Search the archive

CYBERSECURITY AI

CAI is an open-source framework for building AI tools for cybersecurity bug hunting and vulnerability testing. It uses agents and tools to automate tasks, but lets humans guide and control the process.

TNOK – NEXT GENERATION PORT SECURITY

Tnok is a port security tool that employs time-based one-time passwords (TOTP) as dynamic port knock sequences. It encodes 6-digit 2FA codes into network packets sent to the target port: for UDP, the code is included in packet data, and for TCP, codes are encoded in TCP options (like MD5 and Mood) or distributed across multiple SYN packets via MSS values to avoid requiring root privileges. The system keeps protected ports closed until a valid TOTP code is received, after which it temporarily grants access without additional firewall configuration.

KALI LINUX 2025.1C FIXES KEY ISSUE, ADDS NEW TOOLS AND INTERFACE UPDATES

Kali Linux lost its software signing key in April, causing update errors for users with systems installed before that date and potentially exposing them to security risks. Version 2025.1c fixes this issue by including a new repository key. Older installations will require manually downloading and installing the new key via a wget command. The update also introduces a redesigned menu following the MITRE ATT&CK framework and adds over a dozen new security tools, including Azurehound, binwalk3, and bopscrk.

WINDOWS 11'S CRUCIAL RESTORE POINTS NOW SELF-DESTRUCT AFTER 60 DAYS

Microsoft announced that as of the June update, Windows 11 24H2, restore points will only be stored for 60 days. Restore points are used to restore a system to a known good state in the event of system corruption. Before this update, restore points were stored for 90 days.

POLICE WARN OF SMS ‘BLASTER' SCAMS

Police warned about SMS "blaster" devices after Chinese student Ruichen Xiong was jailed for over a year for using one to send fraudulent messages while driving in London in March. These radio devices lure phones from legitimate networks with stronger signals, enabling criminals to send texts without phone numbers and bypass anti-spam measures to conduct "smishing" attacks that steal personal info. Experts suggest Android users disable 2G and iPhone users filter unknown messages. Report suspicious texts to 7726.

CRYPTOMINERS' ANATOMY: SHUTTING DOWN MINING BOTNETS

Akamai developed two techniques to shut down cryptomining botnets by exploiting mining pool topologies and policies - submitting "bad shares" (invalid hash calculations) that trigger automatic bans from mining pools. The first technique targets mining proxies by connecting as a fake miner and submitting consecutive bad shares, causing the proxy to get banned and shutting down the entire botnet operation (they reduced one campaign's hashrate from 3.3 million to zero). The second technique floods public pools with thousands of fake login attempts to temporarily disrupt direct pool connections, though this method is less permanent than targeting proxies.

NEW U.S. VISA RULE REQUIRES APPLICANTS TO SET SOCIAL MEDIA ACCOUNT PRIVACY TO PUBLIC

The U.S. now requires F, M, and J visa applicants to make their social media accounts public.

ANDROXGH0ST BOTNET EXPANDS REACH, EXPLOITING US UNIVERSITY SERVERS

The Androxgh0st botnet is attacking more targets, including US universities like UC San Diego, by exploiting weak servers and software.

THE U.S. HOUSE BANNED WHATSAPP ON GOVERNMENT DEVICES DUE TO SECURITY CONCERNS

The U.S. House has prohibited the use of WhatsApp on official devices due to security and data protection concerns, requiring staff to use approved alternatives such as Microsoft Teams and Signal.

MCLAREN HEALTH CARE HIT BY ANOTHER DATA BREACH, EXPOSING 743K PEOPLE'S DATA

McLaren Health Care suffered another data breach in July-August 2024, exposing the personal and medical information of 750,000 people. Hackers accessed names, Social Security numbers, driver's licenses, and health records. This follows a 2023 ransomware attack by BlackCat that affected over 2 million people.

CANADA SAYS TELCOS WERE BREACHED IN CHINA-LINKED ESPIONAGE HACKS

The Canadian government and the FBI report that China-backed Salt Typhoon hackers targeted Canadian telecoms, compromising at least one provider in February by manipulating Cisco routers for traffic collection. The group, active since 2024, previously hit U.S. telecoms and is expected to continue targeting Canadian organizations through 2027.

CYBERCRIMINALS BREACH AFLAC AS PART OF HACKING SPREE AGAINST US INSURANCE INDUSTRY

Insurance giant Aflac has announced it suffered a breach due to a social engineering attack. The breached information includes SSNs, insurance claims, and health information. Experts suspect that the attackers were the Scattered Spider ransomware group.

MITIGATING PROMPT INJECTION ATTACKS WITH A LAYERED DEFENSE STRATEGY

Google has implemented a layered security approach to protect Gemini AI from indirect prompt injection attacks. Its defenses include content classifiers detecting malicious instructions, security thought reinforcement, URL sanitization, user confirmation frameworks, and security notifications. This multi-layer strategy makes attacks more difficult and expensive while keeping users informed about threats.

THE RISE OF RESIDENTIAL PROXIES AS CYBERCRIME ENABLERS

Residential proxy providers offer millions of IP addresses from residential devices such as laptops, set-top boxes, and IoT smart devices. Residential proxies can provide cybercriminals with many IPs to cycle through while blending in with legitimate user traffic. Defenders should use JA4+ fingerprinting or other session-based defenses.

SPYING ON SCREEN ACTIVITY USING CHROMIUM BROWSERS

By default, Chromium-based browsers require users to consent to screen sharing and choose a screen to share to allow websites to capture a user's screen. However, these security researchers developed an attack that uses the `-- auto-select-desktop-capture-source` command line flag to enable screen sharing automatically. This attack can be chained with a headless browser or a small browser launched off-screen to hide the window from a user.

to Automation_

NPQ

NPQ is a security tool that audits npm/yarn packages before installation, running safety checks like vulnerability scans, package age verification, download count analysis, and malicious script detection. It prompts users for confirmation if issues arise, then allows npm or yarn to proceed with installation.

CLOUDREC

CloudRec is an open-source, multi-cloud security posture management (CSPM) platform.

NEW AI JAILBREAK BYPASSES GUARDRAILS WITH EASE

"Echo Chamber" is a new AI jailbreak technique that manipulates LLM context through progressive "poisoning" with acceptable prompts. Unlike direct attacks, it plants innocent "steering seeds" that gradually guide models toward prohibited responses. Testing showed over 90% success rates for generating harmful content across major AI models.

IRAN'S INTERNET: A CENSYS PERSPECTIVE

Iran faced a near-total internet blackout from June 18, hitting its lowest visibility on June 21 before gradually recovering. Some networks, like AS25124 (DATAK) and AS1756 (HAMYAR-AS), recovered slowly, while others, such as AS42337 (RESPINA-AS) and AS50810 (MOBINNET-AS), were fully restored. The Telecommunication Infrastructure Company (TIC) acts as a key bottleneck, providing transit for all networks with the weakest recovery.

NEW INFOGRAPHIC: PCI DSS VULNERABILITY MANAGEMENT PROCESSES

A high-level infographic from PCI outlining the new PCI DSS vulnerability management processes.

RUSSIAN COURT RELEASES SEVERAL REVIL RANSOMWARE GANG MEMBERS

A Russian court found four REvil gang members guilty of fraud and crimes but released them after serving time since their 2022 arrests, confiscating luxury assets worth hundreds of thousands of dollars.

APT28 HACKERS USE SIGNAL CHATS TO LAUNCH NEW MALWARE ATTACKS ON UKRAINE

Russian hackers from APT28 are leveraging Signal chats to distribute malware named BeardShell and SlimAgent, aiming to steal data and capture screenshots from Ukrainian government targets.

Join Persona's engineering team for a live discussion and demo

covering:

Register for the live event →

16 BILLION APPLE, FACEBOOK, GOOGLE, AND OTHER PASSWORDS LEAKED

A record 16 billion login credentials have leaked online, exposing passwords from major services. Experts urge users to stop reusing passwords, adopt password managers, enable multi-factor authentication, and switch to passkeys for better security. The leak is not from a single breach but multiple infostealer sources.

ATTACK ON OXFORD CITY COUNCIL EXPOSES 21 YEARS OF ELECTION WORKER DATA

Oxford City Council suffered a cyberattack on June 7-8, compromising 21 years of election worker data (2001-2022). The breach affected current and former council officers' personal information. Automated security systems detected and stopped the attack and have since been restored. There is no evidence that suggests data was shared externally or mass-downloaded.

ANUBIS RANSOMWARE LISTS DISNEYLAND PARIS AS NEW VICTIM

The Anubis ransomware group asserts that it has acquired 64GB of data from Disneyland Paris, mostly concerning construction and renovation efforts. They claim to have accessed the files by breaching a partner company and have shared images and videos as evidence. It remains uncertain whether customer data was also compromised. Disneyland Paris has not verified the breach.

CLOUDTRAIL LOGGING EVASION: WHERE POLICY SIZE MATTERS

Researchers from Permiso Security discovered a novel CloudTrail log bypass that abuses differing policy size calculations. AWS' documentation states that whitespace does not count when determining the maximum size of an IAM policy. However, the researchers determined that the policy would fail validation if the whitespace caused the size to exceed 131,072 characters. The researchers discovered that CloudTrail fails to capture full request details for requests in the size range of 102,401 to 131,072.

DO NOT RUN ANY CARGO COMMANDS ON UNTRUSTED PROJECTS

This post highlights two attack vectors by which malicious Rust code could target the cargo system. The first attack vector abuses the fact that a project could remap the `rustc` binary to any arbitrary path, which would compromise any cargo commands. The second attack vector could compromise plugins that don't use the cargo config files, such as `cargo crev`, by defining an alias for that command in the config.toml.

DETECTION PITFALLS YOU MIGHT BE SLEEPING ON

This post presents five common Windows detection pitfalls that can lead to gaps in detection. The pitfalls include parameters being able to be called in multiple different ways, & and | causing multiple log entries for a single command, extra whitespace in commands, other forms of command obfuscation, and commands that don't cause process creation events. Each pitfall also includes detection tips to circumvent it.

or Apple AirPods Pro! Claim your offer

GPGFRONTEND

Modern, cross-platform OpenPGP GUI—easy for beginners, powerful for experts, fully portable and open-source.

AWS ROLLS OUT 3 KEY SECURITY CAPABILITIES AT RE:INFORCE, HELPING CUSTOMERS SIMPLIFY AND SCALE

AWS announced three new security services at re:Inforce conference to address AI-era threats. Security Hub centralizes threat identification and prioritization. Shield proactively analyzes network configurations to prevent attacks like SQL injection and DDoS. GuardDuty Extended Threat Detection now protects container applications, detecting sophisticated multi-stage attack patterns.

TOOLHIVE

ToolHive is a tool that allows for running any MCP server in a locked-down container with a single command.

MASSIVE 7.3 TBPS DDOS ATTACK DELIVERS 37.4 TB IN 45 SECONDS, TARGETING HOSTING PROVIDER

Cloudflare blocked a record-breaking 7.3 Tbps DDoS attack targeting a hosting provider in May. The 45-second attack delivered 37.4 terabytes from over 122,000 IP addresses across 161 countries.

IRAN'S GOVERNMENT SAYS IT SHUT DOWN INTERNET TO PROTECT AGAINST CYBERATTACKS

Iran shut down its internet nationwide this week, calling it a "near-total blackout." The government confirmed it ordered the shutdown to protect against Israeli cyberattacks, citing recent hacks on Iranian banks and cryptocurrency exchanges by the pro-Israel group Predatory Sparrow.

SCAMMERS USE INFERNO DRAINER TO STEAL $43K FROM COINMARKETCAP USERS

Hackers deceived CoinMarketCap users into linking their crypto wallets to a counterfeit prompt, resulting in the theft of over $43,000 through a tool known as Inferno Drainer, which disseminated a hidden code across the site.

WALMART TO PAY $10M TO SETTLE LAWSUIT OVER MONEY TRANSFER SCAM

Walmart has agreed to pay $10 million to settle FTC allegations that it allowed scammers to exploit its money transfer services between 2013 and 2018, which resulted in hundreds of millions of dollars stolen from customers through fraud schemes.

RUSSIAN HACKERS BYPASS GMAIL MFA USING STOLEN APP PASSWORDS

Russian hackers impersonated U.S. State Department officials to deceive individuals into providing passwords that allowed them to circumvent Gmail's security measures, specifically targeting experts and critics of Russia.

→ The experts at Gartner have identified 5 essential questions

you need to answer in order to bridge the gap between security and

IAM. Read their findings in this complimentary report

→ Want to dive deeper into these issues and prepare your IAM program for the age of AI agents? Register for Gartner Identity & Access

Management Summit 2025

HEALTHCARE SAAS FIRM SAYS DATA BREACH IMPACTS 5.4M PATIENTS

Episource, a healthcare services company that provides risk adjustment, medical coding, data analytics, and technology solutions to health plans and providers, is warning impacted patients of a data breach that it suffered in January. The breached data may have included full names, physical addresses, email addresses, phone numbers, insurance plan and Medicaid information, medical records, dates of birth, and SSNs. Episource has stated that no banking or payment card information was stolen.