Tag: threat
-
Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069
Google has formally attributed the supply chain compromise of the popular Axios npm package to a financially motivated North Korean threat activity cluster tracked as UNC1069.”We have attributed the attack to a suspected North Korean threat actor we track as UNC1069,” John Hultquist, chief analyst at Google Threat Intelligence Group (GTIG), told The Hacker News…
-
North Korean Hackers Breach Axios Package, Target Windows, macOS, and Linux Systems
A North Koreanexus threat actor has hijacked the popular Axios NPM package in a high”‘impact software supply chain attack that can silently backdoor Windows, macOS, and Linux systems. Between March 31, 2026, 00:21 and 03:20 UTC, attackers used a compromised maintainer account to push backdoored Axios releases 1.14.1 and 0.30.4 to NPM. The attackers changed…
-
North Korean Hackers Breach Axios Package, Target Windows, macOS, and Linux Systems
A North Koreanexus threat actor has hijacked the popular Axios NPM package in a high”‘impact software supply chain attack that can silently backdoor Windows, macOS, and Linux systems. Between March 31, 2026, 00:21 and 03:20 UTC, attackers used a compromised maintainer account to push backdoored Axios releases 1.14.1 and 0.30.4 to NPM. The attackers changed…
-
CrewAI Hit by Critical Vulnerabilities Enabling Sandbox Escape and Host Compromise
CrewAI, a prominent tool used by developers to orchestrate multi-agent AI systems, is currently vulnerable to a chain of critical security flaws. By using direct or indirect prompt injection, attackers can manipulate AI agents to escape secure sandboxes and compromise the host machine. The primary threat stems from insecure fallback behaviors and configuration settings within…
-
Operation »Epic Fury» und die digitale Reaktion
Die geopolitische Cyberlage in Europa hat sich seit dem 28. Februar 2026 grundlegend verschärft. Mit der militärischen »Epic Fury«- Operation gegen den Iran hat sich eine latente Bedrohung zu einem aktiven Cyberkonflikt entwickelt. Währenddessen positionieren sich chinesische APT-Gruppen unbemerkt in kritischen Infrastrukturen. Die Cybersecurity-Expertinnen und Experten von InfoGuard berichten in ihrem quartalsweisen Threat Report,… First…
-
Are you satisfied with your current NHI management?
How Secure Are Your Non-Human Identities (NHIs)? With cyber threats evolving, have you considered how effectively you are managing your Non-Human Identities (NHIs)? This crucial aspect of cybersecurity often flies under the radar, overshadowed by more traditional concerns. However, where reliance on cloud services grows, ensuring robust NHI management is not just recommended”, it’s essential.…
-
Axios NPM Package Compromised in Precision Attack
The NPM package for Axios, a popular JavaScript HTTP client library, was briefly compromised this week, possibly by North Korean threat actors. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/axios-npm-package-compromised-precision-attack
-
Google links axios supply chain attack to North Korean group
Google Threat Intelligence Group (GTIG) joined several other researchers in attributing the attack to a North Korean threat actor they call UNC1069. SentinelOne found the same group using macOS-based malware in attacks dating back to 2023. First seen on therecord.media Jump to article: therecord.media/google-links-axios-supply-chain-attack-north-korea
-
TeamPCP Breaches Cloud, SaaS Instances With Stolen Credentials
The threat group’s shift to speedy attacks on AWS, Azure, and SaaS instances shows organizations need to respond quickly to compromised credentials. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/teampcp-breaches-cloud-saas-instances-stolen-credentials
-
Supply chain attack on Axios npm package: Scope, impact, and remediations
Tags: access, api, attack, breach, cloud, control, credentials, crypto, data, data-breach, defense, exploit, incident response, macOS, malicious, malware, open-source, rat, risk, security-incident, software, supply-chain, theft, threat, vulnerability, windowsThe Axios npm package has been compromised in a supply chain attack that uploaded new versions of the package containing malicious code. Any environment that downloaded these compromised Axios versions is at risk of severe data theft, including the loss of credentials and API keys. Scan your environment now. Key takeaways This incident is a…
-
5-month-old F5 BIG-IP DoS bug becomes critical RCE exploited in the wild
/run/bigtlog.pipe and /run/bigstart.ltm and makes changes to system binaries, including /usr/bin/umount and /usr/sbin/httpd. Attackers have also been observed modifying the sys-eicheck utility, which relies on RPM integrity checks to verify on-disk executables.Log analysis can reveal patterns related to the attack. The user “f5hubblelcdadmin” accessing the iControl REST API from localhost, SELinux disable commands in auditd…
-
Attackers hijack Axios npm account to spread RAT malware
Threat actors hijacked the npm account of Axios to distribute RAT malware via malicious package updates. Threat actors compromised the npm account of Axios, a widely used library with over 100M weekly downloads, and published malicious versions to spread remote access trojans across Linux, Windows, and macOS. The supply chain attack was identified by multiple…
-
2026 SANS Identity Threats Report: Why Attacks Still Work
SANS findings highlight the real issue, compromised credentials enable access long before traditional security controls detect a problem. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/2026-sans-identity-threats-report-why-attacks-still-work/
-
Cisco source code stolen in Trivy-linked dev environment breach
Cisco has suffered a cyberattack after threat actors used stolen credentials from the recent Trivy supply chain attack to breach its internal development environment and steal source code belonging to the company and its customers. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/cisco-source-code-stolen-in-trivy-linked-dev-environment-breach/
-
Iran actors’ claims raise questions about larger cyber threat to US, allies
Questions are being raised about the veracity and tactics of Iran-linked actors, amid claims that a large trove of Lockheed Martin data is on the market. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/iran-actors-claims-cyber-threat-us-allies/816228/
-
Why ‘Emerging Threats’ Are Harder to Prioritize in the AI Era
AI is accelerating cyberattacks faster than organizations can prioritize them, forcing security leaders to rethink how they define and defend against “emerging threats.” Most modern threats aren’t new, just amplified by AI, says Akamai’s Brent Maynard. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/emerging-threats-are-harder-to-prioritize-in-ai-era-i-5542
-
AI and Quantum Are Forcing a Rethink of Digital Trust
In a conversation with Dark Reading’s Terry Sweeney, DigiCert CEO Amit Sinha explains how AI-driven identities and quantum threats are reshaping the foundations of digital trust. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/ai-and-quantum-are-forcing-a-rethink-of-digital-trust
-
Latest Xloader Obfuscation Methods and Network Protocol
Tags: api, automation, breach, cloud, communications, credentials, data, detection, email, encryption, framework, google, Internet, malicious, malware, microsoft, network, password, powershell, software, threat, tool, update, windowsIntroduction Xloader is an information stealing malware family that evolved from Formbook and targets web browsers, email clients, and File Transfer Protocol (FTP) applications. Additionally, Xloader may execute arbitrary commands and download second-stage payloads on an infected system. The author of Xloader continues to update the codebase, with the most recent observed version being 8.7. Since…
-
Iran actors claims raise questions about larger cyber threat to U.S., allies
Iran-linked group offers to sell data it claims to have stolen from Lockheed Martin. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/iran-actors-claims-cyber-threat-us-allies/816228/
-
Why ‘Emerging Threats’ Are Harder to Prioritize in the AI Era
AI is accelerating cyberattacks faster than organizations can prioritize them, forcing security leaders to rethink how they define and defend against “emerging threats.” Most modern threats aren’t new, just amplified by AI, says Akamai’s Brent Maynard. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/emerging-threats-are-harder-to-prioritize-in-ai-era-i-5542
-
Why ‘Emerging Threats’ Are Harder to Prioritize in the AI Era
AI is accelerating cyberattacks faster than organizations can prioritize them, forcing security leaders to rethink how they define and defend against “emerging threats.” Most modern threats aren’t new, just amplified by AI, says Akamai’s Brent Maynard. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/interviews/emerging-threats-are-harder-to-prioritize-in-ai-era-i-5542
-
How we made Trail of Bits AI-native (so far)
Tags: access, ai, application-security, attack, automation, blockchain, business, ceo, chatgpt, computer, computing, conference, control, data, email, germany, government, identity, injection, jobs, macOS, marketplace, nvidia, open-source, risk, service, skills, strategy, supply-chain, technology, threat, tool, vulnerabilityThis post is adapted from a talk I gave at [un]prompted, the AI security practitioner conference. Thanks to Gadi Evron for inviting me to speak. You can watch the recorded presentation below or download the slides. Most companies hand out ChatGPT licenses and wait for the productivity numbers to move. We built a system instead.…
-
CISA tells federal agencies to patch Citrix NetScaler bug by Thursday
The bug enables threat actors to send requests that disclose sensitive information and carries a severity score of 9.3 out of 10, indicating a critical risk. First seen on therecord.media Jump to article: therecord.media/cisa-tells-federal-agencies-to-patch-citrix-netscaler-bug
-
Download: 2026 SANS Identity Threats Defenses Survey
New research from the 2026 SANS Identity Threats Defenses Survey shows that 55% of organizations experienced an identity-related compromise last year, while 26% … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/03/31/enzoic-2026-sans-identity-threats-defenses-survey/
-
The AI Arms Race Why Unified Exposure Management Is Becoming a Boardroom Priority
The cybersecurity landscape is accelerating at an unprecedented rate. What is emerging is not simply a rise in the number of vulnerabilities or tools, but a dramatic increase in speed. Speed of attack, speed of exploitation, and speed of change across modern environments.This is the defining challenge of the new era of digital warfare: the…
-
Einbruch war gestern Hacker loggen sich heute einfach ein
Der aktuelle Threat Intelligence Report für das zweite Halbjahr 2025 des Sicherheitsanbieters Ontinue zeigt eine klare Verschiebung im Vorgehen von Cyberkriminellen. First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/hacker-loggen-sich-heute-einfach-ein
-
The external pressures redefining cybersecurity risk
Tags: access, ai, attack, breach, business, ciso, control, cyber, cyberattack, cybersecurity, data, deep-fake, defense, email, governance, guide, incident response, injection, network, nist, resilience, risk, risk-management, supply-chain, technology, threat, toolAI is accelerating both the attackers and your defenses, but governance is often missing : What I see generative AI doing in cybersecurity is accelerating what attackers can do and lowering the cost of entry for new criminal gangs. Cyberattacks are more potent because the technology makes it easier to target victims, create deepfake videos or…
-
The Quantum Clock is Ticking and Your Encryption is Running Out of Time
With 90% of organizations unprepared for quantum threats, the shift to post-quantum cryptography (PQC) is a structural necessity. Explore the “harvest now, decrypt later” risk and the NIST PQC standards. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/03/the-quantum-clock-is-ticking-and-your-encryption-is-running-out-of-time/
-
6 key takeaways from RSA Conference 2026
Tags: ai, api, attack, ceo, cio, ciso, compliance, conference, control, cyber, cybersecurity, data, framework, google, governance, government, identity, infrastructure, injection, intelligence, jobs, LLM, office, RedTeam, regulation, risk, saas, service, technology, threat, tool, trainingSecuring the AI stack: Yes, but the threat surface has grown: The first technical priority I offered for CISOs in my conference preview was securing the AI stack, RAG workflows, LLM data pipelines, vector databases, and model APIs, on the basis that prompt injection, training data poisoning, and model inversion attacks were no longer theoretical.The…