Tag: supply-chain
-
AI’s Role in Cutting Costs and Cybersecurity Threats in Logistics
Supply chains are under immense pressure. Fuel costs are skyrocketing, delays are becoming the norm, and cybersecurity threats… First seen on hackread.com Jump to article: hackread.com/ai-role-cutting-costs-cybersecurity-threats-logistics/
-
The SolarWinds $4.4 billion acquisition gives CISOs what they least want: Uncertainty
Tags: attack, breach, business, cisa, ciso, cyber, cybersecurity, finance, government, group, risk, risk-management, service, software, strategy, supply-chain, tool, updateWhen SolarWinds on Friday announced a $4.4 billion cash deal for it to be acquired by private equity (PE) firm Turn/River Capital, it delivered the last thing that nervous enterprise CISOs want: Uncertainty, to be followed by more uncertainty.”Whenever a security company gets acquired by private equity, you never want to throw a party,” said…
-
Modern Bank Heists 2025: Revenge of the Zero Days
Tom Kellermann’s Annual Report on Key Threats to Financial Sector. Zero days. Supply chain attacks. APIs and cloud environments as growing threat vectors. These are among the topics discussed in this seventh annual Modern Bank Heists report, and author Tom Kellermann discusses their impact on financial institutions – and which defensive gaps need to be…
-
Private equity firm to acquire SolarWinds for $4.4B
SolarWinds, which now will go private, was embroiled in a massive supply chain attack in 2020 linked to Russia-backed threat actors. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/private-equity-firm-to-acquire-solarwinds-for-44b/739573/
-
CIOs and CISOs grapple with DORA: Key challenges, compliance complexities
Tags: access, automation, banking, business, cio, ciso, communications, compliance, control, country, cyber, cybersecurity, data, dora, finance, framework, GDPR, governance, jobs, law, monitoring, network, nis-2, penetration-testing, privacy, regulation, resilience, risk, risk-management, service, skills, supply-chain, technology, threat, tool, training, vulnerabilityIn force since January, the Digital Operational Resilience Act (DORA) has required considerable effort from CIOs and CISOs at 20 types of financial entities to achieve compliance. For many, the journey is not complete.”In the past months, financial entities targeted by DORA have been busy internally defining roles and responsibilities related to ICT security, identifying…
-
Software Supply Chain Compromise Possible With Neglected AWS S3 Buckets
First seen on scworld.com Jump to article: www.scworld.com/brief/software-supply-chain-compromise-possible-with-neglected-aws-s3-buckets
-
Extensive software supply chain compromise possible with deserted AWS S3 buckets
First seen on scworld.com Jump to article: www.scworld.com/brief/extensive-software-supply-chain-compromise-possible-with-deserted-aws-s3-buckets
-
Go Module Mirror served backdoor to devs for 3+ years
Supply chain attack targets developers using the Go programming language. First seen on arstechnica.com Jump to article: arstechnica.com/security/2025/02/backdoored-package-in-go-mirror-site-went-unnoticed-for-3-years/
-
Weaponized Go Package Module Let Attackers Gain Remote Access to Infected Systems
Tags: access, attack, backdoor, cyber, cybersecurity, malicious, open-source, software, supply-chain, threatIn a significant software supply chain attack, cybersecurity researchers uncovered a malicious Go package that impersonates the widely trusted BoltDB database module. The typosquat packagegithub.com/boltdb-go/bolt was found to include a backdoor enabling remote access to infected systems, allowing attackers to execute arbitrary commands. This discovery underscores the growing sophistication of threats targeting open-source ecosystems. The…
-
More sophisticated XE Group attacks pose greater supply chain threat
First seen on scworld.com Jump to article: www.scworld.com/brief/more-sophisticated-xe-group-attacks-pose-greater-supply-chain-threat
-
The Supply Chain Security System of Low-altitude Economy
Previous posts: Security Risks of Low-altitude Economy The Network Security Business System of Low-altitude Economy The low-altitude economic supply chain security system aims to build an all-round security system from upstream to downstream. The upstream links ensure the safety at source by strictly controlling the supply of raw materials and key components. Implement trusted design…The…
-
WatchTowr warns abandoned S3 buckets pose supply chain risk
WatchTowr researchers found that they could reregister abandoned Amazon S3 buckets and detail alarming ways that threat actors could exploit the attack surface. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366618663/WatchTowr-warns-abandoned-S3-buckets-pose-supply-chain-risk
-
Malicious Go Package Exploits Module Mirror Caching for Persistent Remote Access
Cybersecurity researchers have called attention to a software supply chain attack targeting the Go ecosystem that involves a malicious package capable of granting the adversary remote access to infected systems.The package, named github.com/boltdb-go/bolt, is a typosquat of the legitimate BoltDB database module (github.com/boltdb/bolt), per Socket. The malicious version (1.3.1) was published to First seen on…
-
Abandoned AWS S3 buckets can be reused in supply-chain attacks that would make SolarWinds look ‘insignificant’
When cloud customers don’t clean up after themselves, part 97 First seen on theregister.com Jump to article: www.theregister.com/2025/02/04/abandoned_aws_s3/
-
The Secret to Your Artifactory: Inside The Attacker Kill-Chain
Artifactory token leaks are not the most common, but they pose significant risks, exposing sensitive assets and enabling supply chain attacks. This article explores the dangers of leaked tokens and proposes mitigation strategies, including token scoping and implementing least privilege policies. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/02/the-secret-to-your-artifactory-inside-the-attacker-kill-chain/
-
PyPI Introduces Archival Status to Alert Users About Unmaintained Python Packages
The maintainers of the Python Package Index (PyPI) registry have announced a new feature that allows package developers to archive a project as part of efforts to improve supply chain security.”Maintainers can now archive a project to let users know that the project is not expected to receive any more updates,” Facundo Tuesca, senior engineer…
-
DORA erfordert robuste Risikomanagementprozesse über die gesamte Lieferkette hinweg
Der Finanzsektor ist mit regulatorischen Anforderungen bestens vertraut, doch DORA stellt insbesondere im Bereich Drittanbieter und Lieferketten neue Herausforderungen dar. Eine durchgehende Compliance erfordert die Anpassung von Risikomanagementprozessen und Service-Level-Agreements. Ein Kommentar von Andre Troskie, EMEA Field CISO bei Veeam. Im Gegensatz zu anderen Wirtschaftsbereichen, die ebenfalls die NIS2 einhalten müssen, sind dem Finanzsektor strenge Vorschriften…
-
BlueVoyant verstärkt die Führungsetage mit Michael Montoya als COO
BlueVoyant startet das Jahr 2025 mit mehr als 1.000 Kunden weltweit. Das Unternehmen hat kürzlich seine preisgekrönte BlueVoyant Cyber Defense Platform vorgestellt, die Sicherheitsoperationen der nächsten Generation für die interne, externe und Supply-Chain-Verteidigung bietet. First seen on infopoint-security.de Jump to article: www.infopoint-security.de/bluevoyant-verstaerkt-die-fuehrungsetage-mit-michael-montoya-als-coo/a39595/
-
Eclypsium Raises $45M to Guard AI and Telecom Infrastructure
Series C Funding Targets Supply Chain Risks in AI, Next-Gen Infrastructure Security. Eclypsium raised $45 million in Series C funding to address emerging cyber threats in AI workloads, GPU systems and the global supply chain. With support from Qualcomm and 1011 Ventures, the company will to tackle advanced cyberthreats from nation-state adversaries like Volt Typhoon.…
-
API Supply Chain Attacks Put Millions of Airline Users at Risk
An API supply-chain attack affecting a popular online travel booking service put millions of airline users at risk First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/api-supply-chain-attacks-millions/
-
A pickle in Meta’s LLM code could allow RCE attacks
Tags: ai, attack, breach, cve, cvss, data, data-breach, exploit, flaw, framework, github, LLM, malicious, ml, network, open-source, rce, remote-code-execution, software, supply-chain, technology, theft, vulnerabilityMeta’s large language model (LLM) framework, Llama, suffers a typical open-source coding oversight, potentially allowing arbitrary code execution on servers leading to resource theft, data breaches, and AI model takeover.The flaw, tracked as CVE-2024-50050, is a critical deserialization bug belonging to a class of vulnerabilities arising from the improper use of the open-source library (pyzmq)…
-
Eclypsium finds security issues in Palo Alto Networks NGFWs
Eclypsium researchers stressed how essential supply chain security is as threat actors increasingly target and exploit vulnerabilities in firewalls, VPNs and other edge devices. First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366618492/Eclyspium-finds-security-issues-in-Palo-Alto-Networks-NGFWs
-
Angriff der Plüschdämonen
ESET Forscher entdecken Supply-Chain-Angriff gegen einen VPN-Anbieter in Südkorea durch neue APT-Gruppe “PlushDaemon” First seen on welivesecurity.com Jump to article: www.welivesecurity.com/de/eset-research/angriff-der-pluschdamonen/
-
New Supply Chain Attack Targeting Chrome Extensions to Inject Malicious Code
A sophisticated supply chain attack targeting Chrome browser extensions has come to light, potentially compromising hundreds of thousands of users. The attack, which unfolded in December 2024, involved phishing campaigns aimed at extension developers and the injection of malicious code into legitimate Chrome extensions. Sensitive user data, including API keys, session cookies, and authentication tokens…
-
Chinese Cyberspies Target South Korean VPN in Supply Chain Attack
Advanced persistent threat group PlushDaemon, active since 2019, is using a sophisticated modular backdoor to collect data from infected systems in South Korea. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/chinese-cyberspies-target-south-korean-vpn-supply-chain-attack