Supply chain

Attackers hijack legitimate commands and run malicious code to launch supply chain attacks.

Such escalating threats, which are exacerbated by being increasingly undetected by traditional security software, have not corresponded to improved security practices, with 95% of flawed OSS components still being downloaded during the past year despite the availability of more secure versions, according to a study from Sonatype.

Despite immediate action to thwart unauthorized access and enforce security measures, ADT had some encrypted employee data stolen as a result of the incident, said the firm in a filing with the Securities and Exchange Commission.

Such packages leveraged in the attacks had their legitimacy established by fraudulent statistics and included malicious code distributed across several dependencies to better evade detection.

Threat actors leveraged the zero-day to infiltrate three of Rackspace's internal monitoring web servers with the ScienceLogic app and the third-party utility, facilitating access to customers' account names and numbers, usernames, Rackspace internally generated device IDs, device names and IP addresses, and AES256 encrypted Rackspace internal device agent credentials.

More than 3.1 million individuals were confirmed by the Centers for Medicare & Medicaid Services to have had their information compromised as a result of the widespread MOVEit hack conducted by the Cl0p ransomware operation against Medicare admin services provider Wisconsin Physicians Service last year.

Apple drops a lawsuit to avoid exposing secrets, what does it mean for the security industry if MS locks down the kernel?, exploding pagers, more things from the past: Adobe Flash exploits, robots get rid of your data, PKFail is still a thing, Android TV malware is back: now with conspiracy theories, DMA attacks, gamers are not nation-state attacke...

As high-profile attacks on the software supply chain, such as the 2023 MOVEit and 3CX breaches, continue to demonstrate, supply chain blind spots can expose businesses to catastrophic risks.