Tag: supply-chain
-
Supply chain management vendor Blue Yonder succumbs to ransomware
And it looks like major UK retailers that rely on it are feeling the pinch First seen on theregister.com Jump to article: www.theregister.com/2024/11/26/blue_yonder_ransomware/
-
Blue Yonder ransomware attack disrupts grocery store supply chain
Supply chain management firm Blue Yonder is warning that a ransomware attack caused significant disruption to its services, with the outages impacting grocery store chains in the UK. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/blue-yonder-ransomware-attack-disrupts-grocery-store-supply-chain/
-
Walking the Walk: How Tenable Embraces Its >>Secure by Design<< Pledge to CISA
Tags: access, application-security, attack, authentication, best-practice, business, cisa, cloud, conference, container, control, credentials, cve, cvss, cyber, cybersecurity, data, data-breach, defense, exploit, Hardware, identity, infrastructure, injection, Internet, leak, lessons-learned, mfa, open-source, passkey, password, phishing, risk, saas, service, siem, software, sql, strategy, supply-chain, theft, threat, tool, update, vulnerability, vulnerability-managementAs a cybersecurity leader, Tenable was proud to be one of the original signatories of CISA’s “Secure by Design” pledge earlier this year. Our embrace of this pledge underscores our commitment to security-first principles and reaffirms our dedication to shipping robust, secure products that our users can trust. Read on to learn how we’re standing…
-
Ransomware hits supply chain software firm Blue Yonder ahead of Thanksgiving
The attack against Blue Yonder led to issues for Morrisons, a U.K.-based grocery chain, in its warehouse management system for fresh food and produce. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ransomware-supply-chain-blue-yonder-thanksgiving/733888/
-
npm Package Lottie-Player Compromised in Supply Chain Attack
npm package @lottiefiles/lottie-player hacked with malicious code, draining crypto wallets via web3 pop-ups First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/npm-package-lottieplayer-supply/
-
PyPI-Lieferkette im Visier: Kaspersky deckte Cyber-Angriff auf
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/pypi-lieferkette-visier-kaspersky-aufdeckung-cyber-angriff
-
Microsoft Takes Down >>ONNX<< Phishing-as-a-Service Operation
Microsoft’s Digital Crimes Unit (DCU) has struck a significant blow against the cybercrime supply chain, seizing 240 fraudulent websites and disrupting a major player in the >>Phishing-as-a-Service
-
Going Beyond Secure by Demand
Secure by Demand offers a starting point for third-party risk management teams, but they need to take the essential step of using a mature software supply chain security solution to ensure they’re not blindly trusting a provider’s software. First seen on darkreading.com Jump to article: www.darkreading.com/vulnerabilities-threats/going-beyond-secure-by-demand
-
Cybersecurity Snapshot: Prompt Injection and Data Disclosure Top OWASP’s List of Cyber Risks for GenAI LLM Apps
Tags: access, advisory, ai, application-security, attack, backup, best-practice, breach, cisa, cloud, computer, cve, cyber, cyberattack, cybercrime, cybersecurity, data, exploit, extortion, firewall, framework, governance, government, group, guide, Hardware, incident, incident response, infrastructure, injection, intelligence, Internet, LLM, malicious, microsoft, mitigation, mitre, monitoring, network, nist, office, open-source, powershell, privacy, ransomware, regulation, risk, risk-management, russia, service, skills, software, sql, strategy, supply-chain, tactics, technology, theft, threat, tool, update, vulnerability, vulnerability-management, windowsDon’t miss OWASP’s update to its “Top 10 Risks for LLMs” list. Plus, the ranking of the most harmful software weaknesses is out. Meanwhile, critical infrastructure orgs have a new framework for using AI securely. And get the latest on the BianLian ransomware gang and on the challenges of protecting water and transportation systems against…
-
SEC charges 4 companies for downplaying SolarWinds attacks
The U.S. Securities and Exchange Commission fined the companies for misleading investors about intrusions stemming from the SolarWinds supply chain at… First seen on techtarget.com Jump to article: www.techtarget.com/searchsecurity/news/366614413/SEC-charges-4-companies-for-downplaying-SolarWinds-attack-risks
-
Securing the Foundation: The Critical Role of Hardware in Supply Chain Attacks
As enterprises increasingly focus on supply chain security, a critical yet often overlooked element remains: hardware security. Many organizations fail to address the risks associated with underlying hardware, either due to misconceptions or the perceived complexity of mitigation efforts. First seen on securityboulevard.com Jump to article: securityboulevard.com/2024/11/securing-the-foundation-the-critical-role-of-hardware-in-supply-chain-attacks/
-
Securing the Software Supply Chain: Checkmarx One Expands its Offerings
Tags: ai, container, detection, exploit, programming, software, strategy, supply-chain, threat, toolThe software supply chain is under siege. Threat actors increasingly exploit weaknesses in code repositories, dependencies and mismanaged secrets to infiltrate and disrupt software development processes. In response, organizations are turning to robust strategies to safeguard their supply chains, including tools like SCA scanning, AI and container security, secrets detection and repository health monitoring. Checkmarx’s..…
-
African Reliance on Foreign Suppliers Boosts Insecurity Concerns
Recent backdoor implants and cyber-espionage attacks on their supply chains have African organizations looking to diversify beyond Chinese, American tech vendors. First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/african-reliance-on-foreign-suppliers-boosts-insecurity
-
Bipartisan Senate bill targets supply chain threats from foreign adversaries
The bill would strengthen oversight powers for the body charged with investigating IT products from China and other foes. First seen on cyberscoop.com Jump to article: cyberscoop.com/federal-acquisition-security-council-improvement-act-supply-chain-security/
-
Lessons From OSC&R on Protecting the Software Supply Chain
A new report from the Open Software Supply Chain Attack Reference (OSC&R) team provides a framework to reduce how much vulnerable software reaches production. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/lessons-from-osc-r-on-protecting-the-software-supply-chain
-
Amazon Employee Data Compromised in MOVEit Breach
The data leak was not actually due to a breach in Amazon’s systems but rather that of a third-party vendor; the supply chain incident affected several other clients as well. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/amazon-employee-data-compromised-moveit-breach
-
‘GoIssue’ Cybercrime Tool Targets GitHub Developers En Masse
Marketed on a cybercriminal forum, the $700 tool harvests email addresses from public GitHub profiles, priming cyberattackers for further credential theft, malware delivery, OAuth subversion, supply chain attacks, and other corporate breaches. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/goissue-cybercrime-tool-github-developers-en-masse
-
New GoIssue Tool Targets GitHub Devs And Corporate Supply Chains
First seen on packetstormsecurity.com Jump to article: packetstormsecurity.com/news/view/36585/New-GoIssue-Tool-Targets-GitHub-Devs-And-Corporate-Supply-Chains.html
-
GitLoker Strikes Again: New >>Goissue<< Tool Targets GitHub Developers and Corporate Supply Chains
GoIssue is a new tool for cybercriminals that allows attackers to extract email addresses from GitHub profiles and send bulk emails to users. The post GitLoker Strikes Again: New >>Goissue
-
LottieFiles Issues Warning About Compromised lottie-player npm Package
LottieFiles has revealed that its npm package lottie-player was compromised as part of a supply chain attack, prompting it to release an updated versi… First seen on thehackernews.com Jump to article: thehackernews.com/2024/10/lottiefiles-issues-warning-about.html
-
Security Flaws in Popular ML Toolkits Enable Server Hijacks, Privilege Escalation
Cybersecurity researchers have uncovered nearly two dozen security flaws spanning 15 different machine learning (ML) related open-source projects.These comprise vulnerabilities discovered both on the server- and client-side, software supply chain security firm JFrog said in an analysis published last week.The server-side weaknesses “allow attackers to hijack important servers in the First seen on thehackernews.com Jump…
-
Cyber-Angriffe auf die Lieferkette: Unternehmen sollten Risiken erkennen und gezielt vorbeugen
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/cyber-angriffe-lieferkette-unternehmen-risiken-erkennung-ziel-vorbeugung
-
Malicious NPM Packages Target Roblox Users with Data-Stealing Malware
A new campaign has targeted the npm package repository with malicious JavaScript libraries that are designed to infect Roblox users with open-source stealer malware such as Skuld and Blank-Grabber.”This incident highlights the alarming ease with which threat actors can launch supply chain attacks by exploiting trust and human error within the open source ecosystem, and…
-
The Global Effort to Maintain Supply Chain Security – Part Two
Various Cybersecurity Experts, CISO Global A well-run kitchen requires a fully stocked pantry and a clear understanding of what’s on hand. In cybersecurity, your pantry is your asset inventory”, every server, every piece of software, and even those firmware components lurking in the background. You wouldn’t want to cook without knowing exactly what ingredients are…
-
White House Outlines AI’s Role in National Security
The National Security Memorandum on Artificial Intelligence tasks various federal agencies with securing the AI supply chain from potential cyberattac… First seen on darkreading.com Jump to article: www.darkreading.com/cyber-risk/white-house-outlines-ai-role-national-security