[SPONSOREDNUBIVANCE]
Rapid7 deployed right the first time.
Full-platform Rapid7 rollouts - InsightVM, InsightIDR, event sources, agents, tuning - by a Registered Partner who has done it at state-agency scale, including OT/SCADA.
Talk deploymentSupply Chain Attacks
Attackers Hijack AOMEI Backupper's Update Servers to Deploy Backdoor
In a shocking security breach, attackers hijacked AOMEI Backupper's update servers for just a few minutes on three separate occasions, deploying a sneaky backdoor to unsuspecting users who checked for updates during that time. This tiny window of opportunity was all the hackers needed to compromise the system, thanks to a vulnerability in AOMEI's update process.
Ledger Halts Asia Sales After Supply-Chain Attack Compromises Wallets
Trezor is stepping up its game to protect users, implementing a stricter legal framework and tighter checks on device sourcing, storage, and handling. Ledger, meanwhile, is warning users to be vigilant after discovering that devices sold by a Southeast Asian reseller had been compromised, allowing thieves to steal cryptocurrency recovery phrases.
AI Agents Expose Vulnerability Via Software Supply Chain
The software supply chain has just proven to be a weak link in the security chain, as AI agents are exposing vulnerabilities through compromised tools and dependencies. Experts warn that verifying the source and integrity of these components is crucial to preventing such breaches.
Ledger Exposes Supply-Chain Attack Behind Crypto Theft
Ledger just confirmed a shocking case of tampering behind recent crypto thefts, tracing the issue to a single reseller, CryptoBilis, and finding an unauthorized hardware implant in one user's device. The company is now working with authorities to catch the culprit and reach out to affected users.
Ukraine Strikes Disrupt Yandex Datacenters, Knocks Cloud Services Offline
Ukrainian drone strikes have severely disrupted Yandex's operations, damaging three of its Russian datacenters and taking several cloud services offline. Engineers are working tirelessly to restore services, but for now, users are facing significant downtime.
GitHub Repositories Targeted in Credential-Stealing Workflow Attack
Malicious actors have launched a sneaky credential-stealing attack on GitHub repositories, using hijacked accounts to spread a malicious workflow that hit 345 repositories in just a few hours. The GhostAction campaign is back with a vengeance, putting developer credentials at risk.
Web3 Enables Sophisticated Cloud Supply Chain Attacks
Malware authors are now using blockchain technology to launch devastating cloud supply chain attacks, as seen in the ChainDrop attack that infected over 400 npm packages. This sneaky tactic uses a custom runtime to launch a credential harvester, allowing attackers to capture sensitive cloud provider IAM keys and more.
Malicious npm Packages Deliver Overlord RAT and Stealer in Supply Chain Attack
A single malicious npm package, "function-flag," was downloaded a staggering 37,419 times in a supply-chain operation that delivered Remote Access Trojans and information stealers to Windows hosts. This was part of a larger campaign, dubbed MALFEX, where 12 packages were published to the npm registry since August 2023, with eight of them flagged as malicious and collectively downloaded over 40,767 times.
Financial Firms' Software Supply Chain Vulnerability Backlog Reaches Crisis Point
The financial services sector is facing a crisis point as a massive backlog of software supply chain vulnerabilities has finally caught up with it, with exploitation now overtaking phishing as the top breach threat. For years, firms tolerated this risk due to legacy systems, regulatory pressures, and the need for ultra-reliability, but attackers have changed the game.
Malicious npm Packages Evade Detection by Hiding in Runtime Code
A sneaky malicious npm package, indexed-btree, has been hiding in plain sight by disguising its loader inside ordinary library code, allowing it to evade detection and rack up millions of downloads. This cleverly crafted package mimicked a legitimate B-tree utility, but with a sinister twist that went undetected until it was removed from the npm registry.
Attackers Exploit npm Trusted Publishing in GHAPPIER Supply Chain Campaign
Malicious actors have cleverly exploited npm's trusted publishing feature to unleash a supply-chain attack, using a hijacked maintainer account to distribute a sneaky loader called GHAPPIER. They got away with it by hiding behind a valid provenance attestation, highlighting a loophole in the system.
Malicious npm packages exploit runtime evasion tactics
Meet the sneaky npm package that impersonated a popular library, racking up 2 million weekly downloads before revealing its true malicious intent. This cleverly disguised package, indexed-btree, hid its payload in plain sight, masquerading as a legitimate tool until it was too late.
TanStack npm Attack Exposes 170 Private GitHub Repositories
A shocking npm attack on TanStack exposed a massive 170 private GitHub repositories after a malicious actor exploited a stolen OAuth token from a former employee's account. The breach was linked to a supply-chain compromise of TanStack's npm packages, tracked as CVE-2026-45321, which allowed attackers to steal sensitive credentials.
AI Coding Agents Expose Zero-Click Flaw
A newly discovered vulnerability, dubbed Plugin4Shell, allows attackers to execute remote code with just a single click - or none at all - giving them carte blanche access to sensitive data and assets. This zero-click flaw in AI coding agents highlights the urgent need for updated security measures to prevent devastating supply-chain attacks.
Threat Actors Target AI Coding Tools in Software Supply Chain Compromises
Threat actors are increasingly targeting AI coding tools to compromise software supply chains, with financially motivated groups like UNC6780 using malware like Dustmaker to gain initial access to AI environments. This growing trend highlights the need for heightened security measures in modern AI development pipelines.
UK Food Supply Chain Faces Rising Cyberattack Threats
The UK food supply chain is under growing threat from cyberattacks, with the National Audit Office warning that the sector's drive for efficiency has also increased its vulnerability to disruption. Cyber threats are rising in likelihood and severity, and experts are urging the government to strengthen emergency preparedness plans.
[SPONSOREDNUBIVANCE]
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scramble
AI Coding Agents Expose Corporate Networks to Untrusted Code
The alarming truth is that AI coding agents are unwittingly putting corporate networks at risk by blindly trusting untrusted code, leaving them vulnerable to security breaches. Thousands of agent manifest files have already been uncovered in a wide scan of corporate domains, exposing a massive supply-chain surface that's not adequately protected.
Australian Police Disrupt TeamPCP Hacking Group Behind Global Supply-Chain Attacks
Australian authorities have made a major breakthrough in the fight against global supply-chain attacks, arresting two men linked to the notorious TeamPCP hacking group. The suspects, aged 21 and 23, were taken into custody after a year-long investigation into a string of devastating developer supply-chain intrusions.
Australia Charges Two in TeamPCP Cybercrime Case Tied to Supply Chain Attacks
In a major breakthrough, the Australian Federal Police charged two men with 14 offences for their alleged roles in the notorious TeamPCP cybercrime syndicate, which compromised over 1,000 organizations worldwide and stole more than 500,000 credentials. The suspects, aged 23 and 21, were arrested and appeared in court after a joint operation seized electronic devices for forensic analysis.
Supply Chain Attacks Target SDLC's Overlooked Corners
Meet the ChainDrop npm worm, a sneaky threat that infiltrated over 400 packages, including popular libraries like keyv and cacheable-request, by hiding in plain sight within routine developer workflows. This highly evasive threat uses a three-step chain to steal sensitive tokens and secrets, spreading its reach with alarming ease.
Rust Crates Targeted in Supply Chain Attack to Steal Developer Credentials
For a brief but alarming period, a widely-used Rust package was compromised, funneling malicious code into developer machines and putting sensitive credentials at risk. The attack was launched through a cleverly hidden payload in the build script of a popular crate called proc-macro1.
North Korean Hackers Target Rust Supply Chain
North Korean hackers have been caught targeting the Rust supply chain, compromising a trusted open-source maintainer's account to sneak a backdoor into three popular Rust crates. The attackers cleverly modified package manifests to download and execute an unauthorized payload during automated builds.
Rust Crates.io Supply Chain Hit by Build-Time Malware Attack
A single compromised account on Rust's Crates.io led to a cunning malware attack, with an attacker using the popular arrayref crate - which has been downloaded over 245 million times - to spread build-time malware to unsuspecting users through malicious package releases. The attack was swiftly contained, with the Rust Project removing the compromised releases within 86 to 107 minutes of their publication.
AI Agent's Package Suggestion Exposes Malware Risk
An AI agent's seemingly harmless package suggestion nearly led to a malware disaster for Softjourn, highlighting a growing concern known as "slopsquatting" where AI models invent convincing but fake package names. Thankfully, the company's vigilant policy of double-checking AI recommendations saved the day.