Russia's Interior Ministry has announced that a trio of "young IT specialists" allegedly involved in the development, distribution, and deployment of the Meduza information-stealing malware have been arrested by the Russian National Guard, The Register reports.
Open VSX had a limited number of tokens exposed within the VSCode extensions revoked by project maintainer Eclipse Foundation following a Wiz report detailing the compromise of Open VSX and VSCode extensions with the GlassWorm malware as part of a supply chain intrusion, reports The Hacker News.
BADCANDY webshell spread via vulnerable Cisco IOS XE device targeting Threat actors were reported by the Australian Signals Directorate to have launched attacks exploiting the maximum severity Cisco IOS XE vulnerability, tracked as CVE-2023-20198, to deliver the BADCANDY webshell, according to Security Affairs.
Suspected state-backed threat operation CL-STA-1009 has spread the new Airstalk malware in what is believed to be a supply chain attack campaign against the business process outsourcing sector, The Hacker News reports.
