Monday 19 May 2025

Major Incidents or Breaches

• TeleMessage, a messaging app marketed as a secure Signal alternative and reportedly used by at least one Trump administration official, suffered a breach earlier this month. An attacker exploited a basic misconfiguration to compromise the platform in under 20 minutes.

Newly Discovered Vulnerabilities

• The TeleMessage breach highlights the risk of security misconfigurations in enterprise communication platforms, particularly those marketed for secure or government use.

Notable Threat Actor Activity

• Recent malware campaigns have been observed deploying Remote Access Trojans (RATs) via two layers of AutoIT code. This approach demonstrates continued threat actor interest in leveraging AutoIT’s scripting capabilities to evade detection and interact with Windows environments.

Trends, Tools, or Tactics of Interest

• The use of AutoIT as both an obfuscation and deployment mechanism for RATs remains prevalent. Threat actors are increasingly layering AutoIT scripts to bypass security controls and increase persistence on targeted systems.