Tag: supply-chain
-
Supply chain attack hits Chrome extensions, could expose millions
Threat actor exploited phishing and OAuth abuse to inject malicious code First seen on theregister.com Jump to article: www.theregister.com/2025/01/22/supply_chain_attack_chrome_extension/
-
ENISA: Embedding Resilience in Critical Infrastructure
ENISA’s Marnix Dekker on Supply Chain Attacks, Harmonizing the New NIS2 Regulations. The European Union Agency for Cybersecurity is at the center of rolling out new cybersecurity frameworks for critical infrastructure providers across Europe. But a major priority, according to ENISA’s Marnix Dekker, is helping smaller vendors withstand supply chain attacks. First seen on govinfosecurity.com…
-
IPany VPN breached in supply-chain attack to push custom malware
South Korean VPN provider IPany was breached in a supply chain attack by the “PlushDaemon” China-aligned hacking group, who compromised the company’s VPN installer to deploy the custom ‘SlowStepper’ malware. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ipany-vpn-breached-in-supply-chain-attack-to-push-custom-malware/
-
Call for Presentations Open for SecurityWeek’s 2025 Supply Chain Security Third-Party Risk Summit
Join Us in Shaping the Future of Supply Chain Security – Don’t miss this chance to be part of the conversation addressing one of the most pressing cybersecurity challenges . The post Call for Presentations Open for SecurityWeek’s 2025 Supply Chain Security & Third-Party Risk Summit appeared first on SecurityWeek. First seen on securityweek.com Jump…
-
PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack
A previously undocumented China-aligned advanced persistent threat (APT) group named PlushDaemon has been linked to a supply chain attack targeting a South Korean virtual private network (VPN) provider in 2023, according to new findings from ESET.”The attackers replaced the legitimate installer with one that also deployed the group’s signature implant that we have named SlowStepper…
-
China-aligned PlushDaemon APT compromises supply chain of Korean VPN
ESET researchers have uncovered a supply chain attack targeting a South Korean VPN provider, carried out by PlushDaemon, a newly identified China-aligned APT group. In this … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2025/01/22/plushdaemon-apt-slowstepper-supply-chain-compromise/
-
Oracle To Address 320 Vulnerabilities in January Patch Update
Critical flaws include those in Oracle Supply Chain products First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/oracle-320-vulnerabilities-january/
-
US Ban on Automotive Components Could Curb Supply Chain
The US Department of Commerce will prohibit the import of components for connected vehicles from China or Russia, as the US continues to ban technology it sees as potential national security threats. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/us-ban-automotive-components-supply-chain
-
How organizations can secure their AI code
Tags: ai, application-security, awareness, backdoor, breach, business, chatgpt, ciso, compliance, control, credentials, crime, cybersecurity, data, data-breach, finance, github, healthcare, LLM, malicious, ml, open-source, organized, programming, risk, risk-management, software, startup, strategy, supply-chain, technology, tool, training, vulnerabilityIn 2023, the team at data extraction startup Reworkd was under tight deadlines. Investors pressured them to monetize the platform, and they needed to migrate everything from Next.js to Python/FastAPI. To speed things up, the team decided to turn to ChatGPT to do some of the work. The AI-generated code appeared to function, so they…
-
Biden order gives CISA software supply chain ‘teeth’
The outgoing administration makes a Hail Mary attempt to salvage work it began in 2021 to require specific software supply chain security information from software suppliers. First seen on techtarget.com Jump to article: www.techtarget.com/searchitoperations/news/366618234/Biden-order-gives-CISA-software-supply-chain-teeth
-
AI and Applied Security Dominate Nullcon Paper Submissions
CFP Board Members Discuss AI, Hardware Access and Emerging Trends for Nullcon 2025. Cybersecurity research submissions for the Nullcon 2025 CFP Review Board reflect prominent trends and challenges in the field. Nullcon CFP Review Board members Anant Shrivastava and Neelu Tripathi noted a growing focus on AI, supply chain and applied security. First seen on…
-
Cyber Insights 2025: Open Source and Software Supply Chain Security
Open source software (OSS) is a prime target for supply chain cyberattacks and protecting it remains a major challenge. The post Cyber Insights 2025: Open Source and Software Supply Chain Security appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/cyber-insights-2025-open-source-and-the-software-supply-chain/
-
The Future of Cybersecurity: Global Outlook 2025 and Beyond
The cybersecurity landscape is entering an unprecedented era of complexity, with AI-driven threats, geopolitical tensions, and supply chain vulnerabilities reshaping how organizations approach digital security. This analysis explores key trends and strategic imperatives for 2025 and beyond. First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/01/the-future-of-cybersecurity-global-outlook-2025-and-beyond/
-
Chinese Connected Car Tech Banned by Biden Administration
National Security and Hacking Worries Underpin Concerns over Supply Chain Risk. The U.S. federal government is telling the automotive industry to stop buying Chinese manufactured hardware and software powering onboard telematics and automated driving systems, warning that the potential for nation-state hacking and espionage poses a national security risk. First seen on govinfosecurity.com Jump to…
-
OneBlood Notifying Donors Affected by 2024 Ransomware Hack
Attack on Blood Center Spotlights Ongoing Supply Chain Risk in Healthcare Sector. Six months after a ransomware attack temporarily crippled its blood donation and distribution activities, Florida-based nonprofit OneBlood is reporting a data breach to regulators that affected donors’ personal information. Why is the incident reawakening healthcare supply chain concerns? First seen on govinfosecurity.com Jump…
-
Companies Double Down on AI and Supply Chain Security, According to Black Duck’s BSIMM15 Report
Organisations worldwide are ramping up efforts to tackle emerging security risks in artificial intelligence (AI) and software supply chains, according to the newly released BSIMM15 report from Black Duck. The report, which examines software security practices across 121 companies, reveals a sharp increase in activities aimed at strengthening defenses against evolving threats. Key findings from…
-
Malicious Kong Ingress Controller Image Found on DockerHub
A critical security breach in the software supply chain has been detected. An attacker accessed Kong’s DockerHub account… First seen on hackread.com Jump to article: hackread.com/malicious-kong-ingress-controller-image-dockerhub/
-
US attacks ransomware supply chain with indictment of three cryptocurrency mixer operators
Tags: attack, business, control, crypto, cybercrime, group, hacking, law, offense, office, ransomware, russia, service, supply-chainThe US Department of Justice indicted three Russian citizens on Friday for allegedly running services that helped criminals launder cryptocurrency; the services are suspected to have been used to hide the proceeds of ransomware attacks.The US Department of Treasury’s Office of Foreign Assets Control (OFAC) had previously sanctioned the two cryptocurrency mixer services the accused…
-
SEC rule confusion continues to put CISOs in a bind a year after a major revision
Tags: attack, breach, business, ciso, citrix, compliance, control, cyber, cyberattack, cybersecurity, data, government, incident, incident response, law, network, privacy, regulation, risk, security-incident, software, strategy, supply-chainConfusion around when and how to report cybersecurity breaches continues to plague companies a year after revised US Securities and Exchange Commission (SEC) cybersecurity breach reporting rules came into effect, experts say.As the agency that regulates and enforces federal US securities laws continues to flex its enforcement muscles against organizations that violate the strict rules,…
-
DNA sequencer vulnerabilities signal firmware issues across medical device industry
Tags: access, advisory, attack, best-practice, computer, computing, control, credentials, data, exploit, firmware, flaw, Hardware, iot, leak, malicious, malware, mitigation, privacy, rce, remote-code-execution, risk, side-channel, software, supply-chain, update, vulnerability, windowsIn highlighting vulnerabilities in a widely used DNA gene sequencing device, security researchers have brought further attention to the likely poor state of security in the medical device industry, where hardware and firmware development is often outsourced to external equipment manufacturers under questionable support contracts.The device, Illumina’s iSeq 100 compact DNA sequencer, is used by…
-
MSSP Market Update: Sweet Partners With Illustria on Supply Chain Security
First seen on scworld.com Jump to article: www.scworld.com/news/mssp-market-update-sweet-partners-with-illustria-on-supply-chain-security
-
Veracode Fuels Supply Chain Security With Phylum Acquisition
Phylum’s Product Delivers Real-Time Detection of Malicious Open-Source Packages. To combat the rise in software supply chain attacks, Veracode has acquired Denver-area startup Phylum and its advanced tools to detect malicious open-source packages. The acquisition strengthens Veracode’s software composition analysis offering and enables faster, more reliable threat mitigation. First seen on govinfosecurity.com Jump to article:…
-
Veracode Boosts Supply Chain Security Via Phylum Acquisition
Phylum’s Product Delivers Real-Time Detection of Malicious Open-Source Packages. To combat the rise in software supply chain attacks, Veracode has acquired Denver-area startup Phylum and its advanced tools to detect malicious open-source packages. The purchase strengthens Veracode’s software composition analysis offering and enables faster, more reliable threat mitigation. First seen on govinfosecurity.com Jump to article:…