Search the archive

PSST: WANNA BUY A LEGIT FBI EMAIL ACCOUNT FOR $40?

Abnormal AI found active FBI and global government email accounts sold on the dark web for as little as $40.

* Measuring GRC's direct impact on revenue

* Pitching GRC as an investment to your board

Register for the free webinar → August 27, 10 AM PT

INTERLOCK RANSOMWARE GROUP LEAKS 43GB OF DATA IN CITY OF ST. PAUL CYBERATTACK

The Interlock ransomware group attacked the City of St. Paul, disrupting payments and essential services. The city refused to pay the ransom and launched Operation Secure St. Paul with support from the FBI and National Guard while investigating the breach. Interlock claims to have leaked 43GB of HR, financial, and identification documents, prompting a citywide password reset and warnings about increased phishing risks.

HACKERS LEAK 2.8M SENSITIVE RECORDS FROM ALLIANZ LIFE IN SALESFORCE DATA BREACH

Threat actors linked to ShinyHunters have leaked 2.8 million records from Allianz Life's Salesforce CRM, exposing personal details including names, addresses, birth dates, and Tax IDs of customers and business partners. The July 16 breach occurred through social engineering attacks targeting the third-party cloud CRM system, affecting the majority of Allianz Life's 1.4 million customers. The attackers have formed a joint Telegram channel with other groups, including Scattered Spider and Lapsus$, to claim credit for this and other major Salesforce-related breaches.

NEW DOWNGRADE ATTACK CAN BYPASS FIDO AUTH IN MICROSOFT ENTRA ID

ProofPoint researchers discovered a new downgrade attack on Entra ID that downgrades the MFA from FIDO to a less secure fallback. The attack uses a custom evilgnix attacker-in-the-middle module to spoof a browser agent that lacks FIDO support, such as Safari for Windows. It can be prevented by disabling fallback methods.

DETECTION ENGINEERING: PRACTICING DETECTION-AS-CODE

This is part one of an ongoing series on implementing detection-as-code (DaC). It introduces core concepts such as the detection development life cycle (DDLC) and components of DaC, such as version control, code review, testing, and CI/CD pipelines. Organizations that embrace DaC can collaborate more easily, have more consistent, efficient, and higher quality detections, have better documentation, and can scale more effectively.

WHAT THE LOCKBIT 4.0 LEAK REVEALS ABOUT RAAS GROUPS

LockBit 4.0's leaked affiliate panel exposes a fragmented, chaotic RaaS operation: inconsistent negotiations, broken decryptors, unpaid platform fees, and even hits on prohibited Russian targets. This unpredictability complicates defense and incident response. The takeaway: don't rely on negotiation—prioritize preparation (segmentation, MFA, patching, and lateral-movement monitoring), as RaaS brands splinter and attribution grows harder.

LESSONS LEARNED BUILDING AN AI HACKER

This post dives into how Theori built effective LLM agents for DARPA's AI Cyber Challenge. The agents worked by breaking problems into sub-tasks, carefully curating narrow, guarded tools and enforcing structured outputs while specialized sub-agents handled recurring jobs like source questions and PoV debugging.

LEGION (PRODUCT LAUNCH)

Legion's browser-native AI SOC learns analysts' workflows to triage alerts, reduce false positives, and automate investigations across tools.

NETMAKER

Netmaker uses WireGuard to create fast, secure, and distributed virtual networks.

LUDUSHOUND

LudusHound uses BloodHound data to create a fully functional Ludus Range for controlled Active Directory testing.

RUSSIAN GOVERNMENT HACKERS SAID TO BE BEHIND US FEDERAL COURT FILING SYSTEM HACK

Officials blame Russian government hackers for breaching the U.S. federal court filing system (PACER), reportedly searching mid-level criminal cases, including some with Russian/Eastern European surnames, with stolen data including sealed dockets and informant identities. The judiciary confirmed the cyberattack and is enhancing security.

NEW YORK CLAIMS ZELLE'S SHODDY SECURITY ENABLED A BILLION DOLLARS IN SCAMS

New York Attorney General Letitia James is suing Zelle's owner, Early Warning Services, alleging the platform's weak verification and safeguards enabled over $1 billion in scams through 2023. The suit cites lax registration, slow fraud reporting, misleading “safe” marketing, and poor scammer removal. Zelle says the suit is a political stunt and claims it has strong anti-fraud efforts.

WHY IT'S TIME FOR THE U.S. TO GO ON OFFENSE IN CYBERSPACE

The US indicated a shift from strictly defensive capabilities to increasing offensive capabilities with the allocation of $1B in funding for offensive operations that was included in the “Big Beautiful Bill.” This funding will allow the US to operationalize offensive tooling more rapidly and develop the infrastructure to support more complex operations. Defensive deterrents have not been effective enough in cyberwarfare. This shift to offensive deterrents is necessary to maintain US cyber supremacy.

MICROSOFT AUGUST 2025 PATCH TUESDAY FIXES ONE ZERO-DAY, 107 FLAWS

Microsoft released fixes for 107 vulnerabilities, including an actively exploited zero-day in Windows Kerberos.

JAVA 25 PUTS 32-BIT X86 OUT TO PASTURE, ADDS 17 SHINY NEW FEATURES

Java 25, a support release that will drop 32-bit x86 support and add 17 features, is at the release candidate stage, with general availability set for September 16.

NETHERLANDS: CITRIX NETSCALER FLAW CVE-2025-6543 EXPLOITED TO BREACH ORGS

The Netherlands' National Cyber Security Centre (NCSC) warns that a critical Citrix NetScaler vulnerability (CVE-2025-6543) has been actively exploited to breach critical organizations in the country. The flaw allows attackers to compromise NetScaler appliances and gain unauthorized access to organizational networks. Organizations using Citrix NetScaler are urged to apply patches immediately to prevent exploitation.

NORTH KOREAN KIMSUKY HACKERS EXPOSED IN ALLEGED DATA BREACH

Two hackers have breached the North Korean state-sponsored hacking group Kimsuky and leaked 8.9GB of data. The data includes phishing logs, data stolen from South Korea, phishing toolkits, unknown binary archives and executables, Chrome history and configs, and Bash history files. The hackers allegedly hacked Kimsuky for ideological reasons.

MANPOWER FRANCHISE DISCLOSES DATA THEFT AFTER RANSOMHUB POSTS ALLEGED STOLEN DATA

Manpower is notifying 144,189 people of a data breach after attackers accessed its network between December 29, 2024, and January 12, 2025. RansomHub claims 500GB of data was stolen, including client and corporate data.

I BUILT AN AI HACKER. IT FAILED SPECTACULARLY

In this post, the author talks about how they built an autonomous AI pentester chaining tools like Nmap and Burp. It underperformed—few real vulnerabilities, many false results, high costs, and slow runs. Key lessons: LLMs plan well but evaluate poorly, autonomy drifts, and human validation and hybrid AI-assisted workflows outperform pure agentic hacking.

MAKING FILE ENCRYPTION FAST AND SECURE FOR TEAMS WITH ADVANCED KEY MANAGEMENT

Dropbox describes how it solved for Hardware Security Module (HSM)-backed, team-based file encryption, where files are encrypted at rest and access can be removed instantly while also prioritizing usability at scale. End-to-end encryption would make it impossible for Dropbox to offer file content search, and traditional team-based key management, where a top-level key is used to derive unique keys for each file, would be prohibitively slow due to Dropbox's file storage architecture. To solve this problem, Dropbox introduced namespace encryption keys, which are derived from an HSM-backed top-level key and are used to derive team encryption keys. When sharing files, Dropbox can temporarily share the namespace encryption key while it reencrypts the blocks with team encryption keys.

PERSISTENT RISK: XZ UTILS BACKDOOR STILL LURKING IN DOCKER IMAGES

Binarly warns that the XZ Utils backdoor (CVE-2024-3094) still lurks in Debian-based Docker Hub images from March 11, 2024, propagating into derivative images. It found 35+ affected tags, and the risk persists via inherited bases and CI pipelines. Recommendations: avoid those tags, rebuild from patched bases, and scan for the issue in your images.

explore more SANS training and resources.

GO GET 'EM: UPDATES TO VOLEXITY GOLANG TOOLING

Volexity's GoStringExtractor is a plugin utility for IDA Pro and Ghidra that helps analyze string data in Go binaries for reverse engineering and detection purposes. The tool addresses challenges in analyzing Go binaries where strings are stored in contiguous tables without individual termination, and includes data from all linked packages. This enhancement aids security researchers in better understanding malware behavior and developing detection signatures for Go-based threats.

CYATA (PRODUCT LAUNCH)

Cyata continuously scans desktop and SaaS environments for AI identities and their permissions, and creates detailed audit trails of their activity, including by requiring them to justify their reasoning in real time.

VEIL

Verified Entity Identity Lock exposes hidden trust paths in your AWS IAM setup before they become security risks.

JUSTICE DEPARTMENT ANNOUNCES COORDINATED DISRUPTION ACTIONS AGAINST BLACKSUIT (ROYAL) RANSOMWARE OPERATIONS

The Justice Department conducted coordinated disruption actions against the BlackSuit (Royal) ransomware group on July 24, seizing four servers and nine domains. Law enforcement also recovered approximately $1 million in laundered proceeds from the ransomware operations. This represents a significant enforcement action against one of the active ransomware groups targeting organizations worldwide.

HOW TOOL CALLING WORKS IN LLMS

LLMs use tools, external functions, or APIs when a user makes a request that the model cannot fulfill given its internal knowledge base. During inference, an LLM is provided with a series of tool definitions as part of its input prompt or context window, much like providing a human with a series of external functions and their documentation. When the LLM detects that a tool must be called, it ranks potential tools based on their relevance to the task and then calls the appropriate tool to address the user's query.

MUDDYWATER'S DARKBIT RANSOMWARE CRACKED

Cybersecurity firm Profero has cracked the Iranian-backed MuddyWater's DarkBit ransomware, allowing clients to recover their data without paying a ransom. Profero found that the key generation method that DarkBit uses is weak and can be brute-forced. It also discovered that VMDK files on ESXi servers are sparse, and much of the content that its clients needed could be recovered without needing to brute-force the decryption. Profero is not publicly releasing its decryptor but urges victims to contact them.

GITHUB HEAD ANKLES AS MICROSOFT TAKES BIZ BY THE HAND

GitHub CEO Thomas Dohmke is departing the company, with Microsoft choosing not to appoint a successor as the code hosting platform is becoming more integrated within Microsoft's CoreAI division.

FCC TIGHTENS RULES ON FOREIGN FIRMS BUILDING UNDERSEA CABLES, CITING SECURITY

The FCC has implemented stricter licensing requirements for foreign companies building undersea cables, citing national security concerns and the need to protect critical data infrastructure from potential foreign sabotage.

HYUNDAI WANTS IONIQ 5 OWNERS TO PAY TO FIX A KEYLESS ENTRY SECURITY HOLE

Hyundai has offered UK Ioniq 5 owners a £49 “optional” security upgrade to stop thieves using a Game Boy‑like device that cracks keyless entry.

RESEARCHERS DETAIL WINDOWS EPM POISONING EXPLOIT CHAIN LEADING TO DOMAIN PRIVILEGE ESCALATION

Security researchers found an exploit chain in Windows Endpoint Privilege Management (EPM) that lets attackers escalate privileges to domain admin. The attack poisons EPM policies to bypass security controls and elevate privileges. Organizations using Windows EPM should review their settings and update security measures.

BOUYGUES TELECOM HIT BY CYBERATTACK, 6.4 MILLION CUSTOMERS AFFECTED

Bouygues Telecom, a French provider, suffered a cyberattack that exposed the data of 6.4 million customers, including names, emails, and phone numbers, but not payment info. It notified affected customers and authorities during its investigation.

CONNEX CREDIT UNION DATA BREACH IMPACTS 172,000 PEOPLE

Hackers breached Connex Credit Union systems June 2–3, likely stealing files with names, account numbers, debit card data, Social Security numbers, and government IDs. Connex reported 172,000 impacted, but there was no evidence of access to accounts or funds.

THE SECURITY PRINCIPLES GUIDING 1PASSWORD'S APPROACH TO AI

Seven core security principles for AI integration: encrypting secrets, using deterministic authorization over probabilistic LLM decisions, preventing raw credentials in LLM contexts, maintaining auditability, ensuring transparency, implementing least privilege, and balancing security with usability. AI agents must follow strict access controls, similar to humans, with credentials delivered securely (e.g., OAuth) rather than through LLM prompts, maintaining a zero-knowledge architecture. These principles show that traditional siloed privileged access management is inadequate for the AI era, which will require unified frameworks for both human and AI interactions.

THREE DOTS TO ROOT: HOW I FOUND A PATH TRAVERSAL IN MICROSOFT'S AGENTIC WEB

Microsoft's NLWeb is a new framework designed to allow AI agents to interact with websites and APIs via natural language. This author describes how they discovered a path traversal vulnerability that could lead to the disclosure of arbitrary files such as `/etc/passwd` or `.env`. The vulnerability was caused by the use of the `os.path.normpath()` function, which does not prevent “climbing out” of the directory using `../`.

CONSTRUCTING A TRUSTWORTHY EVALUATION METHODOLOGY FOR CONTEXTUAL SECURITY ANALYSIS

DryRun Security uses an AI engine called Contextual Security Analysis (CSA) to analyze code changes probabilistically. Each PR goes through three steps: whole-PR synthesis to understand the goal, hunk-scoped reasoning to isolate individual code hunks and filter out unrelated changes, and on-demand context acquisition to retrieve supporting files and dependencies. DryRun also has a secondary audit model that randomly samples production findings every 24 hours to check instruction compliance, hallucination detection, and vulnerability accuracy.

Get the Hype Cycle Report (via Dropzone AI)

IDA PRO CROSS-REFERENCE GENERATOR FOR MANDIANT XREFER

Professional IDAPython script that generates additional cross-references for IDA Pro that aren't automatically detected, specifically designed for use with the Mandiant XRefer plugin.

EPSS PULSE (PRODUCT LAUNCH)

RunZero's EPSS Pulse is a free tool that tracks trends in Exploit Prediction Scoring System (EPSS) data to help security teams prioritize vulnerability remediation. It shows which vulnerabilities are gaining or losing exploitation likelihood over time, helping defenders focus on critical patches. Monitoring EPSS score changes enables organizations to make better vulnerability management decisions beyond static CVSS scores.

TONIC SECURITY (PRODUCT LAUNCH)

Tonic Security provides an AI agent–driven exposure management platform that ingests org data and threat intel to contextualize risk, prioritize remediation, reduce alert noise, and accelerate fixes. The company claims 50% faster MTTR and 90% fewer remediation actions needed.

UTILITIES, FACTORIES AT RISK FROM ENCRYPTION HOLES IN INDUSTRIAL PROTOCOL

OPC UA, a widely used industrial protocol, contains cryptographic design flaws that enable authentication bypass and message confusion attacks. Researcher Tom Tervoort has disclosed CVEs and PoCs that affect multiple vendors. He recommends applying patches, disabling OPC UA over HTTPS and Basic128Rsa15, and enforcing network restrictions like IP allowlists to limit exposure.

APPSEC/PRODSEC'S REALITY GAP

Application and Product Security face a disparity in connecting theoretical security concepts to practical environments. A lack of context defines the problem space, teams trying to avoid slowing down development, security tools not addressing where teams are struggling or organizational scale, and tooling being designed for gates instead of guardrails. AI-based tools may help in providing more context and tailored experiences, but they will not alleviate the resource constraints that many teams face.