> InfoSec News Nuggets 10/14/2025

JPMorgan to Invest up to $10 Billion in US Companies with Crucial Ties to National Security The investment plan revealed Monday will focus on four areas: supply chain and advanced manufacturing in critical minerals, pharmaceutical precursors and robotics; defense and aerospace; energy independence, with investments in battery storage and grid resilience; and strategic technologies, including artificial intelligence, cybersecurity and quantum computing. The investment is part of the bank’s Security and Resiliency Initiative, a $1.5 trillion, 10-year plan to facilitate, finance and invest in industries critical to national security.   Massive multi-country botnet targets RDP services in the US A large-scale botnet is targeting Remote Desktop Protocol (RDP) services in the United States from more than 100,000 IP addresses. The campaign started on October 8 and based on the source of the IPs, researchers believe the attacks are launched by a multi-country botnet. RDP is a network protocol that enables remote connection and control of Windows systems. It is typically used by administrators, helpdesk staff, and remote workers. Attackers often scan for open RDP ports or try to brute-force logins, exploit vulnerabilities, or perform timing attacks. In this case, researchers at threat monitoring platform GreyNoise found that the botnet relies on two types of RDP-related attacks.   To shield kids, California hikes fake nude fines to $250K max California is cracking down on AI technology deemed too harmful for kids, attacking two increasingly notorious child safety fronts: companion bots and deepfake pornography. On Monday, Governor Gavin Newsom signed the first-ever US law regulating companion bots after several teen suicides sparked lawsuits. Moving forward, California will require any companion bot platforms—including ChatGPT, Grok, Character.AI, and the like—to create and make public “protocols to identify and address users’ suicidal ideation or expressions of self-harm.”   RealBlindingEDR Tool That Permanently Turns Off AV/EDR Using Kernel Callbacks An open-source tool called RealBlindingEDR enables attackers to blind, permanently disable, or terminate antivirus (AV) and endpoint detection and response (EDR) software by clearing critical kernel callbacks on Windows systems. Released on GitHub in late 2023, the utility leverages signed drivers for arbitrary memory read and write operations, bypassing protections like PatchGuard to target six major kernel callback types. This development raises alarms for cybersecurity professionals, as the tool has been adopted by ransomware groups such as Crypto24 in recent attacks.​   OpenAI’s Guardrails Can Be Bypassed by Simple Prompt Injection Attack A new report from the research firm HiddenLayer reveals an alarming flaw in the safety measures for Large Language Models (LLMs). OpenAI recently rolled out its Guardrails safety framework on October 6th as part of its new AgentKit toolset to help developers build and secure AI agents. It is described by OpenAI as an open-source, modular safety layer to protect against unintended or malicious behaviour, including concealing Personal Identifiable Information (PII). This system was designed to use special AI programs called LLM-based judges to detect and block harmful actions like jailbreaks and prompt injections.   The post InfoSec News Nuggets 10/14/2025 appeared first on AboutDFIR - The Definitive Compendium Project.