Tag: supply-chain
-
Malicious npm Package Targets Developers for Supply Chain Attack
The Socket Research Team has uncovered a malicious npm package@ton-wallet/create designed to steal sensitive cryptocurrency wallet keys from developers and users in the TON blockchain ecosystem. TON, originally developed by Telegram, is a growing platform for decentralized applications (dApps), smart contracts, and cryptocurrency transactions. The malicious package impersonated the legitimate @ton/ton package and remained undetected…
-
How to create an effective incident response plan
Tags: access, advisory, attack, backup, breach, business, ceo, ciso, communications, corporate, cyber, cybersecurity, email, endpoint, exploit, finance, governance, guide, incident, incident response, insurance, law, lessons-learned, malicious, monitoring, network, office, phone, ransomware, risk, security-incident, service, strategy, supply-chain, technology, threat, updateEstablish a comprehensive post-incident communications strategy: Another key element that can make or break an incident response strategy is communications. Without clear communications among the major stakeholders of the business, a company might experience much longer downtimes or the loss of vital processes for extended periods.”How are you going to go about communicating? With whom?…
-
Virtual AI Summit Explores Cross-Regional AI Security
Security Leaders From Three Continents Convene to Address AI Adoption Challenges. ISMG recently concluded its tri-continental Virtual AI Summit, where experts from the Americas, EMEA and APAC explored governance, supply chain risks and ethical concerns. The summit addressed growing concerns related to AI, highlighting the urgent need for tailored security strategies. First seen on govinfosecurity.com…
-
Conducting Security Audits in Supply Chain Management
Cyberattacks against supply chains have risen recently, but many risks go unnoticed and unaddressed. As cybercrime grows, supply chain professionals must embrace regular security audits. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/02/conducting-security-audits-in-supply-chain-management/
-
Zero Trust World: Viable defense strategies against zero days and supply chain risks
First seen on scworld.com Jump to article: www.scworld.com/resource/zero-trust-world-viable-defense-strategies-against-zero-days-and-supply-chain-risks
-
How CISOs can sharpen their board pitch for IAM buy-in
Tags: access, automation, breach, business, ciso, cloud, compliance, control, cybersecurity, data, finance, guide, iam, identity, metric, risk, security-incident, strategy, supply-chainthe top focus area going into 2025. However, communicating IAM’s value to the board remains a challenge”, it isn’t enough for these security leaders to craft effective IAM strategies”, they must also secure their board’s support.CISOs know that executive buy-in is critical for obtaining the necessary funding and setting the right tone from the top. The…
-
Supply Chain Flaw Impacting Newly-Acquired Firm Nets Over $50K Reward
First seen on scworld.com Jump to article: www.scworld.com/brief/supply-chain-flaw-impacting-newly-acquired-firm-nets-over-50k-reward
-
New Variant of macOS Threat XCSSET Spotted in the Wild
Microsoft is warning the modular and potentially wormable Apple-focused infostealer boasts new capabilities for obfuscation, persistence, and infection, and could lead to a supply chain attack. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/microsoft-variant-macos-threat-xcsset
-
Severe supply chain flaw impacting newly acquired firm nets over $50K reward
First seen on scworld.com Jump to article: www.scworld.com/brief/severe-supply-chain-flaw-impacting-newly-acquired-firm-nets-over-50k-reward
-
XCSSET macOS malware reappears with new attack strategies, Microsoft sounds alarm
Xcode developers targeted through infected projects: Microsoft reported that XCSSET continues to spread via compromised Xcode projects, a technique that has been in use since the malware’s discovery in 2020. Once an infected project is cloned or downloaded, the malware can embed itself within the developer’s system and further propagate when the infected code is…
-
Duo Wins $50K Bug Bounty for Supply Chain Flaw in Newly Acquired Firm
Researchers earned a $50,500 Bug Bounty after uncovering a critical supply chain flaw in a newly acquired firm,… First seen on hackread.com Jump to article: hackread.com/duo-bug-bounty-supply-chain-flaw-newly-acquired-firm/
-
How to evaluate and mitigate risks to the global supply chain
Tags: access, business, ceo, ciso, communications, compliance, control, cyberattack, cybersecurity, data, framework, governance, government, intelligence, international, ISO-27001, kaspersky, microsoft, mitigation, monitoring, office, resilience, risk, risk-assessment, risk-management, russia, service, soc, software, supply-chain, technology, threat, tool, update, vulnerabilityMaintain a diversified supply chain: Organizations that source from international technology suppliers need to ensure they are not overly reliant on a single vendor, single region or even a single technology. Maintaining a diversified supply chain can mitigate costly disruptions from a cyberattack or vulnerability involving a key supplier, or from disruptions tied to regulatory…
-
CISO success story: How LA County trains (and retrains) workers to fight phishing
Tags: ai, awareness, breach, business, chatgpt, cio, ciso, cloud, compliance, computing, control, corporate, cybersecurity, data, dos, election, email, endpoint, government, hacker, healthcare, incident response, jobs, law, lessons-learned, malicious, marketplace, network, phishing, privacy, regulation, risk, risk-management, service, software, strategy, supply-chain, tactics, technology, threat, tool, training, vulnerability(The following interview has been edited for clarity and length.)At first glance, LA County’s reporting structure who reports to whom seems, well, fairly complex.We have a federated model: I report to the county CIO. Each department acts as an independent business and has its own department CIO and information security officer. Their job is to…
-
Open Source AI Models: Perfect Storm for Malicious Code, Vulnerabilities
Companies pursing internal AI development using models from Hugging Face and other open source repositories need to focus on supply chain security and checking for vulnerabilities. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/open-source-ai-models-pose-risks-of-malicious-code-vulnerabilities
-
Lazarus Group Targets Developers Worldwide with New Malware Tactic
Tags: crypto, cyber, cybercrime, group, korea, lazarus, malware, north-korea, software, supply-chain, tacticsNorth Korea’s Lazarus Group, a state-sponsored cybercriminal organization, has launched a sophisticated global campaign targeting software developers and cryptocurrency users. Dubbed Operation Marstech Mayhem, this operation leverages the group’s latest implant, >>Marstech1,
-
Russian hacking group targets critical infrastructure in the US, the UK, and Canada
Tags: access, attack, blizzard, computer, control, cyber, cyberattack, cybersecurity, data, espionage, exploit, fortinet, group, hacker, hacking, infrastructure, intelligence, international, microsoft, military, network, ransomware, russia, software, strategy, supply-chain, threat, tool, ukraine, update, vulnerability, zero-trustWeaponizing IT software against global enterprises: Since early 2024, the hackers have exploited vulnerabilities in widely used IT management tools, including ConnectWise ScreenConnect (CVE-2024-1709) and Fortinet FortiClient EMS (CVE-2023-48788). By compromising these critical enterprise systems, the group has gained undetected access to networks, Microsoft warned.”Seashell Blizzard’s specialized operations have ranged from espionage to information operations…
-
North Korea targets crypto developers via NPM supply chain attack
Yet another cash grab from Kim’s cronies and an intel update from Microsoft First seen on theregister.com Jump to article: www.theregister.com/2025/02/13/north_korea_npm_crypto/
-
JFrog und AWS intensivieren Zusammenarbeit: Optimierte DevSecOps-Lösungen für die Cloud
Software-Lieferkette: Die erweiterte Zusammenarbeit bietet Unternehmenskunden zahlreiche Vorteile: Durch die Möglichkeit, Arbeitslasten schneller auf AWS zu migrieren, steigern Unternehmen den Wert ihrer Cloud-Investitionen erheblich. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/jfrog-und-aws-intensivieren-zusammenarbeit-optimierte-devsecops-loesungen-fuer-die-cloud/a39788/
-
Researchers Breach Software Supply Chain and Secure $50K Bug Bounty
Tags: breach, bug-bounty, cyber, cybersecurity, data-breach, exploit, flaw, software, supply-chain, vulnerabilityA duo of cybersecurity researchers uncovered a critical vulnerability in a software supply chain, landing them an extraordinary $50,500 bug bounty. The exploit, described as an “Exceptional Vulnerability,” not only exposed systemic flaws in software supply chain security but also demonstrated just how far-reaching the impact of overlooked weak points can be. The researchers, who…
-
It’s time to secure the extended digital supply chain
Organizations’ increasing reliance on third-party software and services has created an environment with more vulnerabilities and harder-to-detect risks. Attackers know they … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/02/12/supply-chain-risk/
-
How Trump’s Funding Freeze Threatens US Port Cybersecurity
Experts Testify Budget Cuts Could Hurt Security Investments, Disrupt Supply Chains. President Donald Trump’s federal funding freeze threatens to significantly weaken U.S. maritime cybersecurity efforts as China expands its control over global ports, experts warned in congressional testimony. Attacks on ports could disrupt supply chains and destabilize global trade. First seen on govinfosecurity.com Jump to…
-
The Rise of Typhoon Cyber Groups
Tags: access, attack, breach, communications, control, cyber, cyberattack, cybersecurity, data, defense, dns, endpoint, espionage, exploit, finance, government, group, infrastructure, intelligence, iot, military, monitoring, network, phone, resilience, supply-chain, tactics, threat, tool, vulnerability, zero-day -
VeraCore zero-day vulnerabilities exploited in supply chain attacks
Cybercriminals maintained access to one victim;organization for more than four years. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/veracore-zero-day-vulnerabilities-exploited-in-supply-chain-attacks/739784/
-
XE Group Shifts From Card Skimming to Supply Chain Attacks
The likely Vietnam-based threat actor has been using two zero-days in VeraCore’s warehouse management software in some of its latest cyberattacks. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/xe-group-shifts-card-skimming-supply-chain-attacks
-
Protecting Your Software Supply Chain: Assessing the Risks Before Deployment
Imagine you’re considering a new car for your family. Before making a purchase, you evaluate its safety ratings, fuel efficiency, and reliability. You might even take it for a test drive to ensure it meets your needs. The same approach should be applied to software and hardware products before integrating them into an organization’s environment.…
-
Die besten DAST- & SAST-Tools
Tags: access, ai, api, application-security, authentication, awareness, cloud, cyberattack, cybersecurity, docker, framework, HIPAA, injection, PCI, rat, risk, risk-management, service, software, sql, supply-chain, tool, vulnerability, vulnerability-managementTools für Dynamic und Static Application Security Testing helfen Entwicklern, ihren Quellcode zu härten. Wir zeigen Ihnen die besten Tools zu diesem Zweck.Die Softwarelieferkette respektive ihre Schwachstellen haben in den vergangenen Jahren für viel Wirbel gesorgt. Ein besonders schlagzeilenträchtiges Beispiel ist der Angriff auf den IT-Dienstleister SolarWinds, bei dem mehr als 18.000 Kundenunternehmen betroffen waren.…
-
Projecting the next decade of software supply chain security
A 2035 vision includes a shift that combines security and innovation. First seen on cyberscoop.com Jump to article: cyberscoop.com/projecting-the-next-decade-of-software-supply-chain-security/