing high performance and potential for further enhancements.

OFFENSIVE KERBEROS TECHNIQUES FOR DETECTION ENGINEERING

As the successor to NTLM, Kerberos is the most widely used authentication mechanism for Active Directory. This article presents an in-depth overview of different attacks like Kerberoasting, unconstrained delegation, constrained delegation, and others against Kerberos and methods for detection and mitigation. Each attack includes necessary background information, a description of the attack and potential impact, and strategies for detecting the attack.

THREATMATE (PRODUCT LAUNCH)

ThreatMate's platform incorporates analytics, continuous monitoring, and a multi-tenant design to help Managed Service Providers monitor, manage, and secure customers' internal, external, and cloud environments from a single dashboard.

BAITROUTE

Baitroute is a web honeypot library that serves vulnerable-looking decoy endpoints that mislead attackers and lead to false positives. It provides easy integration with popular web frameworks and claims to pose minimal performance impact. Developers can also write their own rules using YAML files.

LIVING OFF THE TUNNELS (WEB APP)

Living Off the Tunnels (LOTTunnels) is a project that aims to document digital tunnels that can be abused by threat actors.

UK DEMANDS APPLE BREAK ENCRYPTION TO ALLOW GOV'T SPYING WORLDWIDE, REPORTS SAY

The UK government reportedly issued a secret order requiring Apple to create a backdoor for accessing encrypted iCloud data worldwide. Apple is likely to withdraw encrypted storage in the UK rather than comply, as it argues such backdoors would compromise user security globally.

RESEARCHER OUTSMARTS, JAILBREAKS OPENAI'S NEW O3-MINI

A security researcher, Eran Shimony has successfully bypassed OpenAI's new "deliberative alignment" safety feature in o3-mini, getting it to provide Windows exploit instructions by posing as a historian. According to Shimony, OpenAI's models are particularly susceptible to natural language social engineering attacks, while Meta's Llama models are instead vulnerable to ASCII art-encoded malicious prompts, and Claude is most vulnerable to generating harmful code because it doesn't effectively classify code's potential malicious uses.

VSCODE'S SSH AGENT IS BANANAS

Thomas Ptacek writes about how VSCode's SSH Agent defies the intuition that a security researcher familiar with similar tools like Emacs Tramp might have. Unlike Tramp, which operates minimally on remote systems using existing shell commands, VSCode's SSH Agent installs a full Node.js environment and runs an agent with extensive capabilities including filesystem access, file editing, shell process launching, and self-persistence - behaviors that make security professionals nervous, especially in production environments. Thomas ends the blog by noting that Fly.io is able to accomplish the same remote development feature on their instances without such invasive installation on remote hosts.

MICROSOFT SHARES WORKAROUND FOR WINDOWS SECURITY UPDATE ISSUES

Microsoft has advised users to reinstall Windows with security updates past December 2024 for users running into installation issues with Windows 11, version 24H2 where the OS wouldn't accept further security updates.

THE STATE OF THE CYBERSECURITY MARKET IN 2024

Mike Privette provides an in-depth financial analysis of the Cybersecurity market in 2024 with increasing trends in funding, M&A, and decreasing layoffs.

ATTACKERS HIDE MALICIOUS CODE IN HUGGING FACE AI MODEL PICKLE FILES

Researchers from ReversingLabs found two models from Hugging Face hiding malicious code in Python's Pickle files.

DEEP JAVA LIBRARY VULNERABILITY ALLOWS PATH TRAVERSAL

A new vulnerability in the ZipUtils.unzip and TarUtils.untar utilities in the Deep Java Library allows for absolute path traversal. These utilities are used by Deep Java Library when extracting models to load. The vulnerability exists because the absolute path is not properly validated. A malicious attacker could exploit this vulnerability to overwrite system files.

GO MODULE MIRROR SERVED BACKDOOR TO DEVS FOR 3+ YEARS

Researchers from Socket discovered that Go Module Mirror had been hosting a malicious Go package for over three years. Go Module Mirror is a caching service that Google runs to cache modules for quicker downloads when building Go programs. The attackers typosquatted an archived Go package, published a version with a backdoor embedded, and then changed their repo back to look like the benign module.

EXPERTS FLAG SECURITY, PRIVACY RISKS IN DEEPSEEK AI APP

Brian Krebs reports that experts from NowSecure have raised security and privacy concerns about the DeepSeek AI app from China. He notes that the app sends a lot of user data in unencrypted form and device information to Chinese companies, posing risks. The author also urges organizations to remove the DeepSeek iOS app due to security threats identified by NowSecure.

REPLACING A SPACE HEATER FIRMWARE OVER WIFI

A security team discovered a vulnerability in a Govee smart space heater allowing complete firmware control through a man-in-the-middle attack on local networks. After extended disclosure discussions with Govee in early 2024, the product was recalled as the flaw could enable malicious control of device operations.

SCATTERBRAIN: UNMASKING THE SHADOW OF POISONPLUG'S OBFUSCATOR

Since 2022, Google Threat Intelligence Group (GTIG) has been tracking a group of malware samples that use the PoisonPlug moniker and employ a complex obfuscator. The ScatterBrain obfuscator operates in three different protection modes which determine to what extent it obfuscates the control flow graph, mutates instructions, and protects the binary's import table. The post walks through how GTIG reverse engineered this obfuscator and created a deobfuscator tool.

A NETWORK THREAT HUNTER'S GUIDE TO C2 OVER QUIC

QUIC is a newer network communication protocol that abbreviates the typical TCP 3-way handshake as well as adding other features such as a Communication ID for persistent connections. This post introduces the QUIC protocol and then sets up a lab environment to analyze the Merlin QUIC-based C2 with different sets of delays. The post finds that the Merlin C2 can be detected by RITA with any delay, alternatively, Zeek logs can be examined for unusually persistent QUIC connections, and finally, the post also noted a unique QUIC handshake that is only exhibited by Merlin.

ASTRA (PRODUCT LAUNCH)

Astra is a DAST (Dynamic Application Security Testing) and Pentest scanning engine that incorporates more than 10,000 security tests to hunt for over 13,000 vulnerabilities.

LOLC2 (WEB APP)

LOLC2 is a collection of C2 (Command and Control) frameworks that utilize legitimate services to evade detection.

GHIDRA 11.3 RELEASED: NEW FEATURES, PERFORMANCE IMPROVEMENTS, BUG FIXES

Ghidra 11.3 has been released by the NSA. It introduces tools like a Visual Studio Code integration and a PyGhidra Python library for easier access to the Ghidra API. The update also includes improvements to the Function Graph, debugger infrastructure, source code mapping, processor support, and string translation capabilities.

7-ZIP 0-DAY WAS EXPLOITED IN RUSSIA'S ONGOING INVASION OF UKRAINE

Russia exploited a zero-day vulnerability in 7-Zip that bypassed Windows' Mark of the Web (MotW) security feature. The flaw, tracked as CVE-2025-0411, allowed malware hiding in nested archives to evade detection when targeting Ukrainian agencies.

NEW TARGET OF PARAGON SPYWARE COMES FORWARD

WhatsApp revealed that Italian activists and journalists critical of Italian PM Meloni's government were targeted by Paragon spyware. This raises questions about the Italian government's involvement. Paragon claims it only sells to democratic nations.

ANNOUNCING THE ELASTIC BOUNTY PROGRAM FOR BEHAVIOR RULE PROTECTIONS

Elastic has expanded the scope of its bug bounty program to include Elastic Security detection rulesets. Under the new scope, Elastic will offer bug bounties for submissions that evade detection by Elastic Security's rules with a particular focus on not requiring elevated privileges. At present, the scope of the expansion is limited to Windows Behavior Alerts.

SECURITY CONSIDERATIONS FOR EDGE DEVICES (ITSM.80.101)

The Five Eyes countries have issued a joint guidance for device manufacturers to secure their edge products against increasingly frequent malicious attacks.

THE GLOBAL INFOSEC/CYBERSECURITY SALARY INDEX FOR 2025 💰📊

The site lists salaries of different roles in infosec across the world as well as salary trends.

S. KOREA'S NOTORIOUS SEX CRIME HUB YA-MOON HACKED, USER DATA LEAKED

A hacker named "Valerie" breached South Korea's notorious Ya-moon website, leaking user data including personal information and illegal activity logs.

GET THE AWS EKS CHEAT SHEET

HACKERS SPOOF MICROSOFT ADFS LOGIN PAGES TO STEAL CREDENTIALS

Abnormal Security has detected a new phishing campaign targeting education, healthcare, and government organizations' ADFS. The attackers send emails to targets, impersonating their company's IT team, with a request that they sign in to accept new policies or other routine changes, steal the login credentials and MFA, and then redirect the victims to the login page.

LIVE CHAT BLOG #2: CISCO WEBEX CONNECT - ACCESS TO MILLIONS OF CHATS HISTORIES

A vulnerability was discovered in Cisco's Webex Chat that allowed unauthorized access to the chat histories of many organizations, including internal and customer-facing help desks. The flaw was related to the use of the clientKey as a secretKey in API calls, which allowed attackers to read chat histories by exploiting specific parameters. The issue was reported to Cisco in July 2024 and patches were released to address the security vulnerability.

NETGEAR URGES USERS TO UPGRADE TWO FLAWS IMPACTING WIFI ROUTER MODELS

Netgear has identified critical flaws in multiple WiFi router models (XR1000, XR1000v2, and XR500) and is urging users to update their firmware as soon as possible. The vulnerabilities include a remote code execution issue and an authentication bypass vulnerability that can be exploited by attackers without user interaction. This post includes the firmware versions to download the patches as well as instructions on how to upgrade.

HOW WE BUILT AN APPSEC AI THAT SECURITY RESEARCHERS AGREE WITH 96% OF THE TIME

Semgrep built Semgrep Assistant's auto triage function to automatically classify a finding as a true or false positive by sending a minimal amount of code to an LLM. To benchmark the model, Semgrep's research team labeled 2,000 findings and then the system was evaluated against it. The original Assistant system was able to score a 90% success rate, but through optimizations around models, prompting, and context the team managed to increase the true positive rate to 96%.

INSIDE IMESSAGE-EXPORTER: REVERSE ENGINEERING APPLE'S TYPEDSTREAM FORMAT

Apple uses a proprietary and undocumented serialization format for serializing iMessage data. This researcher breaks down the process of reverse engineering the binary format, noting the patterns found, and shows how those assumptions are translated into the imessage-exporter tool.

LINUX DETECTION ENGINEERING - A CONTINUATION ON PERSISTENCE MECHANISMS

This blog post is part of a three part series from Elastic Security that covers various persistence mechanisms and utilizes PANIX, a custom-built Linux persistence tool. It goes in-depth on various techniques like Dynamic Linker Hijacking that exploit LD_PRELOAD and LD_LIBRARY_PATH to inject malicious libraries, Kernel Module Persistence, Web Shell persistence, and system account SSH backdoors. The post also provides key detection and mitigation strategies file, configuration monitoring, as well as examples of utilizing ElasticSearch and OSquery for hunting.

STONEKEEPER

StokeKeeper is an experimental EDR evasion framework for research purposes.

INTRODUCING NATURAL LANGUAGE CODE POLICIES IN DRYRUN SECURITY

DryRun Security has introduced Natural Language Code Policies (NLCP) to help AppSec teams identify critical code changes without drowning in alerts. NLCP uses plain language to create policy checks, making it easier to spot high-impact vulnerabilities.

VMINER

Vminer is a tool that aims to simplify the retrieval of data from virtual machines without utilizing guest tools or working with memory dumps. It supports multiple guest OS and architectures and offers features like getting process information and backtraces. To use it, you attach it to the VM process. Required PDBs are automatically downloaded for Windows guests.

ALMOST 1 IN 10 PEOPLE USE THE SAME FOUR-DIGIT PIN

The Australian Broadcasting Company (ABC) analyzed a corpus of 29 million four digit pins from Have I Been Pwned? Some of the most popular pins are expected keyscans, 1234, and number repetitions (1111, etc). Some other more interesting trends are highlighted such as 0229 and 2902 being less popular than other surrounding pins as they represent leap days.

CVSS IS DEAD TO US

The curl team abandoned the CVSS system in favor of four security levels ranging from critical to low for use in their bug bounty system. They cited evidence from previous incidents, where CVSS calculators overstated the impact of a vulnerability that is only present in very niche configurations. One issue that the team notes is that even though the CVSS score is not mandatory in CVE filings, it is often added by CISA as an enrichment.

ROBOCALLERS POSING AS FCC FRAUD PREVENTION TEAM CALL FCC STAFF

Scammers using Telnyx's VoIP service made nearly 1,800 robocalls impersonating a fictitious FCC "Fraud Prevention Team," ironically targeting FCC staff and their families among others. The FCC has proposed a $4.5M fine against Telnyx for allegedly failing to properly verify customer identities through Know Your Customer (KYC) procedures, though Telnyx denies these accusations. The scammers, operating under "MarioCop" accounts with suspicious discrepancies between their registered location and IP addresses, attempted to defraud victims by demanding $1,000 in Google gift cards to avoid supposed jail time.

LAZARUS APT TARGETS CRYPTO WALLETS USING CROSS-PLATFORM JAVASCRIPT STEALER

The Lazarus APT group, linked to North Korea, uses a JavaScript stealer to target crypto wallets through fake job offers on platforms like LinkedIn.

THE BIGGEST SUPPLY CHAIN ATTACKS IN 2024

Software supply chain attacks in 2024 targeted repositories and development tools, exploiting npm, PyPI, and JavaScript libraries to steal credentials and distribute malware.