[Sentinel] #5 - Qantas Cyberattack: 6M Customer Records Exposed!

🛡️ IN TODAY’S EDITION

• 🧨 1. Breach of the Week

• 🧠 2. AI Threats Are Getting Deadlier

• 🔒 3. Protocol News: Protocol Flaws Compromised

• 📡 4. Attack Surface: Cloud Security in 2025

• 🔓 5. Free Resources for You

  • 👉 For Now, One Quick Question

🧨 1. Breach of the Week

🧠 2. AI Threats Are Getting Deadlier

A new breed of AI-powered malware is evading detection at unprecedented scale. Criminals are now leveraging LLMs to generate over 10,000 malware variants automatically, each designed to bypass traditional signature-based defenses.

💡GhostGPT-style attacks are using AI to craft hyper-personalized phishing campaigns, resulting in a staggering 442% increase in voice phishing attacks.

📉 Traditional antivirus solutions relying on static detection are falling behind as adversaries deploy "Policy Puppetry" attacks that bypass AI safety guardrails across all major models.

📍Takeaway: AI-assisted threats demand AI-assisted defenses—security teams must evolve faster than the threats themselves.

🔒 3. Protocol News: Protocol Flaws Compromised

Protocol exploitation is surging, with attackers leveraging subtle abuse for devastating impact. The CVE-2025-32433 flaw in Erlang/OTP’s SSH allows unauthenticated remote code execution, bypassing all login controls to hijack critical infrastructure, IoT, and telecom systems.

But it’s not just SSH. Legacy protocols and outdated authentication logic are being targeted at scale:

• NTLM relay and hash-leak attacks (see CVE-2025-24054) are still rampant, letting attackers steal credentials and move laterally inside networks with minimal user interaction.

• Authentication bypasses like CVE-2025-21396 in Microsoft’s account systems allow spoofing and unauthorized access by exploiting weak validation in protocol design—often using IP or DNS spoofing to trick trust boundaries.

• Certificate-based login flaws on Linux (PAM-PKCS#11) have enabled attackers to bypass authentication entirely by abusing default settings, logging in as users without ever possessing their private keys.

Lesson: Protocols are a favorite playground for attackers, not just because of code bugs, but because design assumptions get outdated. Harden protocol configurations, patch aggressively, and don’t assume “secure by default” means secure forever.

📡 4. Attack Surface: Cloud Security in 2025

Cloud security is rapidly evolving to meet growing threats against sprawling, complex environments. In 2025, cloud and SOC teams are merging, integrating threat detection and response for faster, coordinated defense.

Key trends:

• Enhanced tools from AWS and others provide richer context and anomaly detection to catch multistage attacks early.

• Despite widespread MFA adoption, attackers focus on token theft, overprivileged apps, and infrastructure persistence to maintain access.

• Critical vulnerabilities in virtualization layers, like VMware’s recent privilege escalation flaw, highlight risks beyond just software.

• Misconfigurations remain a top cause of breaches, with exposed storage and lax policies expanding attack surfaces.

🔓 5. Free Resources for You

Here’s what I’ve found most helpful this week:

• 🧰 CyberSecLabs.io – Hands-on blue team and red team labs!!

• 📊 IBM X-Force Threat Intelligence Report 2024 – [Check it out!]

• 📘 MITRE ATT&CK Navigator – Visualize threat actor techniques

• 🛡️ FREE “Blue Team Extensive Training” – Save yourself hours! – [Worth 20$]

• 📜 FREE Google Cybersecurity Certificate – Worth every second of your time!

• 💥 My “Top 5 Free Cybersecurity Tools for 2025” – [View Notion]

👉 For Now, One Quick Question

Since this project is just getting started, I’d love to hear from you early!

Shape our next Cyber & AI publication — take our quick survey now! 🤖🔒

💬 Hit reply and let me know—I'll build this newsletter to serve the challenges you're facing, not just the ones trending on Twitter!

This newsletter is crafted with focus, scepticism, and zero hype. Just field-relevant insights at the intersection of cybersecurity and AI.

💬 Got a tip, tool, or topic suggestion? Hit reply! I read every message!
🌍 Published by Sentinel