Major Incidents or Breaches

  • A supply-chain attack has compromised Android-based car head units by leveraging a legitimate device-update application to distribute malware. The infected devices are conscripted into a proxy botnet or used for ad fraud operations [2].

Newly Discovered Vulnerabilities

  • Weak access controls on Windows named pipes have been highlighted as a security risk, with the potential for untrusted processes to access privileged services if proper endpoint verification and command authentication are not enforced [3].

Notable Threat Actor Activity

  • Active campaigns involving banking trojans have been observed, including the spyware-equipped Manic trojan, a persistent Grandoreiro campaign targeting Latin America and Europe, and an expanded deployment of ToxicPanda 2.0 malware [5].

Regulatory or Policy Developments Affecting the Security Industry

  • TikTok has agreed to pay a $400 million settlement to resolve a US Department of Justice lawsuit alleging violations of child privacy laws in the United States [1].

Sources#

  1. Hackers infect Android car head units with proxy botnet malware - bleepingcomputer.com
  2. Named Pipes Under Attack: Securing Windows Interprocess Communication - bleepingcomputer.com
  3. Banking Trojans Manic, Grandoreiro, ToxicPanda 2.0 in the Spotlight - securityweek.com
  4. TikTok Agrees to $400 Million Settlement in U.S. Child Privacy Lawsuit - thehackernews.com