Search the archive

TAILSCALE LAUNCHES JAMF PRO INTEGRATION

Tailscale has launched an integration with Jamf Pro that allows Tailscale administrators to utilize checks from Jamf Pro in device posture management rules.

OPENGREP

Opengrep is a static code analysis tool that helps find security issues in code. It is a fork of Semgrep that aims to empower developers with transparent analysis. Opengrep supports various languages and offers fast pattern searching for fixing security vulnerabilities.

DRYRUN SECURITY (PRODUCT LAUNCH)

Dryryn provides Natural Language Code Policies (NLCP), which enables development teams to define and enforce security policies using plain conversational language.

MITRE ROLLS OUT D3FEND 1.0 TO BRING IN NEW ERA OF CYBERSECURITY STANDARDIZATION

MITRE has released a new cybersecurity ontology aimed at standardizing the vocabulary for countering cyber threats. The D3FEND framework seeks to encode a countermeasure knowledge graph with semantically rigorous types and relations that define key concepts in the countermeasures domain and the relations to link them. MITRE has also released a Cyber Attack-Defense (CAD) tool to construct D3FEND knowledge graphs.

4 REASONS YOUR SAAS ATTACK SURFACE CAN NO LONGER BE IGNORED

SaaS apps have become nearly ubiquitous, with some estimates suggesting that the average employee creates a new SaaS account every two weeks. The Verizon DBIR and reports from Crowdstrike highlight that SaaS apps form an incredibly attractive attack surface for hackers. The article highlights the unique SaaS sprawl that GenAI has caused as well as the potential compliance issues involved in SaaS products.

TARGETED SUPPLY CHAIN ATTACK AGAINST CHROME BROWSER EXTENSIONS

A supply chain attack targeted Chrome browser extensions in December, compromising developers through phishing emails to upload malicious versions to the Chrome Web Store. The attacker aimed to harvest sensitive data from users' web browsers by injecting malicious code into compromised extensions. This sophisticated attack potentially impacted hundreds of thousands of end users.

PWN2OWN AUTOMOTIVE 2025 DAY 2: ORGANIZERS AWARDED $335,500

Bug hunters at Pwn2Own Automotive 2025 earned over $700,000 in two days, with $335,500 awarded on Day 2 alone.

PAYPAL FINED $2M FOR EXPOSING NEW YORKER'S PERSONAL INFO

PayPal was fined $2 million for exposing customers' personal information, including Social Security numbers, due to weak cybersecurity controls.

CISA: HACKERS STILL EXPLOITING OLDER IVANTI BUGS TO BREACH NETWORKS

CISA and FBI warn that hackers are still exploiting old security flaws in Ivanti Cloud Service Appliances to breach networks.

CISCO WARNS OF CLAMAV DOS FLAW WITH POC EXPLOIT CODE

Cisco has released security updates to patch a ClamAV vulnerability that could lead to denial-of-service. The vulnerability is caused by a heap-based buffer overflow in the OLE2 decryption routine that could lead the program to crash when scanning maliciously crafted OLE2 content. Cisco has stated that PoC exploit code is publicly available but there is no evidence of active exploitation.

IPANY VPN BREACHED IN SUPPLY-CHAIN ATTACK TO PUSH CUSTOM MALWARE

South Korean VPN provider IPany was breached in a supply-chain attack that deployed a custom SlowStepper malware. The attackers breached the IPany development environment and added their custom SlowStepper malware to the VPN installation. The SlowStepper C2 malware supports commands that gather system information, fetch and run files from the C2 server, enumerate and exfiltrate files, run Python-based spyware tools, run shell commands, execute syscalls, and delete files or directories.

ZENDESK'S SUBDOMAIN REGISTRATION EXPOSED TO PHISHING, PIG BUTCHERING SCAMS

A security vulnerability in Zendesk's subdomain registration feature allows cybercriminals to conduct phishing and investment scams. CloudSEK researchers discovered that attackers can create fake subdomains resembling legitimate brands to deceive victims. This poses a significant risk as attackers can send convincing phishing emails and manipulate users into sharing sensitive information or funds.

HOW TO USE TEMPORARY ACCESS PASS (TAP) WITH INTERNAL GUEST USERS

TAP is a Microsoft Entra ID solution that provides users with temporary passwordless access so one of the other permanent passwordless mechanisms can be configured. Previously, TAP would not work for guest users as they would generally need to authenticate with a remote provider. This blog post shows how to enable the newly released Entra ID TAP for internal guests feature.

TRACKING CLOUD-FLUENT THREAT ACTORS: BEHAVIORAL IOCS

Behavioral IOCs attempt to enrich a traditional IOC by correlating multiple events to add context for more robust detections. This post introduces the concept of behavioral IOCs in cloud environments and provides an example of how Wiz developed IOCs for a specific threat actor. It recommends beginning with a piece of identifying information about a threat actor or tactic and then iteratively mapping out unique parameters or other identifiers to detect that threat actor to the IOC.

SECURING INHERITED CLOUD: TOP LESSONS

Security professionals often get invited late to cloud projects, causing panic over potential vulnerabilities. To secure these environments, follow a playbook with steps like gaining access, implementing least privilege access, enabling MFA, and conducting a compromise assessment. By following the steps in this blog post, you can take control, address security concerns, and protect valuable data in cloud projects effectively.

GARAK

garak (Generative AI Red-teaming & Assessment Kit) is a vulnerability scanner for LLMs from NVIDIA.

LITTERBOX

LitterBox is a sandbox tool for testing malware payloads. It helps red teamers validate evasion techniques and assess detection mechanisms. The tool provides detailed analysis reports and should only be used in secure testing environments.

FEDISECFEEDS (WEB APP)

FediSecFeeds searches CVE data in infosec.exchange and ioc.exchange instances. The output can be fetched via GitHub's API.

TERRAFORM S3 BACKEND SETUP: SKIP THE TABLE

Terraform makes use of lock files to ensure that multiple users are not modifying a state file simultaneously. Prior to version 1.10, users who were using the S3 backend required a DynamoDB table to store the lock file. As of the newly released version 1.10, Terraform can make use of S3 conditional writes to utilize S3 for both state file and lock file storage.

TELEGRAM CAPTCHA TRICKS YOU INTO RUNNING MALICIOUS POWERSHELL SCRIPTS

Threat actors are tricking Telegram users into running malicious PowerShell scripts by pretending to be a captcha or verification system. This tactic exploits the news around Silk Road founder Ross Ulbricht to lure victims into downloading malware. Users should be cautious and avoid running any unfamiliar commands on their devices to avoid falling victim to such attacks.

MASTERCARD DNS ERROR WENT UNNOTICED FOR YEARS

MasterCard had a DNS error, unnoticed for five years, that allowed potential interception or redirection of internet traffic. A security researcher discovered the error and prevented cybercriminals from exploiting it by registering the mistyped domain. The issue has been resolved, but it highlights the importance of careful domain configuration for cybersecurity.

TRUMP ADMINISTRATION DISBANDS DHS BOARD INVESTIGATING SALT TYPHOON HACKS

The Trump administration disbanded the Cyber Safety Review Board investigating the Salt Typhoon hacks, causing concern among cybersecurity experts about the impact on national security.

WINDOWS 11 24H2 NOW ALSO OFFERED TO ALL ELIGIBLE WINDOWS 10 PCS

Windows 11 24H2 is now available to all eligible Windows 10 PCs via Windows Update.

DOJ DELETES CHINA-LINKED PLUGX MALWARE OFF MORE THAN 4,200 US COMPUTERS

The DOJ and FBI removed Chinese-linked PlugX malware from over 4,200 U.S. computers.

Download the Gartner report from SUSE →

BITBUCKET SERVICES “HARD DOWN” DUE TO MAJOR WORLDWIDE OUTAGE

Atlassian reported a major outage affecting Atlassian Bitbucket Cloud customers. Impacted services included the website, API, git via HTTPS and SSH, Webhooks, source downloads, pipelines, git LFS, email delivery, purchasing and licensing, and signup. Bitbucket has managed to restore services and disclosed that the issue was due to saturated database connections. A full postmortem will be published.

7-ZIP FIXES BUG THAT BYPASSES WINDOWS MOTW SECURITY WARNINGS

7-Zip has released a patch for a vulnerability that could allow maliciously crafted archives to bypass Windows MotW protection. Mark of the Web (MotW) is a flag that alerts users and the operating system that a file may have come from an untrusted source and prompts for permission before running. In this vulnerability, 7-Zip failed to propagate the MotW from the archive to the extracted files.

WINDOWS BITLOCKER - SCREWED WITHOUT A SCREWDRIVER

This blog post discusses how to exploit a vulnerability in BitLocker-encrypted Windows systems through a bootloader downgrade and Secure Boot bypass. By downgrading the bootloader, attackers can gain full read/write access to the encrypted disk without changing the target system. The exploit highlights the importance of Secure Boot and the potential risks associated with default BitLocker configurations.

UNSAFE ARCHIVE UNPACKING: LABS AND SEMGREP RULES

Archive Path Traversal is a vulnerability that can occur when extracting an archive file if the implementation does not properly check that filename sequences don't exit the archive (ex: ../../evil). An intern at Doyensec created a project that provides Semgrep rules as well as a playground with various malicious archive files and vulnerable implementations to demonstrate this vulnerability. The post concludes by discussing path sanitization and path validation as possible mitigations.

UNIQUE 0-CLICK DEANONYMIZATION ATTACK TARGETING SIGNAL, DISCORD, AND HUNDREDS OF PLATFORMS

An attacker discovered a method to find a person's location within a 250-mile radius through a unique 0-click deanonymization attack on platforms like Signal and Discord. By exploiting Cloudflare caching, the attacker could pinpoint a target's location by causing them to load a resource that gets cached in a local datacenter. While Cloudflare patched the bug, the attack shows how infrastructure designed for performance can be used for tracking, highlighting ongoing risks for users.

SUMMITING THE PYRAMID: BRING THE PAIN WITH ROBUST AND ACCURATE DETECTION

Summiting the Pyramid introduces a methodology to score analytics for robust detection against adversary behavior, aiming to make it harder for adversaries to hide. The framework helps defenders build accurate and resistant detections using a combination of specificity and exclusion criteria. It also provides guidance on creating robust detections for both host-based and network data.

EVILKNIEVELNOVNC

EvilKnievelnoVNC can be used for scalable and semi-automated MFA-phishing through a "browser-in-the-middle" approach. It includes features like concurrent sessions, victim-specific URLs, and real-time monitoring. Users are advised to use the tool responsibly, customize settings, and conduct tests before usage.

CYBERBRO (WEB APP)

Cyberbro is a user-friendly application for checking the reputation of online observables like IP addresses and URLs. It integrates with multiple services like VirusTotal and Google Safe Browsing to provide detailed reports efficiently. Users can easily deploy Cyberbro using Docker and customize it with API keys from different services.

GLIBC_HEAP_EXPLOITATION_TRAINING

This GitHub repository offers resources for a glibc Malloc heap exploitation course by Maxwell Dulin and Security Innovation. It includes free videos, slides, and exercises for learning about heap exploitation. The training covers various techniques and modules.

3 TAKEAWAYS FROM RED TEAMING 100 GENERATIVE AI PRODUCTS

Microsoft founded its AI red team in 2018 to address the growing landscape of AI security and threats. Generative AI systems can be vulnerable to both existing/traditional security vulnerabilities as well as novel ones. Humans will be necessary to augment Generative AI systems with subject matter expertise, emotional intelligence, and cultural context. Both technical and nontechnical, defense-in-depth approaches will be necessary to protect Generative AI systems.

PRODUCT SECURITY BAD PRACTICES

A list from CISA of product security bad practices for software manufacturers with recommendations on how to fix the issues. The first set of product practices focuses on using memory-unsafe languages, usage of default or hardcoded credentials, usage of dependencies with critical vulnerabilities, and unsafe cryptography. The second set focuses on security practices such as supporting MFA and providing access to logs that would enable intrusion detection. The last set focuses on organizational practices such as having a VDP and publishing CVEs and EoL timelines.

MALICIOUS EXTENSIONS CIRCUMVENT GOOGLE'S REMOTE CODE BAN

This blog post discusses how malicious extensions found ways to hide their harmful functions in Chrome Web Store, despite Google's restrictions. Several extensions, like Phoenix Invicta and Sweet VPN, were discovered using obfuscated code and accessing sensitive data. Domain names associated with these malicious extensions were identified, hinting at potential spying and fraud activities.

CLOUDFLARE MITIGATED A RECORD BREAKING 5.6 TBPS DDOS ATTACK

Last October, Cloudflare mitigated a 5.6Tbps UDP-based DDoS attack from a 13k Mirai botnet that lasted 80 seconds.

MICROSOFT TEAMS VISHING ATTACKS TRICK EMPLOYEES INTO HANDING OVER REMOTE ACCESS

Ransomware groups are conducting sophisticated social engineering attacks by bombarding employees with spam emails and then posing as IT support on Microsoft Teams to trick them into granting remote access to their computers.

REDLINE, VIDAR, AND RACCOON MALWARE STOLE 1 BILLION PASSWORDS IN 2024

Over 1 billion passwords were stolen by malware in the past year, including commonly used weak passwords like "123456."

HPE INVESTIGATES BREACH AS HACKER CLAIMS TO STEAL SOURCE CODE

A hacker going by the name IntelBroker claimed to have breached HPE. The hacker is selling an archive that allegedly contains certificates (private and public keys), Zerto and iLO source code, Docker builds, and old user personal information used for deliveries. HPE disabled relevant credentials but claimed that it had not discovered any evidence of a breach.

DONOT TEAM LINKED TO NEW TANZEEM ANDROID MALWARE TARGETING INTELLIGENCE COLLECTION

A hacking group called DoNot Team has been linked to a new Android malware named Tanzeem that targets specific individuals for intelligence collection. The malware masquerades as a chat app but actually collects sensitive data and establishes connections to a command-and-control server. Cyfirma notes that the group uses push notifications to deploy additional malware and ensure persistence on targeted devices for ongoing intelligence gathering.

TELEGRAM-BASED “SNEAKY 2FA” PHISHING KIT TARGETS MICROSOFT 365 ACCOUNTS

A new phishing kit called Sneaky 2FA targets Microsoft 365 accounts using evasion tactics and a Telegram platform. The kit is offered as a service on Telegram and incorporates techniques to avoid detection, posing a significant threat to cybersecurity. Organizations are advised to monitor threats closely and enhance their security measures to combat this growing risk.

AI-SUPPORTED SPEAR PHISHING FOOLS MORE THAN 50% OF TARGETS

A group of researchers tested spear-phishing emails that were created by AI agents based on Claude 3.5 Sonnet and GPT-4o which crawled the Internet for information on the targets. The researchers achieved a click-through rate (CTR) of 54% with the AI agents compared to 12% in the control group. Human-crafted spear-phishing emails also achieved a 54% CTR but at 30x the cost of the AI-generated ones, whereas emails crafted with AI and human input achieved a CTR of 56% with 4x the cost.

PREVENTING UNINTENDED ENCRYPTION OF AMAZON S3 OBJECTS

AWS detected unauthorized encryption activities in Amazon S3 due to malicious actors with valid credentials. Customers can prevent such incidents by using short-term credentials, implementing data recovery procedures, and monitoring access patterns. AWS notes that blocking of use of SSE-C encryption can also enhance security against unauthorized access.

INVESTIGATING AN "EVIL" RJ45 DONGLE

Michał Zalewski reverse-engineered a suspicious RJ45 dongle from China and revealed it was not malicious, but rather a device using a software-defined CD-ROM feature to install drivers. The device contained a chip that emulated a CD-ROM to simplify driver installation, dispelling concerns of potential malware. The investigation highlighted the importance of research and patience in understanding complex hardware systems.

IAM SIMULATE

An AWS IAM simulator that provides detailed explanations of how a policy was evaluated. It supports various IAM features like identity policies, resource policies, and more. The simulator automatically validates inputs and will soon include additional features like session policies and support for anonymous requests.

ROLES

Roles is a tool written in Golang for testing unauthenticated AWS IAM role enumeration.

GITXRAY

GitXRay is a security tool for GitHub repositories that uses public GitHub APIs for various purposes like OSINT and Forensics. It can detect sensitive information, identify threat actors, and find fake or infected repositories. Users can install and run GitXRay easily to enhance repository security and gather valuable insights.