Search the archive

ORCHID SECURITY (PRODUCT LAUNCH)

Orchid Security automatically discovers applications and evaluates authentication and authorization flows to pinpoint weak spots and suggest areas for remediation.

ATTACKRULEMAP

This GitHub repository maps Atomic Red Team attack simulations to detection rules like Sigma and Splunk ESCU. The project helps security professionals test attacks and evaluate detection strategies effectively. Contributions are welcome, including testing detection rules on different platforms and providing feedback for project improvement.

CISO ASSISTANT

CISO Assistant is a tool for managing cybersecurity posture, compliance, and risk assessments. It supports multiple frameworks and automates various tasks like audit management and evidence collection. The app aims to simplify cybersecurity processes and save time for security teams.

‘GOODBYE TO MY CHINESE SPY' MIGHT BE THE LAST GREAT TIKTOK TREND

The US faces a potential TikTok ban, prompting users to humorously say goodbye to their "personal Chinese spy" - a reference to data privacy concerns. Users are posting videos thanking their "spies" for curating content and monitoring them, preferring TikTok despite security concerns.

2024 CVES IN REVIEW

Analysis of 2024's CVE trends shows decreasing severity scores, with average CVSS dropping from 7.09 to 6.9. Critical and High severity vulnerabilities declined, while total reserved CVEs fell 7%. WordPress-related vulnerabilities increased significantly, though this may indicate improved security maturity rather than declining security.

CISA DIRECTOR SAYS THREAT HUNTERS SPOTTED SALT TYPHOON ON FEDERAL NETWORKS BEFORE TELCO COMPROMISES

CISA's director Jen Easterly mentioned that threat hunters found suspicious activity from Salt Typhoon on federal networks before realizing it was part of a larger Chinese hacking campaign targeting U.S. telecommunications. By identifying and seizing virtual private servers leased by the hackers, CISA gained insight into the extent of the hacking campaign against telecommunications companies and provided assistance to potential victims. The incident highlights the ongoing challenge of defending critical infrastructure from foreign adversaries like China and the need for improved cybersecurity measures in vulnerable sectors like telecommunications.

LAZARUS GROUP TARGETS WEB3 DEVELOPERS WITH FAKE LINKEDIN PROFILES IN OPERATION 99

The Lazarus Group conducted cyber attacks through fake LinkedIn profiles targeting Web3 developers to distribute malware and victims were tricked into cloning malicious GitLab repositories, allowing the attackers to steal sensitive data.

NICKEL TAPESTRY INFRASTRUCTURE ASSOCIATED WITH CROWDFUNDING SCHEME

CTU researchers found connections between North Korean IT worker schemes and a 2016 crowdfunding scam, linking them to the NICKEL TAPESTRY threat group.

LEGITIMATE CHROME EXTENSIONS ARE STEALING FACEBOOK PASSWORDS

A recent attack targeted popular Chrome extensions to steal Facebook passwords and other data.

See the full list here →

SCHOLASTIC EDUCATION GIANT BREACHED

A hacker going by the moniker Parasocial disclosed that they stole 8M records from Scholastic. The records contain a mix of names, email addresses, phone numbers, and home addresses with a total of over 4.2M unique emails. The hacker stated that they gained access via a compromised employee and don't plan to make the data public.

TELEFÓNICA CONFIRMS INTERNAL TICKETING SYSTEM BREACH AFTER DATA LEAK

Telefónica confirmed a security breach of its internal Jira ticketing system. Attackers using the aliases DNA, Grep, Pryx, and Rey accessed the system using compromised employee credentials and leaked approximately 2.3 GB of data on a hacking forum.

MILLIONS OF ACCOUNTS VULNERABLE DUE TO GOOGLE'S OAUTH FLAW

A security flaw in Google's OAuth login system allows attackers to access former employees' accounts by purchasing defunct startup domains. This affects millions due to startup failure rates. The vulnerability lets attackers access sensitive data in Slack, ChatGPT, HR systems, and more. Google initially dismissed but later acknowledged the issue.

COMPOUND PROBABILITY: YOU DON'T NEED 100% COVERAGE TO WIN

Compound probability is a concept in which the probability of two independent events occurring is the product of the probability of each event occurring. It explains how increasing attack surface coverage can significantly reduce an attacker's probability of evading detection. The article acknowledges some oversimplifications, particularly around EDR.

PASSWORD SPRAYING WITH SELENIUM AND FIREPROX

Password spraying attempts can often be hindered by IP based rate limiting. To circumvent this issue, this post walks through the setup of a dynamic proxy using Fireprox as well as Burp Suite Bambdas to modify the request to bypass CSP headers and other rate limiting. The post then concludes by showcasing how Selenium can be combined with the created proxy and crafted request to automate login attempts to achieve a password spraying attack.

RANSOMWARE ON ESXI: THE MECHANIZATION OF VIRTUALIZED ATTACKS

Ransomware attacks on VMware ESXi servers surged in 2024, with demands reaching $5 million and exposure of 8,000 hosts to the internet. Attackers targeted ESXi architecture through vCenter to gain control and disrupt operations. Strategies like updates, MFA, detection tools, and network segmentation are crucial in mitigating ransomware risks on ESXi.

Read the guide

SHIFT (PRODUCT LAUNCH)

Shift is a new paid Caido plugin that adds Copilot-like AI functionality to Caido.

EVIL-GO

Evil-Go is a fork of Go with some tweaks to make generated binaries more stealthy.

BUG BOUNTY WRITEUPS

This repository can be used as a reference while learning and performing Bug-Bounty hunting.

CRACKING THE CODE: HOW BANSHEE STEALER TARGETS MACOS USERS

Banshee Stealer is a macOS malware that first gained attention as a stealer-as-a-service in mid-2024. Its source code leaked in November 2024. Banshee steals system data, utilizes convincing pop-ups to convince users into entering their passwords, employs advanced evasion techniques, and exfiltrates data. The Banshee Stealer is a testament to the sophistication of modern macOS malware.

HOW BARCELONA BECAME AN UNLIKELY HUB FOR SPYWARE STARTUPS

Barcelona has emerged as a hub for spyware companies, including Palm Beach Networks (now Head and Tail), Paradigm Shift, and Epsilon. Companies are attracted by the city's lifestyle, lower costs, and easier spyware export regulations compared to Israel. Critics warn this development could fuel Europe's surveillance tech concerns.

MINISTERS CONSIDER BAN ON ALL UK PUBLIC BODIES MAKING RANSOMWARE PAYMENTS

The UK government plans to ban schools, NHS, councils, and critical infrastructure operators from making ransomware payments. Private companies must report intended payouts, which could be blocked if going to sanctioned groups. The measure aims to deter hackers, who collected $1.1bn globally in 2023.

MILLIONS OF OPENSEA USER EMAILS LEAKED IN 2022 NOW FULLY PUBLIC

7M emails obtained in a breach at OpenSea in 2022 have now been published.

JANUARY WINDOWS UPDATES MAY FAIL IF CITRIX SRA IS INSTALLED

Microsoft warns that January 2025 Windows updates may fail if Citrix SRA version 2411 is installed.

159-CVE JANUARY PATCH TUESDAY SMASHES SINGLE-MONTH RECORD

The January Patch Tuesday set a record with 159 CVEs, including 3 publicly disclosed and 3 exploited vulnerabilities, with critical impacts like Remote Code Execution.

A BREACH OF GRAVY ANALYTICS' HUGE TROVE OF LOCATION DATA THREATENS THE PRIVACY OF MILLIONS

A major data breach at Gravy Analytics threatens millions of people's smartphone location data, collected through app advertising networks. The hacker leaked 30 million location points from various apps, including sensitive locations. The breach occurred via a compromised Amazon cloud key, prompting investigations by data protection authorities.

NOMINET PROBES NETWORK INTRUSION LINKED TO IVANTI ZERO-DAY EXPLOIT

Nominet discovered a network intrusion through Ivanti VPN software's latest zero-day vulnerability (CVE-2025-0282). While domain systems remain operational and no data theft is confirmed, this marks the first public case of this exploit.

MICROSOFT: MACOS BUG LETS HACKERS INSTALL MALICIOUS KERNEL DRIVERS

Apple patched a macOS vulnerability that allowed hackers to bypass System Integrity Protection and install malicious kernel drivers by exploiting a flaw in the Storage Kit daemon. This flaw, designated as CVE-2024-44243, could be abused by local attackers with root privileges to compromise Mac systems without physical access, potentially leading to the installation of persistent malware and data theft. Microsoft emphasized the importance of SIP in protecting macOS systems and highlighted the need for robust security solutions to detect and prevent such threats.

FUNKSEC – ALLEGED TOP RANSOMWARE GROUP POWERED BY AI

FunkSec ransomware group emerged in late 2024, claiming 85+ victims in December. Analysis suggests they use AI-assisted malware development despite apparent inexperience and that many of their leaked datasets appear to be recycled from previous hacktivist campaigns.

THE SHIFTING LANDSCAPE OF OPEN SOURCE SECURITY

This post dives into the landscape of OSS, which in 2025 faces increased supply chain attacks and regulatory demands. Key trends include AI's dual role in cybersecurity (both helping and hindering), the impact of the EU's Cyber Resilience Act, and the growing emphasis on continuous monitoring.

AVOIDING MISTAKES WITH AWS OIDC INTEGRATION CONDITIONS

This article discusses a critical security issue with AWS OpenID Connect (OIDC) integrations where missing or incorrectly configured conditions in IAM role trust policies could allow unauthorized access to AWS accounts. The article explains that while the "sub" condition is commonly known to be required (especially for GitHub Actions), different vendors may require different or additional conditions, such as Microsoft Defender requiring "sts:RoleSessionName" or some vendors using custom conditions. The key recommendation is that AWS customers should ensure all their OIDC integrations have both "aud" and "sub" conditions (unless vendor documentation specifically indicates otherwise) and investigate any exceptions carefully, as there are many vendors that work differently and some even recommend additional security measures like IP address restrictions.

SOCIAL ANALYZER

Social Analyzer is an API, CLI, and Web App for analyzing and finding a person's profile across over 1,000 social media/websites. It includes different analysis and detection modules, and you can choose which modules to use during the investigation process.

BURPFERENCE

burpference is a Burp Suite extension that captures in-scope HTTP requests from Burp's proxy history and sends them to an LLM in JSON format.

MEGR-APT

MEGR-APT is an APT hunting system that discovers suspicious subgraphs matching an attack scenario published in Cyber Threat Intel (CTI) reports.

SECURITY AT SCALE: PLAID'S JOURNEY TO CREATING A KEY MANAGEMENT SYSTEM

Plaid launched an effort to build its own Key Management System (KMS) to curb bespoke cryptographic processes across different teams and services. It chose to build its own system over using a vendor-provided solution to avoid API limitations that would hamper scalability, lower costs, and be self-service. The migration process proved to be the most challenging part of building the system.

THE MANY WAYS TO OBTAIN CREDENTIALS IN AWS

This post enumerates the many different ways that an attacker might be able to obtain credentials in an AWS environment. The AWS SDK looks for hard-coded credentials, followed by environment variables, followed by AWS credential files, and lastly IMDS. The post concludes by listing out more specialized ways that certain services can obtain credentials.

SNYK SECURITY RESEARCHER DEPLOYS MALICIOUS NPM PACKAGES TARGETING CURSOR.COM

Source Code Red claims that NPM packages were deployed to target Cursor.com by a user named sn4k-s3c from Snyk. These packages collected sensitive data from systems and exfiltrated it to an attacker-controlled web service. It is essential to be cautious when installing NPM packages and look for suspicious signals like limited files in the package.

NEW ADVICE HELPS ORGANIZATIONS SELECT SECURE OPERATIONAL TECHNOLOGY PRODUCTS IN FACE OF RISING CYBER THREAT

The National Cyber Security Centre and international cyber experts urge critical infrastructure operators to integrate security into procurement processes to defend against cyber threats.

AZURE AND M365 MFA OUTAGE LOCKS OUT USERS ACROSS REGIONS

Azure and Microsoft 365 experienced a four-hour outage for multi-factor authentication that affected users in Western Europe, Chile, and the US.

CISA ORDERS AGENCIES TO PATCH BEYONDTRUST BUG EXPLOITED IN ATTACKS

CISA ordered U.S. federal agencies to patch a command injection bug in BeyondTrust software within three weeks to protect against ongoing attacks.

MEDUSIND BREACH EXPOSES SENSITIVE PATIENT DATA

Medusind has reported a data breach affecting over 360,000 customers, exposing medical, financial, and personal data following a December 2023 cyber incident. The company is offering affected individuals two years of credit monitoring and has implemented enhanced security measures.

DRUG ADDICTION TREATMENT SERVICE ADMITS ATTACKERS STOLE SENSITIVE PATIENT DATA

BayMark Health Services has reported a data breach exposing patients' sensitive information, including treatment details and personal data, following a September-October 2024 cyber incident. RansomHub gang claimed responsibility and leaked the data after apparent non-payment of ransom demands.

PHISHING TEXTS TRICK APPLE IMESSAGE USERS INTO DISABLING PROTECTION

Cybercriminals are tricking Apple iMessage users into disabling phishing protection by getting them to reply to texts. These smishing attacks prompt users to respond with "Y" to enable malicious links. Users are urged to avoid replying to suspicious texts and to verify messages directly with the company or organization.

SAMSUNG S24: OUT OF BOUNDS WRITE IN APE DECODER

A zero-click vulnerability (CVE-2024-49415) in Samsung's Monkey's Audio decoder allows for code execution through malicious audio messages on RCS-enabled phones. The vulnerability has been patched by Samsung.

USING CAPABILITIES INSTEAD OF TRUSTING 3RD PARTY CODE

CHERI capabilities can restrict third-party code's memory access by creating read-only references with explicit bounds. Rather than trust docs, the author uses hardware enforcement to prevent the MQTT library from keeping or modifying memory references. This removes trust requirements for external code by using CPU-level controls instead of relying on documentation or audits.

A JUST CULTURE GUIDE FOR INFORMATION GOVERNANCE AND CYBER SECURITY

This guidance supports organizations in creating a fair and learning-focused approach to handling data incidents in healthcare. It encourages transparency and collaboration to improve information governance and cyber security practices. NHS England provides support functions to help organizations manage incidents effectively and learn from them.