Hi folks,

It has been a while :-)

After the last issue I took some more time for myself. Not all for bad reasons though, in fact life is pretty sweet right now. My family is doing great, we're settling into the new house, and I went ahead and started a non-profit!

It's still early days, there's barely even a website, but I'm having so much fun. I haven't felt this driven and motivated in a long while, and it feels goood :-)

It's essentially a non-profit digital engineering company, where we focus on reliable, robust software for critical infrastructure and (real-world) incident response. It's exciting and maybe a little over-ambitious, but I've got a couple of projects going, and am even starting to pull in some help! We'll see where it goes :-) More to come later, I'm sure, but I won't drag this out for now.

I'm not sure what the frequency of securitynewsletter.co will be for the foreseeable future. I'll probably send, well, when I feel like it. Which I've only recently learned how much of a privilege that is, indeed.

I've gathered the news below that stood out to me from the last few weeks and months. As always, I hope you get value out of it.

Thank you for reading, thank you for waiting, and as always, thank you to 1Password for their support.

Cheers to all,

Dieter

• Chinese state attackers going after Dell zero-day since mid-2024: link.
• Aisuru botnet sets new record with 31.4 Tbps DDoS attack: link.
• Critical n8n flaws disclosed along with public exploits: link.
• CISA seeks infrastructure sector consultation on incident reporting rule: link.
• Majority of Ivanti EPMM threat activity linked to hidden IP: link.

• Have I Been Pwned: SoundCloud data breach impacts 29.8 million accounts: link.
• Newsletter platform Substack notifies users of data breach: link.
• European Commission discloses breach that exposed staff data: link.
• Hackers access Odido customer info, 6.2 million hit: link.

Hi folks,

I think last week was the first time I ever skipped an issue. My grandfather passed away, so priorities changed. Fortunately he passed without pain, in his sleep, at the worthy age of 98. We had a beautiful service honoring the man he was and the family he built, and are now getting back on track.

For this issue I had the choice of either focusing on the last seven days of news, or focus on the last two weeks but only highlight articles, not summarise them. I went for the latter option, because I want to make sure I didn't miss anything big. So here are the stories of the last two weeks that jumped out to me.

Have a good week my friends,

Dieter

• GitHub tightens npm security with mandatory 2FA, access tokens: link.
• As many as 2 million Cisco devices affected by actively exploited 0-day: link.
• Hackers steal sensitive Red Hat customer data after breaching GitLab repository: link.
• New EDR-Freeze tool uses Windows WER to suspend security software: link.

• Supermicro server motherboards can be infected with unremovable malware: link.

• Chinese hackers exploiting VMware zero-day since October 2024: link.

• CISA warns of critical Linux Sudo flaw exploited in attacks: link.

• Microsoft warns of new XCSSET macOS malware variant targeting Xcode devs: link.

• Redis warns of critical flaw impacting thousands of instances: link.

• Steam and Microsoft warn of Unity flaw exposing gamers to attacks: link.

• Signal adds new cryptographic defense against quantum attacks: link.

• Potential EU law sparks global concerns over end-to-end encryption for messaging apps: link.

• Microsoft will offer free Windows 10 extended security updates in Europe: link.

• Microsoft Outlook stops displaying inline SVG images used in attacks: link.

• Gmail business users can now send encrypted emails to anyone: link.

• Google's new AI bug bounty program pays up to $30,000 for flaws: link.

• Zeroday Cloud hacking contest offers $4.5 million in bounties: link.

• Dutch teens arrested for trying to spy on Europol for Russia: link.

• UK govt backs JLR with £1.5 billion loan guarantee after cyberattack: link.

• ParkMobile pays... $1 each for 2021 data breach that hit 22 million: link.

That's it for this week (/the last two weeks). Thank you for reading, and thank you to 1Password for their support. See you next week!

Hi folks!

Here we are with this week's issue. I'm glad I got it out in time for once :-)

I don't have much else to share right now, except: have a wonderful, bright, sunny day and week! <3

Cheers, Dieter

One Token to rule them all - obtaining Global Admin in every Entra ID tenant

Read the article (dirkjanm.io).

This is a doozy. Great write-up of how this security researcher combined two flaws in Entra to gain full admin access over all Entra ID tenants.

From the article:

Effectively this means that with a token I requested in my lab tenant I could authenticate as any user, including Global Admins, in any other tenant. Because of the nature of these Actor tokens, they are not subject to security policies like Conditional Access, which means there was no setting that could have mitigated this for specific hardened tenants.

Oof. On the bright side, Microsoft responded quickly and patched the issue within days. Good work, good write-up, and a good discussion on Hackernews.

Self-propagating supply chain attack hits 187 npm packages

Read the article (bleepingcomputer.com).

This is a different one than last week, or the week before that.

We're getting better and faster at catching these. Although honestly, at some point, we should probably just come to terms that this whole dependency at build/runtime thing is not working out. I'm starting to look forlornly at Golang for new projects just because of its beautiful standard library.

The malware also showed "worm-like" behavior, distributing itself through other packages. From the article:

The malware downloads each package by a maintainer, modifies its package.json, injects a bundle.js script (shown below), repacks the archive, and republishes it, thereby "enabling automatic trojanization of downstream packages," as Socket researchers explained.

So every package that depended on it would also be compromised, I think?. Impressive.

New Phoenix attack bypasses Rowhammer defenses in DDR5 memory

Read the article (bleepingcomputer.com).

Mostly just including this for the one-paragraph explanation of Rowhammer that finally made me understand it:

A Rowhammer attack works by repeatedly accessing specific rows of memory cells at high-speed read/write operations to cause enough electrical interference to alter the value of the nearby bits from one to zero and vice-versa (bit flipping).

Researchers expose MalTerminal, an LLM-enabled malware pioneer

Read the article (securityaffairs.com).

That's right, malware that ships with an LLM model, or uses one through API tokens, to write the real malicious code at runtime.

OpenAI fixes zero-click ShadowLeak vulnerability affecting ChatGPT Deep Research agent

Read the article (therecord.media).

Because of the issue, you could send your victim an email with embedded commands, which ChatGPT would interpret while searching through your inbox to perform a task for you.

Quick links

• Cyberattack on Collins Aerospace disrupted operations at major European airports: link.
• Fortra discloses 10/10 severity bug in GoAnywhere MFT: link.
• Apple backports zero-day patches to older iPhones and iPads: link.
• Microsoft: Office 2016 and Office 2019 reach end of support next month: link.
• BreachForums founder resentenced to three years in prison: link.
• CISA: technical analysis of malware used on Ivanti: link.

That was it for this week! Thank you for reading, and thanks to 1Password for their wonderful support. See you next week!

Hi folks!

I ran out of time this week, so I'm going to be efficient and line up the articles I found most interesting, but didn't have the time to write a summary for. I hope it still helps!

Enjoy!

Dieter

Interesting reads this week:

• Hackers left empty-handed after massive NPM supply-chain attack: link.
• Cursor AI editor lets repos “autorun” malicious code on devices: link.
• DDoS defender targeted in 1.5 Bpps denial-of-service attack: link.
• Microsoft reminds of Windows 10 support ending in 30 days: link.
• CISA pledges robust support for funding, further development of CVE program: link.
• How AI and politics hampered the secure open-source software movement: link.
• ​​DHS watchdog finds mismanagement in CISA's cyber talent program: link.
• U.S. Senator accuses Microsoft of “gross cybersecurity negligence”. (Not sharing this to Microsoft-bash, it actually makes for an interesting discussion of security vs keeping old systems running): link.

That's it! Thank you 1Password for being awesome, thank -you- for reading, and see you next week \o/

Hi folks!

Plenty of news to read through this week, so get a cup of coffee, sit back and have a good one :-)

Cheers,

Dieter

Npm debug and chalk packages compromised

Read the article (aikido.dev)

This story is still developing, but it seems that the owner of the packages got compromised, as they stated personally in this Hackernews thread. A long list of popular packages are affected, with all together about 2 billion downloads per week.

There's more supply-chain attacks (and their fallout) being reported on this week. For the heck of it, I'll line them up here:

• AI-powered malware hit 2,180 GitHub accounts in “s1ngularity” attack: link.
• Hackers steal 3,325 secrets in GhostAction GitHub supply chain attack: link.
• Salesloft platform integration restored after probe reveals monthslong GitHub account compromise: link.

VirusTotal finds hidden malware phishing campaign in SVG files

Read the article (bleepingcomputer.com)

Apparently, one can use SVG files to display HTML and execute Javascript, making it an interesting attack vector for phishers. Virustotal found one such case using their AI powered Code Insight feature, after none of the antivirus vendors detected it. Now that they knew what to look for, they looked back and found 523 more such cases.

How the newest ISAC aims to help food and agriculture firms thwart cyberattacks

Read the article (cybersecuritydive.com)

Interesting read on (the existence of) an ISAC (Information Sharing and Analysis Center) in the US food industry, sharing intel on threats between US food industry companies.

Ukraine’s cyber chief on Russian hackers’ shifting tactics and US cyber aid

Read the article (therecord.media)

High-level read on the state of cyber warfare between Ukraine and Russia, with some interesting nuggets. Like how they are tracking around 80 hacker groups that are actively targeting Ukraine, how Russia is shifting tactics and how cooperation with the US is (fortunately) still ongoing.

The number of mis-issued 1.1.1.1 certificates grows. Here’s the latest.

Read the article (arstechnica.com)

Several unauthorised TLS certificates were issued by a certificate authority called Fina CA, for Cloudflare's 1.1.1.1 IP. According to Fina this was for "internal testing", yet making certificates like that without the permission of the owner of the IP is a big no-no, and can cause huge fallout if those certificates were ever leaked.

The article is a great refresher on our TLS infrastructure, something I'd advise everyone (including myself) to freshen up on once every while.

Microsoft open-sources Bill Gates’ 6502 BASIC from 1978

Read the article (arstechnica.com)

This isn't really about security, but I still got a kick out of it. Especially the note that open-sourcing old code like this is still very important, to help us understand how early computers worked in detail, and how their programmers managed to squeeze a whole lot of functionality out of very limited systems, a skill we are starting to lose. You can go straight to the repository here.

Quick links

• US offers $10 million bounty for info on Russian FSB hackers: link.
• Surge in networks scans targeting Cisco ASA devices raise concerns: link.
• Cloudflare blocks largest recorded DDoS attack peaking at 11.5 Tbps: link.
• Signal adds secure cloud backups to save and restore chats: link.
• Max severity Argo CD API flaw leaks repository credentials: link.
• US court document website PACER buckles under MFA rollout: link.
• CISA orders federal agencies to patch Sitecore zero-day: link.

That was it for this week. As always, thank you 1Password for supporting this newsletter, and helping to keep our passwords safe. See you all next week!

Hi folks,

Good to be here again, thanks for having me and all that :-) Security news time!

Salesforce-Salesloft Drift integration compromised en masse.

Read the article (cyberscoop.com)

If you use Salesforce where you work, definitely investigate if you use Salesloft Drift. I'm not too familiar with the Salesforce ecosystem, but it seems that many companies were impacted, including TransUnion with 4.4 million impacted people and some Google Workspace accounts.

Attackers stole OAuth tokens for Salesloft Drift's AI chat integration with Salesforce, and used those to get access to the actual Salesforce instances, where they executed queries against Salesforce objects, including the Cases, Accounts, Users, and Opportunities tables. Drift Email integrations were also compromised.

Google explicitly advises to "treat every authentication token stored in or connected to the platform as compromised". Salesloft and Salesforce also revoked all Drift-related tokens and removed the app from Salesforce’s AppExchange while investigating further.

Malware devs abuse Anthropic’s Claude AI to build ransomware

Read the article (bleepingcomputer.com)

Anthropic shared a number of incidents where it caught its AI being used for malicious purposes. One of the cases describes someone essentially vibe-coding a ransomware strain and a ransomware-as-a-service module, relying on the AI to provide the more complicated and stealthier techniques. The results were then put on sale on a hacker forum.

Another case describes using Anthropic to analyse ransomware data to help them set a good number for a ransom demand, based on the companies financials that the AI analysed. In another case, someone asked the AI to help write "high emotional intelligence" replies to execute romance scams, and helping out with translations.

Not super surprising, but interesting to see it all lined up like this. Anthropic banned the accounts and is tuning its filters to detect this earlier, but I'm sure it's a game of whack-a-mole.

Google previews cyber ‘disruption unit’ for US gov offensive actions

Read the article (cyberscoop.com).

This definitely raised my eyebrows. It's all a bit vague, but the gist of it seems to be that US private industry might offer offensive cybersecurity services to the US government.

There are a lot of opinions on this, and a lot of murky lines between "active defense" and "hacking back". Considering the current political climate though, I wouldn't be too surprised if this became a thing, similar to what China seems to be doing with their Salt Typhoon efforts.

Quick links

• Anthropic’s auto-clicking AI Chrome extension raises browser-hijacking concerns: link.
• CISA warns of actively exploited Git code execution flaw: link.
• Spanish government cancels €10m contract using Huawei equipment: link.
• Microsoft to enforce MFA for Azure resource management in October: link.

That was it for this week. Thank you for reading, and as always thanks to 1Password for being an awesome password manager and a wonderful sponsor.

Have a good week everyone!

Cheers,

Dieter

This is issue 300. That sort of snuck up on me. I only noticed when I clicked the button :D

Awesome though, right? I'm grateful that you're (still?) here to read it. All ~6,000 of you, plus a few thousand more through RSS from what I can see. I still can't quite fathom that.

I'm also kinda proud of myself for having stuck with something this long, albeit with some breaks.

Don't expect anything special though, it's just the same old cybersecurity news wrap-up ;-)

Enjoy!

Well ok, after I wrote the intro above I decided to actually do change it up a bit.
I'm going to write this one as a continuous piece of markdown/html, and wrap it in the existing newsletter.

It's a first step in the plan to move to a more "elemental" (;-)) approach: plain text or html, no tracking, self-hosted (and secured) mailing list, website and RSS feed. But step by step.

It's also a day late because, well, because I felt like it. To those who told me to do this in a way that feels comfortable to me, instead of pressuring myself for no reason: look, I'm listening! (and thank you ;-) )

(Also because I lost way too much time playing around with a new markdown-based flow. I got tired `¯_(ツ)_/¯)

You can tell though that I enjoyed myself since it's a longer issue than usual. I hope the read is also enjoyable :-) Cheers folks!

News

PyPI now blocks domain resurrection attacks used for hijacking accounts: link.

(bleepingcomputer.com)

Domain resurrection attacks are when someone has an email address tied to a certain domain (like securitynewsletter.co), but that someone lets that domain expire. An attacker can re-register that domain, take ownership of that email address and request a password reset.

From the article:

``` PyPI now checks whether the domains of verified email addresses on the platform have expired or are entering expiration phases, and marks those addresses as unverified.

Once the email addresses enter that state, they cannot be used for password resets or other account recovery actions, thus closing the opportunity window for exploitation even if an attacker registers the domain. ```

Very nice and sensible mitigation if you ask me. Good stuff.

Critical Docker Desktop flaw allows container to compromise the host: link.

(bleepingcomputer.com)

That's less good stuff. Although to be fair, you're taking a risk whenever you pull in a third-party Docker container, so don't pull containers you don't trust. But it's a serious vulnerability.

On Windows, it allows the attacker to mount, read and modify the entire C drive. It's less easy on MacOS because of the extra safeguards when it comes to disk access, but it's still possible. Linux isn't affected. Docker released a fix right away.

Major password managers can leak logins in clickjacking attacks: link.

(bleepingcomputer.com)

It comes down to playing around with pop-ups, opacity settings and such to trigger an unwanted click.

From the article:

``` The main attack mechanic is to run a script on a malicious or compromised website that uses opacity settings, overlays, or pointer-event tricks to hide the autofill dropdown menu of a browser-based password manager.

The attacker then overlays fake intrusive elements (e.g. cookie banners, popups, or CAPTCHA) so that the user’s clicks fall on the hidden password manager controls, resulting in completing the forms with sensitive information. ```

I'm not entirely clear though on how they leak the actual login information. You can trick a user into clicking somewhere, sure, but surely the extension only fills the credentials if the domain matches? Responses from vendors seem to be mixed, with some saying they fixed it, and others accepting clickjacking as essentially a risk they (have to) accept.

Considering what I read and the fact that this didn't blow up the infosec world, I lean towards the latter too.

Okta open-sources catalog of Auth0 rules for threat detection: link.

(bleepingcomputer.com)

Kudos, Okta, that's pretty sweet. It's a set of sigma queries to plow through your Auth0 logs to detect suspicious behaviour, published open-source as a "Customer Detection Catalog". More of this, please.

You can find the repo here. And you can learn more about sigma signatures on Wikipedia. The pdf linked to at "Further reading" looks pretty good.

Developer gets 4 years for activating network “kill switch” to avenge his firing: link.

(arstechnica.com)

Oh boy. From the article:

That "kill switch" was designed to "lock out all users if his credentials in the company’s active directory were disabled," the DOJ said Thursday. And it worked flawlessly, automatically activating when Lu "was placed on leave and asked to surrender his laptop" in 2019. It locked out "thousands of company users globally," and no one had a clue what was going on.

Don't do it folks. We often have a lot of power as engineers, use it responsibly.

CISA updates SBOM recommendations: link.

(cybersecuritydive.com)

CISA has released a new version of their SBOM guidelines.

SBOM stands for Software Bill Of Materials. It's a standardised format that lists all dependencies an application has, with data fields for things like licenses and cryptographic hashes. It's definitely something that is gaining importance, which is fantastic.

It's open for public (US-based?) comments till October 3rd. You can find the document itself here, but don't expect it to be a riveting read by itself.

Quick links

• Orange Belgium discloses data breach impacting 850,000 customers (shout-out to my home country \o/): link.
• FCC removes 1,200 voice providers from telephone networks in major robocall crackdown: link.
• Elastic rejects claims of a zero-day RCE flaw in Defend EDR: link.
• US Senator blasts cybersecurity of federal court, citing 'incompetence' and 'cover-ups of previous incidents': link.
• Oregon man arrested for the "Rapper Bot" ddos botnet: link.
• Apple fixes new zero-day flaw exploited in targeted attacks: link.
• Massive anti-cybercrime operation leads to over 1,200 arrests in Africa: link.

That's it! As always, shout-out to 1Password for being both a kickass password manager, and supporting this newsletter. It wouldn't exist without them.

Till next week!

Dieter

P.S.: Did you notice how I didn't include anything about Microsoft for once? Pretty good of me, right? Nothing they did felt individually more important than the news above. Even though they did have their updates break Windows recovery, cause severe streaming issues, cause SSD failures, all while having problems with Teams, Outlook and office.com and Copilot. In the last week. I'm sure it's fine, don't worry about it.

Hi folks!

Today marks the end of the summer holiday where I live, our kids had to go back to school. Queue the sad trombone, or the Mariachi band, depending on where you stand. Either way, the peace and quiet felt nice :-) Now here's your weekly dose of infosec news. Cheers!

• Cisco discloses maximum-severity defect in firewall software: link.
• Fortinet warns of FortiSIEM pre-auth RCE flaw with exploit in the wild: link.
• Norway police believe pro-Russian hackers were behind April dam sabotage link.
• Microsoft reminds of Windows 10 support ending in two months: link.
• Water sector expands partnership with volunteer hackers: link.
• Black Hat/DEF CON: AI more useful for defense than hacking: link.
• Booking.com phishing campaign uses sneaky 'ん' character to trick you: link.

Hi folks,

It's a quick one today! It's still summer vacation, lot's of parenting to do :D

Cheers!

Dieter

• Proton fixes Authenticator bug leaking TOTP secrets in logs: link.
• Google suffers data breach in ongoing Salesforce data theft attacks: link.
• New Plague Linux malware stealthily maintains SSH access: link.
• Cisco discloses data breach impacting Cisco.com user accounts: link.
• Encryption made for police and military radios may be easily cracked: link.

Hi everyone!

I'm trying out Mondays for writing the newsletter, it seems to fit better in my current life flow.

Also, I'm happy to hear that I wasn't to only one upset with the Microsoft story last week, thanks for providing me with shared catharsis :-)

Enjoy the read folks!

Cheers,

Dieter

• Russian airline Aeroflot deeply compromised: link.
• Proton launches free standalone cross-platform authenticator app: link.
• Pwn2own hacking contest to pay 1 million for Whatsapp exploit: link.
• Pi-hole discloses data breach via givewp wordpress plugin flaw: link.
• Minnesota governor activates National Guard after St. Paul cyber-attack: link.

Hi everyone,

Thank you for the very kind messages, it's good to be back.

This week's issue is fairly Microsoft themed. And after summarizing the outsourcing-to-China story I got so worked up that I had to take a break. I guess I'm not as jaded to security news as I sometimes fear, after years of being in this line of work. That's a relief actually :D

Enjoy the read and mind your blood pressure when you do so ;-)

Cheers folks,

Dieter

• UK backing down on Apple encryption backdoor after pressure from US: link.
• After brief delay, Trump’s CISA nominee sails through Senate hearing: link.
• Ukraine arrests suspected admin of XSS Russian hacking forum: link.
• Over 1,000 CrushFTP servers exposed to ongoing hijack attacks: link.

There were quite a few supply chain issues this week. I might as well group them together for the occasion:

• Hackers breach Toptal GitHub account, publish malicious npm packages: link.
• NPM package ‘is’ with 2.8M weekly downloads infected devs with malware: link.
• Arch Linux pulls AUR packages that installed Chaos RAT malware: link.
• Hacker sneaks infostealer malware into early access Steam game: link.

Hi folks! I'm back!

The break took a bit longer than expected, it was an intense few months.

In short (takes deep breath): we moved house, I burned out, found myself in a dark place of anxiety and depression, found help, got through it thanks to the incredible people around me, went back to working for myself, immediately found work, settled in to the new house much smoother than we thought, went back to working from home on my own schedule, and am now enjoying life more than ever.

It has been quite the ride. But looking back, it all needed to happen, and I am in a much better place now than I've been in years. I've learned a lot about myself, and look forward to learning more.

So, after some recharging I'm picking up the newsletter again. Did I miss much? ;-)

As always, I hope you get value out of this issue and the upcoming ones.

Thank you for your patience! Cheers!

• North Korean XORIndex malware hidden in 67 malicious npm packages: link
• UK launches vulnerability research program for external experts: link.
• Max severity Cisco ISE bug allows pre-auth command execution: link
• Chinese hackers breached National Guard to steal network configurations: link
• Ukrainian hackers cripple IT infrastructure of Russian drone manufacturer: link

Hi folks.

I hope the week's email finds you well! :-) There's some valuable lessons on Github Actions, and an eye-watering $32B acquisition by Google. I hope you enjoy the read!

I'll be pausing the newsletter for about two months. There's a big maintenance window coming up at the powerplant where I work, which requires all hands on deck, and after that we're moving house. When all that is done, I'll be back :-) Cheers!

A re-usable Github action building block, 'tj-actions/changed-files', which is used by 23,000 repositories, was hijacked. The attackers injected code that dumped CI secrets as a readable file in the affected Github repository. The impact is somewhat limited though, with "only" 218 repositories actually ending up exposing secrets.

If you use Github actions yourself it's a very worthwhile read to extract some lessons from. Like for example not pinning your actions to certain versions, because those can still be changed. Instead it is recommended to pin them to specific commit hashes.

Three articles that explain it well, in chronological order:

• Supply chain attack on popular GitHub Action exposes CI/CD secrets: link.
• GitHub Action hack likely led to another in cascading supply chain attack: link.
• GitHub Action supply chain attack exposed secrets in 218 repos: link.

• New Windows zero-day exploited by 11 state hacking groups since 2017: link.
• Sperm donation giant California Cryobank warns of a data breach: link.
• Veeam RCE bug lets domain users hack backup servers, patch now: link.
• Critical RCE flaw in Apache Tomcat actively exploited in attacks: link.
• GitLab patches critical authentication bypass vulnerabilities: link.

Hi friends,

Here's this week's attempt to keep up with security news! :-) Enjoy the read and have a good end of the week!

Cheers,

• Texas border city declares state of emergency after cyberattack on government systems: link.
• US govt says Americans lost record $12.5 billion to fraud in 2024: link.
• Google paid $12 million in bug bounties last year to security researchers: link.
• Trump nominates Plankey to lead CISA: link.
• New Chirp tool uses audio tones to transfer data between devices: link.

Hi folks,

Some interesting stuff this week. The VMware vulnerabilities are a must to look at, if you run VMware in your stack. Also some conflicting reports on whether Russia gets a "free pass" in cyberspace by the US, but that seems to be overblown. All in all, just the world being the world as usual :-)

I hope you find some peace and quiet time away from all of that this weekend. I am going to try just that by having a nice, sunny citytrip, mostly offline, with friends :-)

Have a good one folks, cheers!

• Over 49,000 misconfigured building access systems exposed online: link.
• Nearly 12,000 API keys and passwords found in AI training dataset: link.
• House passes bill requiring federal contractors to have vulnerability disclosure policies: link.
• Google fixes Android zero-day exploited by Serbian authorities: link.

Howdy everyone,

Here's this week's wrap-up of security news. Nothing major, I'd say, except for the UK iCloud decryption thing pissing me off, but it did give me comfort to know that even top ransomware groups have issues with their security sometimes. Keep your employees happy folks! :-)

Have a good read and a wonderful weekend!

• US drug testing firm DISA says data breach impacts 3.3 million people: link.
• Apple pulls iCloud end-to-end encryption feature in the UK: link.
• Have I Been Pwned adds 284M accounts stolen by infostealer malware: link.
• Australia bans all Kaspersky products on government systems: link.
• CISA taps Karen Evans as executive assistant director for cybersecurity: link.

Hi folks,

Another week, another wrap-up. I know, the week isn't quite over yet, but the timing works out better for me right now to do this on a Thursday :-) Enjoy the read, and have a good end of the week!

Cheers,

• PostgreSQL flaw exploited as zero-day in BeyondTrust breach: link.
• PirateFi game on Steam caught installing password-stealing malware: link.
• Australian fertility services giant Genea hit by security breach: link.
• What is device code phishing, and why are Russian spies so successful at it : link.
• Microsoft warns that the powerful XCSSET macOS malware is back with new tricks: link.

Hi folks,

I hope you're all having a great Friday! And are looking forward to a great weekend :-)

It's busy-busy on my end, we're working on moving house and good gawd that's a lot of work. But it's always nice to sit back and read through the latest news, and see what jumps out to me. Here's hoping you enjoy the result :-)

Have a good one!

• US health system notifies 882,000 patients of August 2023 breach: link.
• Salt Typhoon remains active, hits more telecom networks via Cisco routers: link.
• Microsoft February 2025 Patch Tuesday fixes 4 zero-days, 55 flaws: link.
• Dutch Police seizes 127 XHost servers, dismantles bulletproof hoster: link.
• Trump picks Sean Cairncross for national cyber director: link.

Hi folks,

I hope you're all doing well! This one is a day early, which seems to line up better with my schedule so it might happen more often.

Nothing major this week that I could see, so I was able to focus on a few smaller items that I found interesting, like the 7-zip zero day and a Go module supply chain attack. I hope you get value from reading through this :-) Cheers!

• US healthcare provider data breach impacts 1 million patients: link.
• House Democrats demand answers over DOGE OPM server: link.
• Thailand cuts power supply to Myanmar scam hubs: link.
• Deloitte pays $5M in connection with breach of Rhode Island benefits site: link.
• Sophos completes $859M acquisition of Secureworks: link.

Hi folks,

Thanks for the feedback that was given after last week's question on the format. It wasn't unanimous but most people seem to prefer the shorter version, and so do I, so for now I'm going with that. I'll aim for about 10 items each week.

Thanks!

• Data breach hitting PowerSchool looks very, very bad: link.
• UnitedHealth now says 190 million impacted by 2024 data breach: link.
• FBI seizes Cracked.io, Nulled.to hacking forums in Operation Talent: link.
• Trump pauses on grants and aid leaves federal cyber programs in state of confusion: link.
• Laravel admin package Voyager vulnerable to one-click RCE flaw: link.

Hi folks,

I hope you're doing well. I got some feedback to ask for. I'm thinking of simplifying the newsletter, I feel like I let it grow from something that gave a brief overview to something that's a chore to catch up on, especially with the long lists of breaches and issues.

Granted, there is a lot more news now than when I started this back in 2016, but all the more reason to make sure I save you time.

I'm thinking a maximum of 5 summarized articles and 5 quick links, breaches and issues included. Enough to make sure you've gotten the most important items of the week, with some interesting extras if there is room. I'm giving it a try this week, let me know what you think.

Thanks!

• Cisco warns of denial of service flaw in ClamAV with PoC exploit code: link.
• Google Cloud links poor credentials to nearly half of all cloud-based attacks: link.
  
• Trump pardons Silk Road founder Ross Ulbricht: link.
  
• BreachForums founder to be resentenced after court vacates previous punishment: link.
  

Hi folks!

Nothing much to share this week, except that I hope you enjoy the read :-)

Cheers!

• New UEFI Secure Boot flaw exposes systems to bootkits: link.
• CISA director says threat hunters spotted Salt Typhoon on federal networks before telco compromises: link.
• DOJ deletes China-linked PlugX malware off more than 4,200 US computers: link.
• US issues rule barring some Chinese and Russian connected car tech: link.

• Hackers leak configs and VPN credentials for 15,000 FortiGate devices: link.
• OneBlood confirms personal data stolen in July ransomware attack: link.
• Russia's largest platform for state procurement hit by cyberattack from pro-Ukraine group: link.
• STIIIZY data breach exposes cannabis buyers’ IDs and purchases: link.
• UK domain registry Nominet confirms breach via Ivanti zero-day: link.
• Stolen Path of Exile 2 admin account used to hack player accounts: link.
• Label giant Avery says website hacked to steal credit cards: link.
• Wolf Haldenstein law firm says 3.5 million impacted by data breach: link.
• Biotech firm settles class action lawsuit over ransomware attack for $7.5 million: link.

• Fortinet warns of auth bypass zero-day exploited to hijack firewalls: link.
• Microsoft January 2025 Patch Tuesday fixes 8 zero-days, 159 flaws: link.
• Over 660,000 Rsync servers exposed to code execution attacks: link.
• SAP fixes critical vulnerabilities in NetWeaver application servers: link.
• W3 Total Cache plugin flaw exposes 1 million WordPress sites to attacks: link.
• Docker Desktop blocked on Macs due to false malware alert: link.
• Hackers exploit critical Aviatrix Controller RCE flaw in attacks: link.
• Microsoft to force install new Outlook on Windows 10 PCs in February. I can't in good conscience state that this is a security issue, but I'm including it anyway. link.

Hi friends,

We're a bit heavy on breaches and issues this week, I hope you can gently read through the list without having it ruin your day.

Also, if you're like me and you find yourself excited for the launch of ... a cybersecurity consumer label, congratulations, you're old and boring like me. Let's make t-shirts.

Enjoy the read folks ;-)

Cheers,

• Chinese hackers also breached Charter and Windstream networks: link.
• US sanctions prominent Chinese cyber company for role in Flax Typhoon attacks: link.
• National cyber director calls for deterrence against China-affiliated cyber threats: link.

• UN aviation agency confirms recruitment database security breach: link.
• Largest US addiction treatment provider notifies patients of data breach: link.
• Massive breach at location data seller: "Millions" of users affected: link.
• Hackers claim to breach Russian state agency managing property, land records: link.
• Some Winston-Salem city services knocked offline by cyberattack: link.
• Education software firm’s hack exposes personal data for students, teachers nationwide: link.
• School districts in Maine, Tennessee respond to holiday cyberattacks: link.
• French govt contractor Atos denies Space Bears ransomware attack claims: link.
• Casio says data of 8,500 people exposed in October ransomware attack: link.
• Data of more than 8,500 customers breached on Green Bay Packers shopping website: link.
• Washington state sues T-Mobile over 2021 data breach security failures: link.
• Cryptocurrency wallet drainers stole $494 million in 2024: link.

• Bad Tenable plugin updates take down Nessus agents worldwide: link.
• Nuclei flaw lets malicious templates bypass signature verification: link.
• Vulnerable Moxa devices expose industrial networks to attacks: link.
• Malicious npm packages target Ethereum developers' private keys: link.
• CISA warns of critical Oracle, Mitel flaws exploited in attacks: link.
• SonicWall urges admins to patch exploitable SSLVPN bug immediately: link.
• Ivanti warns of new Connect Secure flaw used in zero-day attacks: link.
• Unpatched critical flaws impact Fancy Product Designer WordPress plugin: link.
• Hackers exploit KerioControl firewall flaw to steal admin CSRF tokens: link.

Hi folks,

Nothing major this week, except for a continued set of breaches by Chinese state hackers. Nine US telecoms breached in total now, dozens of telecoms in other countries, and the US bureau for economic sanctions as well. The digital battles continue!

There's quite a few other interesting reads that I wanted to share too of course. Enjoy!

• Customer data from 800,000 electric cars and owners exposed online: link.
• Hackers steal ZAGG customers' credit cards in third-party breach: link.
• Hackers leaked data from Rhode Island ransomware attack: link.

• Hackers exploit DoS flaw to disable Palo Alto Networks firewalls: link.
• Thousands of industrial routers vulnerable to command injection flaw: link.

Hi folks,

I hope you're all enjoying the lethargy that comes after lot's of food and lot's of family.

It's a rather quiet newsweek, for obvious reasons, so I'm keeping it short. I just want to make sure you didn't miss anything big during the holidays. Fortunately, nothing big seems to have broken out. Yet. Tam-tam-taaaam.

Ahum. On to the newsletter. Enjoy :-)

• $3 billion towards US ‘rip and replace’ of Chinese tech: link.
• UN General Assembly approves cybercrime treaty despite industry backlash: link.
• US charges Russian-Israeli as suspected LockBit ransomware coder: link.

• Health care giant Ascension says 5.6 million patients affected in cyberattack: link.
• Nearly half a million people had data stolen after cyberattack on American Addiction Centers: link.
• Cyberattack on Ukraine’s state registers disrupts marriage registration, real estate deals: link.
• Defense giant General Dynamics says employees targeted in phishing attack: link.
• Japan Airlines resumes operations after cyberattack delays flights: link.
• FBI links North Korean hackers to $308 million crypto heist: link.
• European Space Agency's official store hacked to steal payment cards: link.
• FTC orders Marriott and Starwood to implement strict data security: link.
• Flagstar fined $3.5M for ‘misleading’ after 2021 cyberattack: link.

• Sophos discloses critical Firewall remote code execution flaw: link.
• Apache fixes remote code execution bypass in Tomcat web server: link.
• Researchers warn of active exploitation of critical Apache Struts 2 flaw: link.
• Apache warns of critical flaws in MINA, HugeGraph, Traffic Control: link.
• Premium WPLMS WordPress plugins address seven critical flaws: link.
• Adobe warns of critical ColdFusion bug with PoC exploit code: link.

Hi folks,

I hope this particular newsletter finds you well :-) My last exam was a success, I made it through the gaunlet, and now I can focus on regular work again! Just in time for the holidays ^^

This week is a doozy, lot's of interesting articles to share, but I've tried to keep it as short as possible. It feels like most reporters and researchers are pushing stuff out the door before a two-week vacation :-)

Enjoy the read, and enjoy the upcoming holidays!

Cheers,

• DOJ indicts 14 North Koreans who fraudulently earned $88 million working for US firms: link.
• CISA urges switch to Signal-like encrypted messaging apps after telecom hacks: link.
• Kali Linux 2024.4 released with 14 new tools, deprecates some features: link.

• Texas Tech University System data breach impacts 1.4 million patients: link.
• ConnectOnCall breach exposes health data of over 910,000 patients: link.
• Rhode Island governor warns residents of cyberattack on state benefits system: link.
• Namibia’s state telecom provider says hackers leaked data after it refused to pay ransom: link.
• Auto parts giant LKQ says cyberattack disrupted Canadian business unit: link.
• Japanese game and anime publisher reportedly pays $3 million ransom to Russia-linked hackers: link.
• South Carolina credit union says 240,000 impacted by recent cyberattack: link.
• Ireland fines Meta $264 million over 2018 Facebook data breach: link.
• BeyondTrust says hackers breached Remote Support SaaS instances: link.
• Chainalysis: $2.2 billion stolen from crypto platforms in 2024 cyberattacks: link.

Maybe a fun section to include once every while :-)

• Raccoon Stealer malware operator gets 5 years in prison after guilty plea: link.
• Romanian Netwalker ransomware affiliate sentenced to 20 years in prison: link.

• Fortinet warns of FortiWLM bug giving hackers admin privileges: link.
• Citrix shares mitigations for ongoing Netscaler password spray attacks: link.
• Windows kernel bug now exploited in attacks to gain SYSTEM privileges: link.
• Over 25,000 SonicWall VPN Firewalls exposed to critical flaws: link.
• New critical Apache Struts flaw exploited to find vulnerable servers: link.
• Cleo urges customers to ‘immediately’ apply new patch as researchers discover new malware: link.

Hi folks,

Greetings from a rather bleek autumn day in The Netherlands! I hope you get to read this while drinking a nice cup of warm tea, tonight or tomorrow.

We're a day early, I got some other work lined up for tomorrow (including studying for a re-exam, damned). But first I'm catching up with a friend tonight, and then catching up with a re-run of The Expanse :-)

Enjoy the read!

• AMD’s trusted execution environment blown wide open by new BadRAM attack: link.
• Chinese hackers use Visual Studio Code tunnels for remote access: link.
• SEC cyber incident reporting rule generates 71 filings in 11 months: link.

• Anna Jaques Hospital ransomware breach exposed data of 300K patients: link.
• US subsidiary of global water treatment firm investigating cyberattack: link.
• Ransomware attack hits leading heart surgery device maker: link.
• Romanian energy supplier Electrica hit by ransomware attack: link.
• Krispy Kreme online ordering disrupted by cyberattack: link.
• Blue Yonder SaaS giant breached by Termite ransomware gang: link.
• Ultralytics AI model hijacked to infect thousands with cryptominer: link.
• Bitcoin ATM firm Byte Federal hacked via GitLab flaw, 58K users exposed: link.

• Microsoft December 2024 Patch Tuesday fixes 1 exploited zero-day, 71 flaws: link.
• New Windows zero-day exposes NTLM credentials, gets unofficial patch: link.
• Critical flaw in Cleo file-transfer software is under mass exploitation: link.
• OpenWrt Sysupgrade flaw let hackers push malicious firmware images: link.
• Ivanti warns of maximum severity CSA auth bypass vulnerability: link.
• WPForms bug allows Stripe refunds on millions of WordPress sites: link.

Hi folks,

I hope you're doing well. We've got a nice balance of interesting articles and plenty of breaches this week :-) Enjoy the read!

Cheers,

• New Windows Server 2012 zero-day gets free, unofficial patches: link.
• BootKitty UEFI malware exploits LogoFAIL to infect Linux systems: link.
• Police seize Matrix encrypted chat service after spying on criminals: link.
• Microsoft reiterates “non-negotiable” TPM 2.0 requirement for Windows 11: link.
• UN, international orgs create advisory body for submarine cables after incidents: link.

• Romania's election systems targeted in over 85,000 cyberattacks: link.
• Costa Rica state energy company calls in US experts to help with ransomware attack: link.
• Hoboken government recovering from ransomware attack as Conti-linked gang takes credit: link.
• Bologna FC confirms data breach after RansomHub ransomware attack: link.
• Vodka maker Stoli files for bankruptcy in US after ransomware attack: link.
• BT unit took servers offline after Black Basta ransomware breach: link.
• U.S. org suffered four month intrusion by Chinese hackers: link.
• Japanese crypto service shuts down after theft of bitcoin worth $308 million: link.
• Solana Web3.js library backdoored to steal secret, private keys: link.

• Veeam warns of critical RCE bug in Service Provider Console: link.
• Exploit released for critical WhatsUp Gold RCE flaw, patch now: link.
• Japan warns of IO-Data zero-day router flaws exploited in attacks: link.
• Mitel MiCollab zero-day flaw gets proof-of-concept exploit: link.
• CISA and German cyber authorities warn Zyxel firewalls facing active exploitation: link.

Hello friends,

I'm finally on the other side of the study mountain and it feels GOOD. I was actually able to sit back and take my time to read security news properly today, which also felt good. Looking forward to getting back in to the routine. Thanks for bearing with me everyone.

Enjoy this week's issue!

Cheers,

• Microsoft testing Windows 11 support for third-party passkeys: link.
• Incident response diplomacy: UK to launch new capability to help attacked allies: link.
• Over 1,000 arrested in massive ‘Serengeti’ anti-cybercrime operation: link.
• CrowdStrike avoids customer exodus after triggering global IT outage: link.

• UK hospital network postpones procedures after cyberattack: link.
• Medical testing company LifeLabs failed to protect customer data, report finds: link.
• Starbucks confirms Blue Yonder attack impacted employee scheduling platform: link.
• New York fines Geico and Travelers $11.3M for pandemic-era breaches: link.
• "Hilariously insecure": Andrew Tate's The Real World breached, 800,000 users affected: link.
• Data broker exposes 600,000 sensitive files including background checks: link.
• Hoboken closes city hall, local courts after pre-Thanksgiving ransomware attack: link.
• Zello asks users to reset passwords after security incident: link.

• QNAP addresses critical flaws across NAS, router software: link.
• Hackers exploit critical bug in Array Networks SSL VPN products: link.
• Cloudflare says it lost 55% of logs pushed to customers for 3.5 hours: link.
• Hackers exploit ProjectSend flaw to backdoor exposed servers: link.

Hi folks!

A day late, since yesterday was exam time. I think it went well! I'm glad it's over though. Now it's time to focus on family, relaxation, and then get back to the normal work routine :-) But first, a short digest of this week's news! Have a good one!

• MITRE shares 2024's top 25 most dangerous software weaknesses: link.
• Chinese hackers target Linux with new WolfsBane malware: link.
• Microsoft launches Zero Day Quest hacking event with $4 million in rewards: link.
• GitHub projects targeted with malicious commits to frame researcher: link.
• CISOs can now obtain professional liability insurance: link.

• Cyberattack at French hospital exposes health data of 750,000 patients: link.
• T-Mobile confirms it was hacked in recent wave of telecom breaches: link.
• US space tech giant Maxar discloses employee data breach: link.
• Fintech giant Finastra investigates data breach after SFTP hack: link.
• Gambling and lottery giant disrupted by cyberattack: link.
• AI company tells SEC that $250,000 stolen in cyberattack: link.

• Apple fixes two zero-days used in attacks on Intel-based Macs: link.
• Ubuntu Linux impacted by decade-old 'needrestart' flaw that gives root: link.
• Critical RCE bug in VMware vCenter Server now exploited in attacks: link.
• Palo Alto Networks patches two firewall zero-days used in attacks: link.
• Over 2,000 Palo Alto firewalls hacked using recently patched bugs: link.
• Chinese hackers exploit Fortinet VPN zero-day to steal credentials: link.
• Fortinet VPN design flaw hides successful brute-force attacks: link.
• Oracle warns of Agile PLM file disclosure flaw exploited in attacks: link.
• Security plugin flaw in millions of WordPress sites gives admin access: link.