Search the archive

APPLE PATCHES FIRST EXPLOITED IOS ZERO-DAY OF 2025

Apple has released patches for multiple vulnerabilities, including an iOS bug exploited in attacks.

GOOGLE TO KILL CHROME SYNC ON OLDER CHROME BROWSER VERSIONS

Google is ending Chrome Sync for older Chrome versions in early 2025.

SIGNAL WILL LET YOU SYNC OLD MESSAGES WHEN LINKING NEW DEVICES

Signal is introducing a new feature that allows users to synchronize their old message history from their primary iOS or Android devices to newly linked devices like desktops and iPads while maintaining end-to-end encryption and data security.

See the Menlo enterprise browser in action →

MILLIONS OF SUBARUS COULD BE REMOTELY UNLOCKED, TRACKED DUE TO SECURITY FLAWS

Security researchers have discovered vulnerabilities in Subaru's Starlink system that allow tracking of vehicles' year-long location history and control of car features. Though now patched, the incident highlighted broader privacy concerns about automotive data collection and employee access to customer information.

BANK OF AMERICA'S SENSITIVE CUSTOMER DATA COMPROMISED IN THIRD-PARTY HACK

Bank of America confirmed that a breach of a third-party software provider led to the exposure of at least 414 customers' personal data. The compromised data includes names, SSNs, addresses, phone numbers, passport numbers, and loan numbers. Bank of America has stated that its systems are not impacted and that it has found no evidence of breach.

HUNDREDS OF FAKE REDDIT SITES PUSH LUMMA STEALER MALWARE

Researchers are warning of threat campaigns that are utilizing fake Reddit pages to social engineer users to download files via a fake WeTransfer site. The campaign involves fake Reddit threads where a user asks for help downloading a tool, another user provides a fake WeTransfer link, and then the first user thanks them. The link redirects to a fake WeTransfer page which redirects the user to a page that downloads the Lumma Infostealer malware.

CLONE2LEAK: YOUR GIT CREDENTIALS BELONG TO US

A security engineer investigating GitHub Desktop discovered a vulnerability in Git's Credential Protocol that could leak user credentials. Further research revealed similar bugs across multiple Git-related projects, stemming from improper message handling in credential helper implementations.

GETTING STARTED WITH AWS SECURITY: ATTACKING AND AUDITING

A blog post with resources and a lab environment for beginners to get started with AWS security. The post begins with an overview and demonstration of 4 common attacks against EC2 and S3. The post then provides an overview of CLI and GUI based auditing.

VMWARE ESXI LOGGING AND DETECTION OPPORTUNITIES

AXOFLOW (PRODUCT LAUNCH)

Axoflow automatically discovers security data sources (such as syslog, OpenTelemetry, Windows, and more) and then classifies, normalizes, and enriches the data, reduces data volume by more than 50%, and eliminates the need for manual data wrangling.

RANDOMPASS

A simple static password generator. Generated passwords are 20 characters, lower and uppercase, and contain special characters by default.

BAITROUTE

Baitroute is a web honeypot library that creates fake vulnerable endpoints to detect and deceive attackers. It offers easy integration with popular web frameworks and minimal performance impact. By setting up rules and alert handlers, you can monitor and respond to attacker activity on the decoy endpoints.

BRITISH MUSEUM SAYS EX-CONTRACTOR 'SHUT DOWN' IT SYSTEMS, WREAKED HAVOC

A fired IT contractor broke into the British Museum on January 23 and sabotaged several IT systems, forcing the closure of temporary exhibitions through the weekend. The individual was arrested at the scene while the museum was working to restore normal operations.

NEW GHOSTGPT CHATBOT FACILITATES MALWARE CREATION AND PHISHING

Researchers from Abnormal Security have reported on a new malicious chatbot that is being sold via Telegram. They believe that GhostGPT is a wrapper around a jailbroken version of ChatGPT or other open-source LLM. This post highlights the risk that these tools bring by giving low-skilled hackers more powerful tools.

PUBLIC GOOGLE DRIVE LINK EXPOSES MILITARY ORDERS CONTAINING PII AND OPERATIONAL DETAILS

A report was submitted to the U.S. Dept of Defense regarding a security issue found in a Google Drive link. The link contained PDFs disclosing sensitive personal information, posing a risk of privacy violation and identity theft. The suggested action is to either remove the folder or adjust its privacy settings.

WHAT DEVELOPERS THINK ABOUT SECURITY IN 2025 – AND WHY IT MATTERS

This survey investigates how developers approach code security, examining their challenges, priorities, and organizational support needs.

HACKERS STEAL $85 MILLION WORTH OF CRYPTOCURRENCY FROM PHEMEX

Hackers stole $85 million in cryptocurrency from Phemex and the exchange suspended transactions, identified vulnerabilities, and reported the incident to authorities.

A TUMULTUOUS WEEK FOR FEDERAL CYBERSECURITY EFFORTS

Brian Krebs reports on major cybersecurity concerns as Trump dismantles key federal security infrastructure, including firing all Cyber Safety Review Board advisors, scraps AI safety measures, and appoints officials who aim to weaken CISA's role in combating misinformation and cyber threats.

surface? Book your demo with Obsidian

UK TELCO TALKTALK CONFIRMS PROBE INTO ALLEGED DATA GRAB UNDERWAY

TalkTalk is investigating claims of a potential data breach affecting customer information on a third-party platform. The company denies the scale of the alleged breach, stating that no billing or financial details were compromised and the claimed customer numbers are inaccurate.

UNITEDHEALTH CONFIRMS 190 MILLION AMERICANS AFFECTED BY CHANGE HEALTHCARE DATA BREACH

UnitedHealth confirmed the Change Healthcare ransomware attack affected approximately 190 million Americans, making it the largest medical data breach in U.S. history. The ALPHV ransomware gang stole extensive personal, medical, and financial information through a compromised account.

SONICWALL FLAGS CRITICAL BUG LIKELY EXPLOITED AS A 0-DAY

SonicWall has issued a warning to customers running SonicWall's Secure Mobile Access 1000 product of a critical (9.8) vulnerability. The vulnerability in question allows for OS command injection. SonicWall is urging customers to update or work around the issue immediately as the vulnerability may be under active exploitation.

RANSACKED

Researchers discovered 119 vulnerabilities across 10 LTE/5G network implementations that enable potential city-wide cellular service disruption and remote network access. Every tested implementation had flaws that affected critical communication systems and could compromise cellular infrastructure. This post goes through every one of them.

SALT TYPHOON: AN ANALYSIS OF VULNERABILITIES EXPLOITED BY THIS STATE-SPONSORED ACTOR

Salt Typhoon breached multiple U.S. telecommunications providers, exploiting known vulnerabilities in external-facing systems. The sophisticated APT group targets government and technology sectors, maintaining stealthy network access through custom malware and unpatched devices. This blog analyses the attack.

SAFEGUARD YOUR GENERATIVE AI WORKLOADS FROM PROMPT INJECTIONS

The AWS Security team provides an overview of prompt injection techniques and an overview of defenses available in AWS. AWS suggests using Amazon Bedrock Guardrails for prompt injection defenses and input and output filtering as well as integrating a WAF and secure prompt engineering practices. It also recommends ensuring proper logging and that IAM roles associated with GenAI apps not have excessive permissions.

See how it works in four minutes, no signup required

Threatlocker Allowlisting lets you set default-deny policies

that prevent ransomware and zero-day exploits, and define exceptions for applications you trust. It comes with 24/7/365 support and outperforms other appsec tools when it comes to blocking ransomware.

HORUS

Horus is a Python tool for investigations that offers API support and data compilation. The tool allows for manual API configuration and has intended features at different development stages.

TOKENSMITH

TokenSmith is a tool that generates Entra ID access and refresh tokens for offensive engagements. It supports bypassing Intune compliant device conditional access.

TRYHACKME'S NEW SOC SIMULATOR

TryHackMe launched a new SOC Simulator environment to provide an immersive SOC training environment. It is running a competition for businesses interested in trying out the simulator.

ATOMIC & STATEFUL DETECTION RULES

Atomic detection rules focus on a single anomalous event. Stateful detection rules focus on identifying a pattern of suspicious activity such as repeated failed logins from a single IP. This post introduces both topics and provides sample Sigma rules for each.

WORLD'S FIRST MIDI SHELLCODE

This blog post discusses how researchers gained control of a Yamaha PSR-E433 synth by sending MIDI messages to make it play a song on the LCD screen. The researchers discovered a powerful chip inside the synth and found ways to manipulate its memory through MIDI commands. By using clever tricks and assembly snippets, they were able to create the world's first MIDI shellcode without needing special interfaces like JTAG or UART.

INSIDE FUNKSEC: AN EXCLUSIVE INTERVIEW WITH A RANSOMWARE ARCHITECT

This is an interview conducted by Foreseit with an architect of FunkSec ransomware group. Mitigation for FunkSec strategies involve strong cybersecurity measures, employee training, and staying informed on threats. Businesses should focus on prevention, backup processes, and proactive security to defend against ransomware threats.

2024 HYBRID SECURITY TRENDS REPORT - HEALTHCARE SECTOR

Report on the threats and attacks of the healthcare sector - 84% of organizations in the sector spotted a cyberattack on their infrastructure last year.

COSTA RICA REFINERY CYBERATTACK WAS FIRST DEPLOYMENT FOR NEW US RESPONSE PROGRAM, AMBASSADOR SAYS

The U.S. used a new rapid response program called FALCON to help Costa Rica after a ransomware attack on its oil refinery - it provided swift support within 36 hours, costing $500,000.

GOOGLE H1 2025 THREAT HORIZONS REPORT (PDF DOCUMENT)

Threat actors are increasingly exploiting overprivileged service accounts and identity vulnerabilities for lateral movement while adapting tactics to evade detection and maximize profits through data theft, ransomware, and cloud resource hijacking.

Get started with Threatspike Blue

ISSUES WITH AMAZON WORKSPACES, AMAZON APPSTREAM 2.0, AND AMAZON DCV

AWS has released a security bulletin on two new CVEs that affect native clients for Amazon Workspaces, Amazon AppStream, and Amazon DCV. These vulnerabilities allow the execution of a man-in-the-middle attack to connect to remote sessions. Amazon has released patched clients and urges users to update.

POWERSCHOOL THEFT LATEST: DECADES OF CANADIAN STUDENT RECORDS, DATA FROM 40-PLUS US STATES FEARED STOLEN

Canadian student records dating back to 1985 may have been leaked following PowerSchool's hack. The data breach affected 62.4 million students across 40+ US states and Canada. Sensitive personal information was potentially accessed, including names, addresses, and medical details. Over 20 lawsuits have been filed.

GOVTECH GIANT CONDUENT WON'T RULE OUT CYBERATTACK AS OUTAGE DRAGS ON

Conduent, a government contractor, experienced a service interruption affecting multiple U.S. states, potentially due to a cyberattack. The outage impacted benefits and support payments in states like Wisconsin and Oklahoma, disrupting child support and food assistance services.

UNDERSTANDING HONEYPOTS: A POWERFUL TOOL FOR IMPROVING NETWORK SECURITY

Honeypots are deceptive security systems that attract and trap cyber attackers, providing organizations with early threat detection, insights into attacker behavior, and protection for critical assets. This blog dives into them and how they can be used to enhance network security.

HOW TO IMPLEMENT IAM POLICY CHECKS WITH VS CODE AND IAM ACCESS ANALYZER

IAM Access Analyzer custom policy checks allow for validating IAM policies against a predefined set of rules. This post walks through the steps to use IAM Access Analyzer in VS Code via the AWS Toolkit extension. IAM Access Analyzer supports ValidatePolicy, CheckNoPublicAccess, CheckAccessNotGranted, and CheckNoNewAccess checks to support developers when developing new IAM policies in Terraform or CloudFormation.

ENTRA CONNECT ATTACKER TRADECRAFT: PART 2

This post discusses how to exploit Entra Connect Sync to add credentials to a user in another domain within the same Entra tenant, despite having limited privileges. A link can be established to a targeted on-premises user account by creating a new Entra user with a matching sourceAnchor. This attack can be prevented by identifying partially synced users and privileged accounts inheriting permissions from the Users OU.

findings and analysis (no registration required)