Search the archive

WHATSAPP SAYS IT DISRUPTED SPYWARE CAMPAIGN AIMED AT REPORTERS, CIVIL SOCIETY

WhatsApp disrupted a spyware campaign targeting journalists and activists.

WIZ RESEARCH UNCOVERS EXPOSED DEEPSEEK DATABASE LEAKING SENSITIVE INFORMATION, INCLUDING CHAT HISTORY

Wiz Research discovered an exposed ClickHouse database belonging to DeepSeek, a Chinese AI startup. The database, accessible without authentication, contained over a million log entries including chat histories, API keys, and sensitive backend data. DeepSeek promptly secured the database after being notified of the exposure.

HACKERS ARE HIJACKING WORDPRESS SITES TO PUSH WINDOWS AND MAC MALWARE

Researchers discovered hackers exploiting vulnerable WordPress sites to trick visitors into downloading fake browser updates containing malware. The ongoing campaign affects thousands of websites, including popular ones, and targets both Windows and Mac users. The malware aims to steal passwords and personal information through deceptive update prompts.

152,000 IMPACTED BY DATA BREACH AT BERMAN & RABIN

2025 GITHUB COPILOT VULNERABILITIES – TECHNICAL OVERVIEW

This blog discusses new GitHub Copilot vulnerabilities, for example, using the word "Sure" can trigger unethical responses like SQL injection tutorials. It aims to highlight weaknesses in AI assistant security safeguards.

THE J-MAGIC SHOW: MAGIC PACKETS AND WHERE TO FIND THEM

Lumen Technologies' Black Lotus Labs has been tracking a malicious campaign that targets Juniper enterprise routers. The malware is a passive agent that listens for one of five parameters sent in a “magic packet.” This post contains a technical analysis of the magic packets and indicators of compromise for threat hunters.

INTRODUCTION TO DETECTION ENGINEERING WITH SIGMA

Sigma provides a backend-neutral detection signature language for logs that can be converted to a variety of different query languages such as Splunk SPL or Sentinel KQL. This post walks through a Sigma rule to explain the components and syntax. It then introduces some more advanced features such as pipelines to resolve mapping issues between rules and data sources and correlation rules to provide stateful detections.

BACKLINE (PRODUCT LAUNCH)

Backline's AI agents act as software and security engineers, analyzing potential vulnerabilities, collecting context, and determining how to optimally address an issue for the customer's specific environment. The agents then autonomously implement the needed code and configuration changes.

SECORA

SeCoRa is an AI-powered code review tool for detecting and remediating vulnerabilities in codebases.

YARAMONITOR

YaraMonitor is a tool that monitors malware samples using YARA rules. It continuously analyzes and alerts on new uploads from sources like MalwareBazaar and can be extended to monitor additional sources. Running the main.py script from the root folder will automate the ingestion and scanning process for malware samples.

DATA SAFETY LEVELS FRAMEWORK: THE FOUNDATION OF HOW WE LOOK AT DATA IN BLOCK

Cash App's security team devised a Data Safety Levels (DSL) Framework based on the CDC's biosafety levels to utilize for data classification. The framework takes a dataset level approach to devise standardized rubrics for evaluating data based on its usage such as Consumer Personal Data and Payment Card Data. The framework couples with automation to be able to classify data as part of Block teams' regular workflows as well as guidelines on how to handle data of various sensitivity levels.

TOP 5 SECURITY MISTAKES SOFTWARE DEVELOPERS MAKE

An executive-level brief on common classes of security issues. The first three focus on vulnerabilities in code such as lack of input validation, lax or missing authentication, and lack of API protections. The last two focus on lack of appropriate tools like WAFs and insufficient or inefficient automations.

PRIVACY-PRESERVING CONTACT DISCOVERY FOR BLUESKY

CISA RELEASES FACT SHEET DETAILING EMBEDDED BACKDOOR FUNCTION OF CONTEC CMS8000 FIRMWARE

CISA released a fact sheet about a backdoor in Contec CMS8000 patient monitors that allows unauthorized access to patient data.

NORTH KOREAN HACKERS IMPERSONATED RECRUITERS TO STEAL CREDENTIALS FROM OVER 1,500 DEVELOPER SYSTEMS

North Korean hackers posed as recruiters to steal credentials from over 1,500 developer systems worldwide in a coordinated cyber campaign.

DARPA WANTS TO CREATE ‘SELF-HEALING' FIRMWARE THAT CAN RESPOND AND RECOVER FROM CYBERATTACKS

DARPA is developing an ambitious project called Red-C that aims to create self-healing firmware capable of automatically detecting, responding to, and recovering from cyberattacks at the bus level of computer systems, though the project faces significant technical and adoption challenges.

ENGINEERING GIANT SMITHS GROUP DISCLOSES SECURITY BREACH

British engineering giant Smiths Group has disclosed that it detected unauthorized activity in its network. Smiths reported that it isolated the affected systems as soon as the unauthorized activity was detected. Smiths has not disclosed if any customer data was accessed at this time.

ENGLOBAL SAYS HACKERS ACCESSED SENSITIVE PERSONAL DATA DURING CYBERATTACK

US engineering firm ENGlobal reported that hackers accessed sensitive personal information during an attack in November 2024. ENGlobal did not disclose details of what data was accessed. The filing also implied that the attack may have involved ransomware and that some systems were offline for six weeks.

ADVERSARIAL MISUSE OF GENERATIVE AI

This blog post from Google Threat Intelligence Group explores how state-sponsored threat actors attempted to misuse Google's AI assistant Gemini. The research found that while threat actors from countries like Iran, China, North Korea, and Russia used Gemini for tasks like research, coding, and content generation, with Iranian actors being the heaviest users, they have not developed novel capabilities or successfully bypassed security controls. The report concludes that while AI can be a useful tool for threat actors, it has not yet proven to be the game-changer some feared, though Google emphasizes continued vigilance through robust security measures and responsible AI development practices.

OUTSMARTING AI-POWERED CYBER ATTACKS: A 2025 PLAYBOOK FOR REAL-TIME ENDPOINT DEFENSE

AI-powered cyber threats are rapidly increasing, with 67% of phishing attacks using AI in 2024. Adversaries are targeting endpoints months in advance, using generative AI to scale attacks. Organizations are struggling to keep pace, taking 277 days on average to identify and contain breaches. This post dives into how companies can deal with these threats.

STATIC SOURCE CODE SECURITY SCANNING TOOLS EVALUATION BENCHMARK

This benchmark framework aims to evaluate static application security testing (SAST) tools. It provides objective criteria for organizations to select appropriate tools, focusing exclusively on static code analysis while excluding dynamic testing methods and non-code scanning tools.

ONE STEP AHEAD IN CYBER HIDE-AND-SEEK: AUTOMATING MALICIOUS INFRASTRUCTURE DISCOVERY WITH GRAPH NEURAL NETWORKS

Palo Alto's Unit 42 has observed that threat actors often reuse infrastructure. Using a Graph Neural Network, Unit 42 has demonstrated that it can discover new malicious infrastructure before it is weaponized. The post walks through three case studies where the team was able to apply this technique.

demo

NEPENTHES

Nepenthes is a “tarpit” that captures web crawlers by generating an endless sequence of pages with dozens of links per page.

FRENOS (PRODUCT LAUNCH)

Frenos is an AI-native platform designed to assess, prioritize, and protect mission-critical environments without the risk of causing operational disruption. Customers are shown exactly which combinations of TTPs and vulnerabilities can pose the greatest risk to their specific setup and then provided with tailored recommendations for reducing risks.

EXTENSIONHOUND

ExtensionHound is a tool that helps security teams track DNS queries made by browser extensions. It can analyze Chrome profiles, correlate requests with extensions, and provide detailed network activity analysis. Users can install ExtensionHound from the GitHub repository and run scans to detect suspicious activities with optional VirusTotal integration for domain reputation checking.

LETSENCRYPT IS ENDING SUPPORT FOR EXPIRATION NOTIFICATION EMAILS

LetsEncrypt has announced that it will be ending support for sending certificate expiration notices on June 4. It made this decision as retaining emails creates a privacy risk for LetsEncrypt and sending expiration emails costs LetsEncrypt tens of thousands of dollars per year and complicates their infrastructure. At this point, LetsEncrypt is confident in the automated renewal tools that the community has built.

MGM AGREES TO PAY $45 MILLION TO VICTIMS OF 2019 DATA BREACH AND 2023 RANSOMWARE ATTACK

MGM Resorts will pay $45 million to settle class action lawsuits stemming from two cyberattacks in 2019 and 2023 that exposed the personal data of over 37 million customers. The 2023 ransomware attack cost MGM $100 million in damages. Affected customers could receive up to $75 each after legal fees.

HOW WE KEPT THE GOOGLE PLAY & ANDROID APP ECOSYSTEMS SAFE IN 2024

Google worked to keep the Google Play and Android app ecosystems safe in 2024 by investing in AI-powered threat detection and privacy enhancements. It prevented millions of policy-violating apps from being published and banned thousands of bad developer accounts. Google also introduced new security features like enhanced fraud protection and app badging to help users find trustworthy apps easily.

SOLANA PUMP.FUN TOOL DOGWIFTOOL COMPROMISED TO DRAIN WALLETS

Hackers compromised DogWifTools on Windows, draining users' wallets on the Solana blockchain.

OPERATION TALENT: FBI SEIZES NULLED.TO, CRACKED.TO, SELLIX.IO, AND MORE

The FBI seized cybercrime forums Nulled.to and Cracked.to along with marketplaces Sellix.io and StarkRDP.io in Operation Talent, which targeted illegal online activities.

LAZARUS GROUP USES REACT-BASED ADMIN PANEL TO CONTROL GLOBAL CYBER ATTACKS

The Lazarus Group, a North Korean threat actor, uses a web-based admin panel built with React and Node.js to control global cyber attacks.

assessment [6] or schedule a demo of Feroot.

DEEPSEEK HALTS NEW SIGNUPS AMID “LARGE-SCALE” CYBERATTACK

Chinese AI platform DeepSeek disabled registration on its DeepSeek-V3 chat platform due to an ongoing attack. It is believed that the company is facing a DDoS attack against its API and Web Chat platforms. Users can still sign in with Google to the platform.

ZERO-CLICK OLE RCE IMPACTS MICROSOFT OUTLOOK

Microsoft has patched a critical vulnerability in Windows Object Linking and Embedding (OLE) caused by a double-free in ole32.dll. An attacker can exploit this vulnerability to execute arbitrary code by sending a malicious RTF file, which is previewed by a victim in Microsoft Outlook. This post includes PoC code and threat hunting queries for the vulnerability.

BREAKING THE APPLE M3 CPU VIA FALSE LOAD OUTPUT PREDICTIONS

Researchers at Georgia Tech have discovered SLAP and FLOP attacks that exploit microarchitecture features in Apple CPUs to read sensitive data from webpages. These attacks involve predicting memory access patterns and tricking the CPU into operating on incorrect data values. SLAP and FLOP will be presented at upcoming security conferences to showcase the potential risks posed by these exploits.

TOP 5 ACTIVE DIRECTORY ATTACKS

Active Directory is the most widely used enterprise access system. This post introduces LLMNR poisoning, SMB relay, IPv6 relay, Pass the Hash, and Kerberoasting attacks. A video demo is also included.

TIPS FOR INVESTIGATING CYBERCRIME INFRASTRUCTURE

HOW TO MIGRATE TO SASE AND ZERO TRUST

The traditional network security model is no longer effective due to the rise of cloud services and remote work, exposing vulnerabilities in VPN solutions. A new approach, called Secure Access Service Edge (SASE) and Zero Trust, emphasizes granular access control and secure remote access to data and services. By adopting these solutions, companies can enhance security, simplify management, and adapt to the changing landscape of cybersecurity threats.

XSS-AGENT

A proof of concept AI-based autonomous post-exploitation system. It is intended for security testing and research purposes only. Users must agree to use the tool ethically and legally and ensure compliance with local laws and regulations.

JA4+ DATABASE (WEBPAGE)

JA4DB is community maintained repository of JA4+ TLS fingerprints

BLUESKYNET

BlueSkyNet is a web tool for OSINT researchers for searching, analyzing, and exporting data from BlueSky's API. It offers advanced search options, multiple endpoints, and CSV export functionality. Users need a BlueSky account to access the tool and can host it locally by cloning the repository.

DEEPSEEK R1 EXPOSED: SECURITY FLAWS IN CHINA'S AI MODEL

DeepSeek's R1 model is a powerful model, but it lacks some of the defenses that some of the more established competitors like ChatGPT's models provide. R1 can be trivially jailbroken using the “evil jailbreak” attack that the ChatGPT models are patched against. It does not have any protections against generating malicious code or unethical results.

FIVE REASONS TO CARE ABOUT OPENGREP

Opengrep was announced as a forever open source fork after Semgrep changed its licensing structure. James Berthoty highlights the importance of an open source SAST for establishing a comparison baseline for commercial SASTs, for the development of an industry standard for abstract syntax trees (ASTs), and the ability for community rules to unify open source scanners. Opengrep will gradually implement some of the Semgrep pro features.

TRACKING A MALICIOUS BLOGSPOT REDIRECTION CAMPAIGN TO APATEWEB

This article analyzes the "ApateWeb" malware campaign, which uses weaponized Blogspot links that appear legitimate but redirect users to malicious content including phishing pages, malware, and scam sites. Through technical investigation, the author identifies several key tactics including VPN detection, internationalization for broader targeting, and the use of "empty OK" responses to evade security scanners, ultimately discovering over 9,500 domains involved in this campaign. The analysis concludes by providing detailed indicators and infrastructure information, including domain lists and investigation tools, to help security teams identify and track similar malicious redirector campaigns.