TLDR Information Security 2025-11-04

When your CEO calls, will you know it's real? (Sponsor)

Phishing has gone beyond email. Today's attackers use AI-generated voices, videos, and interactive deepfakes of company executives. They can fool almost anyone - including you and your coworkers.

Backed by $55M+ in funding from OpenAI and a16z, Adaptive Security is the first security awareness platform built to stop AI-powered social engineering. Adaptive keeps employees on their feet with tools such as:

Deepfake phishing simulations of company executives in real-world attack scenarios
Interactive, customizable training content tailored for each employee (500+ resources)
AI-driven risk scoring that factors in your publicly available data adversaries can exploit

>> Book a demo to chat with a custom interactive deepfake of your boss

>> Take a self-guided tour of the platform (3 minutes)

🔓

Attacks & Vulnerabilities

Poland Hit By Another Major Cyberattack As Hackers Steal Users' Data From Loan Platform (2 minute read)

Polish authorities are investigating a large-scale cyberattack that compromised personal data belonging to clients of the SuperGrosz online loan platform. Poland's Deputy Prime Minister Gawkowski reported that the attackers stole names, national identification numbers, ID card details, email and home addresses, phone numbers, nationality, bank account numbers, and other sensitive personal information. Affected users are advised to exercise caution, change passwords, enable 2FA, and use the government's mobile app to block their national identification number.

CISA: High-Severity Linux Flaw Now Exploited By Ransomware Gangs (2 minute read)

CISA has added a 2024 use-after-free vulnerability to the known exploited vulnerabilities (KEV) list after it was observed being exploited by ransomware gangs. The vulnerability results from a decade-old flaw in the netfilter:nf_tables kernel component and can be abused by local attackers to escalate privileges to root.

Android Apps misusing NFC and HCE to steal payment data on the rise (2 minute read)

Zimperium researchers discovered over 760 malicious Android apps exploiting Near-Field Communication (NFC) and Host Card Emulation (HCE) to steal payment data through NFC relay attacks, showing dramatic growth since April 2024. These apps impersonate trusted financial institutions and trick users into setting them as default NFC payment handlers, then use command-and-control servers to relay card terminal requests and exfiltrate EMV data to Telegram channels. The campaign has targeted over 20 institutions globally using 70+ C2 servers, primarily focusing on Russian banks but also affecting European banks, Brazilian institutions, and services like Google Pay.

🧠

Strategies & Tactics

You'll never see attrition referenced in an RCA (2 minute read)

Public incident reports intentionally omit staff attrition as a contributing factor to reassure customers that issues are being resolved, since mentioning workforce issues could undermine confidence and create liability. Internal analyses also rarely consider attrition, focusing instead on technical details rather than organizational factors that increase system vulnerability. Attrition is like smoking and lung cancer - it's a risk factor that heightens the likelihood of failures without being necessary or sufficient on its own.

MOSIP on AWS: Technical deep dive exploring architecture, implementation, and deployment models (8 minute read)

AWS and Atos developed a cloud-based digital identity platform using MOSIP, addressing security challenges with multi-layered defenses like AWS Shield, WAF, CloudFront, segmented VPCs, and dedicated CloudHSM. It offers four hybrid deployment models for data sovereignty, from fully cloud to on-premises, with security controls such as data encryption, role-based access via OAuth2, and monitoring through GuardDuty and CloudWatch. Security teams should evaluate hybrid cloud architectures for sensitive government systems, implement defense-in-depth with hardware security modules, and use Infrastructure-as-Code for consistent security controls.

Can't Hide in 3D (10 minute read)

Time-Terrain-Behavior (TTB) mapping can be used to transform logs and security events into a 3D landscape to create a visual threat landscape. The x-axis is set as the terrain layer and measures how many different tools detected an entity, the y-axis measures how many different time periods an entity was active in, and the z-axis measures how many different actions an entity performs. This post works through applying this methodology to the Splunk BOTS v2 scenario.

🧑‍💻

Launches & Tools

How to secure on-device AI workloads (Sponsor)

AI is transforming productivity—but it's also expanding the attack surface. Learn how to build a resilient endpoint strategy that supports on-device AI innovation without compromising data integrity. Develop and deploy AI models on a secure, modern foundation with the latest Dell and Intel AI PCs. Get the eBook: Endpoint Security for AI

Orsted C2 (GitHub Repo)

Orsted is a C2 framework that consists of multiple beacons that can communicate with each other and the main Orsted server.

Using Ghidra to patch my keyboard's firmware (16 minute read)

In this post, a researcher demonstrates firmware reverse engineering on the Epomaker Galaxy100 keyboard using Ghidra to bypass VIA configuration limitations and modify key mappings. The technical approach involved extracting firmware via DFU mode (Fn+L+Esc), setting up proper memory mapping in Ghidra for ARM Cortex-M3 architecture, locating USB HID keycode tables through pattern matching, and directly patching binary offsets to swap function key layers. Security professionals can apply these techniques for embedded device analysis, firmware modification workflows, and understanding how consumer hardware implements bootloader protections and keycode handling mechanisms.

Reflectiz (Product Launch)

Reflectiz provides an agentless web exposure management platform that detects third-party tools and code risks, de-obfuscates suspicious JavaScript, and gives organizations centralized visibility and control over website activity and security compliance.

🎁

Miscellaneous

China-linked hackers exploited Lanscope flaw as a zero-day in attacks (2 minute read)

Chinese cyber-espionage group Bronze Butler (Tick) exploited CVE-2025-61932, a critical request origin verification flaw in Motex Lanscope Endpoint Manager versions 9.4.7.2 and earlier, as a zero-day vulnerability for several months before it was patched in October. The attackers exploited this vulnerability to achieve unauthenticated remote code execution with SYSTEM privileges, deploying an updated Gokcpdoor malware variant that features multiplexed command-and-control communication and DLL sideloading for evasion, along with tools such as goddi Active Directory dumper and 7-Zip for data exfiltration to cloud storage services. Organizations using Lanscope Endpoint Manager must immediately upgrade to patched versions, as no workarounds exist, while security teams should monitor for indicators of Bronze Butler activity, including Gokcpdoor malware, OAED Loader, and connections to ports 38000/38002.

Alleged U Penn hacker claims they're in it for money, not 'primarily "anti-DEI"' (2 minute read)

Hackers breached the University of Pennsylvania's systems, aiming to sell roughly 1.2 million lines of personal donor data. Unlike previous university hacks tied to diversity debates, this attack focused on financial gain, not ideology. U Penn is investigating and has involved the FBI as affected individuals have confirmed their stolen data.

Metropolitan Police hails facial recognition tech after record year for arrests (3 minute read)

London's Metropolitan Police credits live facial recognition technology with enabling 962 arrests over the past year. While officials cite improved public safety and broad support, privacy advocates raise concerns about racial bias, noting 80 percent of false alerts involved Black individuals. The report claims these disparities are not statistically significant, yet critics argue for better oversight and legal safeguards to protect civil rights.

⚡

Quick Links

Here's what 400+ IT leaders think about AI adoption, orchestration, and governance (Sponsor)

Tines commissioned Forrester to ask 400+ IT leaders about their biggest AI challenges. The results show where AI adoption stalls, why orchestration unlocks value, and how IT is primed to lead. Read the full study.

Claude AI APIs Can Be Abused for Data Exfiltration (2 minute read)

Attackers can exploit Anthropic's Claude AI APIs using indirect prompt injections to extract user data.

Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks (3 minute read)

Threat actors are collaborating with organized crime groups to deploy legitimate RMM tools like ScreenConnect and SimpleHelp through spear-phishing and fraudulent freight listings to gain network access at logistics companies, enabling them to manipulate dispatch systems and steal physical cargo shipments, primarily food and beverage products.

Alleged Jabber Zeus Coder 'MrICQ' in US Custody (5 minute read)

Ukrainian cybercriminal Yuriy Igorevich Rybtsov, known as "MrICQ," was extradited from Italy to face charges for developing the Jabber Zeus banking trojan, which used man-in-the-browser attacks and real-time one-time password interception to steal tens of millions from US businesses through payroll manipulation and money mule networks.

Love TLDR? Tell your friends and get rewards!

Share your referral link below with friends to get free TLDR swag!

https://refer.tldr.tech/03c142dc/8

Track your referrals here.

Want to advertise in TLDR? 📰

If your company is interested in reaching an audience of cybersecurity professionals and decision makers, you may want to advertise with us.

Want to work at TLDR? 💼

Apply here or send a friend's resume to jobs@tldr.tech and get $1k if we hire them!

If you have any comments or feedback, just respond to this email!

Thanks for reading,
Prasanna Gautam, Eric Fernandez & Sammy Tbeile

Manage your subscriptions to our other newsletters on tech, startups, and programming. Or if TLDR Information Security isn't for you, please unsubscribe.