Tag: supply-chain
-
Scattered Spider Launches Supply Chain Attacks on UK Retail Organizations
Scattered Spider, also known as Roasting 0ktapus and Scatter Swine, has emerged as a formidable threat actor targeting UK retail organizations. Active since May 2022, this financially motivated group has historically focused on telecommunications and business process outsourcing (BPO) sectors but has now shifted its attention to high-leverage industries, including critical infrastructure and retail, particularly…
-
#Infosec2025: Experts to Shine Light on Vendor Supply Chain Resilience Against Third-Party Risks
During Infosecurity Europe 2025 experts will explore how to strengthen organizational resilience against persistent third-party risks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/infosec2025-vendor-supply-chain/
-
Popular npm package compromised with RAT in supply chain attack
First seen on scworld.com Jump to article: www.scworld.com/brief/popular-npm-package-compromised-with-rat-in-supply-chain-attack
-
Mature But Vulnerable: Pharmaceutical Sector’s Cyber Reality
Pharmaceutical companies typically have more mature cyber programs than other healthcare factions, but these firms also face unique risks involving their large attack surfaces, complex manufacturing, supply chains and sensitive intellectual property, said Joshua Mullen of Booz Allen Hamilton. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/mature-but-vulnerable-pharmaceutical-sectors-cyber-reality-i-5476
-
New Supply Chain Attack Compromises Popular npm Package with 45,000 Weekly Downloads
An advanced supply chain attack has targeted the well-known npm package rand-user-agent, which receives about 45,000 downloads every week, in a worrying development for the JavaScript developer community. Maintained by WebScrapingAPI, this package is designed to generate randomized, real-world user-agent strings based on their frequency of occurrence. However, recent analysis has uncovered malicious code embedded…
-
Living Off the Land (LOTL) Attacks: How your tools are used against you?
Introduction A well-known organisation called SolarWinds was attacked in September 2019. In this attack, a hacker used a supply chain attack to inject malicious code into the system. More than 18,000 SolarWinds customers installed Updates containing the dangerous code. Living off the land attacks use legitimate tools to carry out malicious activities. They are particularly……
-
Kaspersky Alerts on AI-Driven Slopsquatting as Emerging Supply Chain Threat
Tags: ai, cyber, cybersecurity, kaspersky, microsoft, programming, risk, software, supply-chain, threat, vulnerabilityCybersecurity researchers at Kaspersky have identified a new supply chain vulnerability emerging from the widespread adoption of AI-generated code. As AI assistants increasingly participate in software development-with Microsoft CTO Kevin Scott predicting AI will write 95% of code within five years-a phenomenon called >>slopsquatting
-
Supply chain attack hits npm package with 45,000 weekly downloads
An npm package named ‘rand-user-agent’ has been compromised in a supply chain attack to inject obfuscated code that activates a remote access trojan (RAT) on the user’s system. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/supply-chain-attack-hits-npm-package-with-45-000-weekly-downloads/
-
India-Pakistan conflict underscores your C-suite’s need to prepare for war
Tags: business, ciso, communications, conference, cyber, cyberattack, data-breach, disinformation, government, india, infrastructure, military, network, russia, service, supply-chain, ukraine, update, usa, vulnerabilityHow the India-Pakistan conflict raises the stakes: Should the conflict between these two nuclear powers escalate and become a full-blown war, the disruption to supply chains, research and development, and support services has the potential to be significant. Pakistan’s technical hubs in Karachi, Lahore, and Islamabad will be placed in jeopardy. India’s technical hubs in…
-
Linux wiper malware hidden in malicious Go modules on GitHub
A supply-chain attack targets Linux servers with disk-wiping malware hidden in Golang modules published on GitHub. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/linux-wiper-malware-hidden-in-malicious-go-modules-on-github/
-
Hundreds of e-commerce sites hacked in supply-chain attack
Attack that started in April and remains ongoing runs malicious code on visitors’ devices. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/05/hundreds-of-e-commerce-sites-hacked-in-supply-chain-attack/
-
Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers
Tags: attack, backdoor, control, cyber, cybersecurity, exploit, hacker, injection, malicious, software, supply-chain, vulnerabilityCybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21 popular e-commerce applications, granting hackers full control over hundreds of online stores. This malicious campaign, which began with the injection of backdoors as early as six years ago, was activated this week, exposing vulnerabilities in software from vendors such as Tigren,…
-
âš¡ Weekly Recap: Nation-State Hacks, Spyware Alerts, Deepfake Malware, Supply Chain Backdoors
What if attackers aren’t breaking in”, they’re already inside, watching, and adapting?This week showed a sharp rise in stealth tactics built for long-term access and silent control. AI is being used to shape opinions. Malware is hiding inside software we trust. And old threats are returning under new names. The real danger isn’t just the…
-
Malicious Go Modules Discovered Wiping Linux Systems in New Supply Chain Attack
Cybersecurity firm Socket has recently uncovered a set of malicious Go modules capable of delivering a destructive disk-wiping payload. The campaign specifically targets Linux systems by exploiting Go’s decentralized module system, putting countless development environments at risk. How Does the… First seen on sensorstechforum.com Jump to article: sensorstechforum.com/malicious-go-modules-linux-supply-chain-attack/
-
Sansec uncovered a supply chain attack via 21 backdoored Magento extensions
Supply chain attack via 21 backdoored Magento extensions hit 5001,000 e-stores, including a $40B multinational. Sansec researchers reported that multiple vendors were hacked in a coordinated supply chain attack, the experts discovered that a backdoor was hidden in 21 applications. Curiously, the malicious code was injected 6 years ago, but the supply chain attack was…
-
Inside the Relentless Liability Pressures Facing CISOs
SolarWinds CISO Tim Brown’s Case Shows Personal, Legal and Health Risks for CISOs. CISOs face tremendous stress in dealing with regulatory scrutiny and legal exposure in the wake of a data breach. SolarWinds CISO Tim Brown shares the personal and professional impact of Securities and Exchange Commission charges against him after the 2020 SolarWinds supply…
-
Hackers Weaponize Go Modules to Deliver Disk”‘Wiping Malware, Causing Massive Data Loss
Tags: attack, cyber, cybersecurity, data, exploit, github, hacker, malicious, malware, programming, sans, supply-chainCybersecurity researchers uncovered a sophisticated supply chain attack targeting the Go programming language ecosystem in April 2025. Hackers have weaponized three malicious Go modules-github[.]com/truthfulpharm/prototransform, github[.]com/blankloggia/go-mcp, and github[.]com/steelpoor/tlsproxy-to deploy devastating disk-wiping malware. Leveraging the decentralized nature of Go’s module system, where developers directly import dependencies from public repositories like GitHub sans centralized gatekeeping, attackers exploit namespace…
-
Malicious Go Modules Deliver Disk-Wiping Linux Malware in Advanced Supply Chain Attack
Cybersecurity researchers have discovered three malicious Go modules that include obfuscated code to fetch next-stage payloads that can irrevocably overwrite a Linux system’s primary disk and render it unbootable.The names of the packages are listed below -github[.]com/truthfulpharm/prototransformgithub[.]com/blankloggia/go-mcpgithub[.]com/steelpoor/tlsproxy”Despite appearing legitimate, First seen on thehackernews.com Jump to article: thehackernews.com/2025/05/malicious-go-modules-deliver-disk.html
-
Hackers Exploit Critical NodeJS Vulnerabilities to Hijack Jenkins Agents for RCE
Tags: cyber, exploit, flaw, github, hacker, infrastructure, rce, remote-code-execution, risk, supply-chain, vulnerabilitySecurity researchers have identified critical vulnerabilities in the Node.js CI/CD infrastructure, exposing internal Jenkins agents to remote code execution and raising the risk of supply chain attacks. These flaws stemmed from the integration and communication gaps between multiple DevOps platforms-specifically GitHub Apps, GitHub Actions workflows, and Jenkins pipelines-that collectively manage Node.js’ continuous integration processes. Exploiting…
-
Magento supply chain attack compromises hundreds of e-stores
A supply chain attack involving 21 backdoored Magento extensions has compromised between 500 and 1,000 e-commerce stores, including one belonging to a $40 billion multinational. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/magento-supply-chain-attack-compromises-hundreds-of-e-stores/
-
Seven Malicious Packages Exploit Gmail SMTP to Run Harmful Commands
Tags: control, cyber, exploit, malicious, open-source, security-incident, service, supply-chain, threatA major supply chain security incident has rocked the Python open-source community as researchers at Socket’s Threat Research Team uncovered seven interconnected malicious packages published on the Python Package Index (PyPI). These packages Coffin-Codes-Pro, Coffin-Codes-NET2, Coffin-Codes-NET, Coffin-Codes-2022, Coffin2022, Coffin-Grave, and cfc-bsb-were ingeniously designed to exploit Gmail’s SMTP service, establishing covert command-and-control tunnels and enabling attackers to execute…
-
Operational impacts top list of vendor risk worries, study finds
The report comes as years of supply chain cyberattacks shine a spotlight on third-party risks. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/third-party-risk-cyberattacks-supply-chain-ey-survey/746877/
-
How CISOs Can Strengthen Supply Chain Security in 2025
The responsibilities of Chief Information Security Officers (CISOs) are rapidly evolving as digital transformation and global interconnectivity reshape the modern supply chain. In 2025, the supply chain will be more than just a logistical function; it will be a complex, dynamic web of partners, vendors, and technologies, each introducing new vulnerabilities and attack vectors. High-profile…
-
The CISO’s Guide to Effective Cloud Security Strategies
As organizations accelerate cloud adoption, CISOs face unprecedented challenges securing dynamic, multi-cloud environments. The shift to cloud-native architectures, hybrid workloads, and decentralized data storage has expanded the attack surface, exposing enterprises to sophisticated threats like supply chain compromises, misconfigured APIs, and insider risks. With 70% of breaches now linked to cloud assets, CISOs must balance…
-
CNAPP-Kaufratgeber
Tags: access, ai, application-security, attack, authentication, cloud, container, detection, edr, encryption, framework, group, ibm, infrastructure, intelligence, kubernetes, linux, ml, monitoring, network, open-source, risk-management, saas, soar, software, supply-chain, threat, tool, vmware -
Securing the invisible: Supply chain security trends
Adversaries are infiltrating upstream software, hardware, and vendor relationships to quietly compromise downstream targets. Whether it’s a malicious update injected into a … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/04/30/supply-chain-security-trends/
-
JPMorgan Chase CISO Warns of SaaS Security Crisis and Supply Chain Risk
In an open letter, Patrick Opet, Chief Information Security Officer (CISO) at JPMorgan Chase, raises a critical alarm First seen on securityonline.info Jump to article: securityonline.info/jpmorgan-chase-ciso-warns-of-saas-security-crisis-and-supply-chain-risk/