Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Supply Chain. Show all posts
Technology
Apple iPhone Mac Supply Chain Technology

Apple Warns of Supply Crunch as Demand Surges

 

Apple’s issue is a supply crunch: strong demand for iPhones and Macs is outpacing the company’s ability to secure key components, especially advanced chips and memory. The BBC report says Apple warned this could hit revenue in the coming months and that supply constraints are already limiting flexibility in the chain. 

What is happening 

Apple said the core problem is not weak demand but the opposite — sales are running hotter than expected, particularly for iPhone and Mac products. The company described the supply situation as “very significant,” with little room to quickly fix it. That means Apple can sell more devices than it can comfortably produce, which creates delays, pressure on inventory, and a risk of missed sales. 

The shortage affects some of Apple’s most important products, so even a strong quarter can come with a weaker outlook. Apple’s shares fell after the warning because investors tend to react sharply when a company says future growth may slow. The BBC also noted that Apple has already raised prices on some products, showing how supply costs are beginning to affect customers.

A major part of the problem is the cost and availability of memory chips, which have surged in price due to broader industry demand, including AI-related hardware needs. Reuters reported that Apple is also dealing with bottlenecks in advanced chipmaking technology used in its Apple silicon chips. In practical terms, this means Apple may have to pay more for parts, accept tighter margins, or pass costs on to buyers. 

Financial impact 

Despite the warning, Apple’s recent results were still strong, with iPhone and Mac sales rising sharply. But the company signaled that the next quarter may not keep pace if component shortages persist. That is why the story is less about a current collapse and more about a future squeeze on growth. 

Apple’s problem reflects a bigger technology trend: demand for chips is rising across consumer devices and AI infrastructure at the same time. When a company as large as Apple struggles to source parts, it often signals pressure across the wider electronics supply chain. In this case, the issue is a mix of extraordinary demand, limited supply flexibility, and rising component prices.
Read more »
UK Retail
Chinese Robots Innovation Supply Chain Technology UK Retail

UK Retail Turns to Chinese Robots

 

Britain’s retail industry is entering a new phase of automation as Chinese robotics companies step in to fill growing labour gaps. With productivity growth still weak and businesses struggling to hire enough workers, robots are no longer being viewed as a distant innovation but as a practical response to everyday problems. In shops, warehouses, and distribution centres, machines are beginning to take on tasks that once depended heavily on human labour. This shift is being driven not only by cost pressures but also by a wider need for speed, consistency, and efficiency across the supply chain. 

For many retailers, the appeal of robotics is straightforward. Rising wages, staff shortages, and tight margins have made it harder to run operations in the traditional way. Automated systems can help with stock movement, sorting, cleaning, delivery preparation, and other repetitive work that does not always require human judgement. Chinese firms, which have become major players in industrial automation, are increasingly offering affordable and adaptable solutions. Their expanding presence in the UK reflects both the maturity of China’s robotics sector and the urgency felt by British businesses looking for new ways to stay competitive. 

The technology is also changing how retailers think about the future of work. Instead of replacing entire teams, many companies are using robots to support employees and handle the dullest or most physically demanding tasks. That can free staff to focus on customer service, problem-solving, and higher-value responsibilities. At the same time, the rollout of robots raises questions about training, investment, and whether smaller businesses will be able to keep up. The transition may be uneven, with larger chains adopting automation faster than independent shops or regional operators. 

Supporters of the trend argue that robotics could help strengthen the retail sector at a time when the UK urgently needs higher productivity. If machines can reduce delays, lower operating costs, and improve accuracy, businesses may become more resilient in an increasingly competitive market. Critics, however, warn that automation should not become a shortcut that ignores the need for better wages, stronger workforce planning, and long-term investment in people. The real challenge is finding a balance where technology boosts performance without deepening economic inequality. 

Ultimately, the rise of Chinese robot makers in British retail signals a broader transformation already underway across global commerce. What began as a response to shortages is evolving into a structural change in how stores and warehouses function. The question is no longer whether robots will be part of retail, but how quickly businesses can adapt to working alongside them. As the UK seeks new paths to growth, the retail floor may become one of the clearest places to see the future of labour taking shape.
Read more »
Supply Chain
Bitcoin Crypto Wallet Cyber Security Ethereum Supply Chain

Hackers Compromise Organization to Swap Crypto Wallet Address In A Supply Chain Attack


Threat actors exploited a JavaScript file offered by advertising technology firm Adform, and modified it into a browser-side tool that rewrites crypto wallet addresses.

Malicious script

Adform found the incident and removed the malicious code, informed the impacted clients, and notified the authorities.

For users who visited a website carrying the modified script on July 27 and copied Ethereum, Tron, or Bitcoin may have deployed malicious code by pasting the a different address.

What should the users do?

Adform has advised users to clean their browser cache as the modified file may stay cached after the fix, and to also double-check any wallet address before sending any money.

According to Adform, the code was not built to deploy software or create persistence and worked only when an affected page stayed open. Clipboard copying was not the only method of replacement; the captured sample also rewrites addresses entered straight into form fields. 

According to Adform’s implementation document, the tracking code can run across a website, several sections, or even a single page. Exploiting the shared resource allowed the hackers a path into downstream websites without having to hack each one of them. Supply chain compromise happened due to the shared deployment path. 

Shared path leading to supply chain attack

One modified address at the point of payment could change a transfer, as the impacted page stayed open.

Security expert Beaumont discovered the hack and said, "Even if you notice the address is wrong and recopy the wallet, it keeps replacing it.”

Beaumont also said that “this allows end user devices of downstream websites to be compromised with crypto stealing malware. Meaning if you visit example.com and they use Adform, example.com will compromise your device.” The file and linked domains, IP addresses, and URLs showed no detections on VirusTotal at the time. 

The discovered sample consists of two malicious blocks attached to the authentic library. Their replacement strings are hidden with a six-byte XOR key. The first looks out for the copy event, attempts to read the clipboard every four seconds, and to replace matching addresses.

The second block rewrites values in textarea, contenteditable elements, and input, and restores the cursor point after a rewrite.

“Based on our investigation to date, we have found no evidence that the malicious code transmitted users’ IP addresses or information about the websites they visited to an external party. Technical analysis indicates that such transmission may have been possible, and this aspect remains under investigation,” says Adform.

Read more »
worm
Block Chain Canister Cybersecurity malware Supply Chain worm

CanisterWorm Campaign Combines Supply Chain Attack, Data Destruction, and Blockchain-Based Control

 



Malware that can automatically spread between systems, commonly referred to as worms, has long been a recurring threat in cybersecurity. What makes the latest campaign unusual is not just its ability to propagate, but the decision by its operators to deliberately destroy systems in a specific region. In this case, machines located in Iran are being targeted for complete data erasure, alongside the use of an unconventional control architecture.

The activity has been linked to a relatively new group known as TeamPCP. The group first appeared in reporting late last year after compromising widely used infrastructure tools such as Docker, Kubernetes, Redis, and Next.js. Its earlier operations appeared focused on assembling a large network of compromised systems that could function as proxies. Such infrastructure is typically valuable for conducting ransomware attacks, extortion campaigns, or other financially driven operations, either by the group itself or by third parties.

The latest version of its malware, referred to as CanisterWorm, introduces behavior that diverges from this profit-oriented pattern. Once inside a system, the malware checks the device’s configured time zone to infer its geographic location. If the system is identified as being in Iran, the malware immediately executes destructive commands. In Kubernetes environments, this results in the deletion of all nodes within a cluster, effectively dismantling the entire deployment. On standard virtual machines, the malware runs a command that recursively deletes all files on the system, leaving it unusable. If the system is not located in Iran, the malware continues to operate as a traditional worm, maintaining persistence and spreading further.

The decision to destroy infected machines has raised questions among researchers, as disabling systems reduces their value for sustained exploitation. In comments reported by KrebsOnSecurity, Charlie Eriksen of Aikido Security suggested that the action may be intended as a demonstration of capability rather than a financially motivated move. He also indicated that the group may have access to a much larger pool of compromised systems than those directly impacted in this campaign.

The attack chain appears to have begun over a recent weekend, starting with the compromise of Trivy, an open-source vulnerability scanning tool frequently used in software development pipelines. By gaining access to publishing credentials associated with Node.js packages that depend on Trivy, the attackers were able to inject malicious code into the npm ecosystem. This allowed the malware to spread further as developers unknowingly installed compromised packages. Once executed, the malware deployed multiple background processes designed to resemble legitimate system services, reducing the likelihood of detection.

A key technical aspect of this campaign lies in how it is controlled. Instead of relying on conventional command-and-control servers, the operators used a decentralized approach by hosting instructions on the Internet Computer Project. Specifically, they utilized a canister, which functions as a smart contract containing both executable code and stored data. Because this infrastructure is distributed across a blockchain network, it is significantly more resistant to disruption than traditional centralized servers.

The Internet Computer Project operates differently from widely known blockchain systems such as Bitcoin or Ethereum. Participation requires node operators to undergo identity verification and provide substantial computing resources. Estimates suggest the network includes around 1,400 machines, with roughly half actively participating at any given time, distributed across more than 100 providers in 34 countries.

The platform’s governance model adds another layer of complexity. Canisters are typically controlled only by their creators, and while the network allows reports of malicious use, any action to disable such components requires a vote with a high approval threshold. This structure is designed to prevent arbitrary or politically motivated shutdowns, but it also makes rapid response to abuse more difficult.

Following public disclosure of the campaign, there are indications that the malicious canister may have been temporarily disabled by its operators. However, due to the design of the system, it can be reactivated at any time. As a result, the most effective defensive measure currently available is to block network-level access to the associated infrastructure.

This campaign reflects a convergence of several developing threat trends. It combines a software supply chain compromise through npm packages, selective targeting based on inferred geographic location, and the use of decentralized technologies for operational control. Together, these elements underline how attackers are expanding both their technical methods and their strategic objectives, increasing the complexity of detection and response for organizations worldwide.

Read more »
Villager
AI software Cyber Security Hacking Supply Chain Villager

Villager: AI Software That Makes Hacking Easier

 


A new penetration testing framework named Villager is drawing international attention for its unusual mix of traditional hacking tools and artificial intelligence. Released in July 2025 through the Python Package Index, the tool has already surpassed 10,000 downloads in just two months, making it one of the fastest-spreading AI-assisted security applications this year.


What Villager Does

At its core, Villager is designed to make penetration testing simulated hacking used to expose system weaknesses more automated. Instead of relying on step-by-step scripts or specialized technical input, it allows users to type simple text commands. These commands are then processed by AI, which translates them into detailed attack sequences. For instance, asking the system to “scan a website for flaws” triggers a chain of actions: launching a containerized Linux environment, running vulnerability scans, and selecting suitable exploits based on what is uncovered.

Villager is built around a distributed architecture that splits its work across different services. A message coordination service, operating on a dedicated port, directs activity. The decision-making engine draws on a library of more than four thousand AI-generated prompts to guide exploit attempts. Each task is carried out inside temporary containers, self-contained systems that disappear after 24 hours. This setup not only automates penetration testing but also makes it harder to trace activities since logs are deleted and network ports are randomized.


Why Experts Are Alarmed

While Villager is being presented as a red-team tool for ethical testing, its design makes it equally attractive to malicious actors. Security researchers warn of parallels with older software like Cobalt Strike, which began as a legitimate testing framework but was widely repurposed by attackers. Villager’s ability to adapt attacks in real time, evade forensic tracking, and lower the technical barriers for launching sophisticated campaigns means that less-skilled individuals could now carry out advanced intrusions with minimal effort.


Risks for Organizations

Because Villager is publicly available through an official software repository, it increases the chance that attackers could blend its use with everyday development processes. This raises supply chain risks, especially for companies using automated pipelines or shared workstations. Faster attack lifecycles, harder attribution, and the wide availability of the tool add up to a new challenge for enterprise defenders.


Protective Measures

Experts recommend organizations strengthen defenses immediately. This includes monitoring for unusual container activity, restricting external package installations, and enhancing incident response logs. Some also suggest deploying security gateways capable of inspecting Model Context Protocol traffic, which can detect and block malicious AI-driven commands before they escalate.

Villager represents both a technological milestone and a serious warning sign. As the boundaries between AI research and offensive security continue to blur, organizations will need to stay one step ahead to protect themselves from tools that automate the very attacks they seek to defend against.



Read more »
Supply Chain
Cyber Attacks highlighting Automotive Cybersecurity risks IT Systems Jaguar Land Rover Cybersecurity Breach disrupts Production Manufacturing Retail Operations Supply Chain

Cybersecurity Breach Leads to Major Disruption at Jaguar Land Rover


 

In a major cybersecurity incident which has caused major disruption to the operations of Jaguar Land Rover, it highlights the growing vulnerability of automakers across the world to cyberattacks, underlining the increasing need to maintain communication channels between automakers and their customers. 

In a statement released on September 2, the British luxury car manufacturer said that the attack had severely disrupted its core computer systems. This led to the suspension of production across the company's UK assembly plants and ripple effects throughout the entire organisation, including global operations, supply chain coordination, and manufacturing engineering. 

Having taken proactive measures to counter the threat, JLR disabled several key systems, resulting in widespread problems in how suppliers and logistics partners could communicate in real-time with one another.

Although the company has not yet provided any details concerning the ransomware or any other forms of malicious code that were responsible for the breach, the company has stated that its internal security experts are working closely with external cyber experts to investigate it, with critical systems currently being restored in a "controlled fashion" under the guidance of external cyber experts.

A major impact of the disruption has already been felt by Jaguar Land Rover’s workforce and production schedule. The Halewood plant, located near Liverpool, was instructed to close early Monday morning via email. Local news reports indicate that the shutdown will continue until midweek, as local reports have suggested. 

There have been a number of issues that have affected the company’s manufacturing operations, but also its retail outlets, which have disrupted the flow of vehicles to customers in the wake of the incident. A JLR official statement confirmed that the company was dealing with a “cyber incident” and that critical systems had been shut down promptly to contain the situation. 

However, the automaker stressed that, although there are ongoing investigations into the issue, there is no indication that any customer data has been compromised at the moment. Although the company acknowledged that both retail and production activities have been severely disrupted, it explained that global applications are gradually being restored in a controlled manner, a process that it described as controlled. 

Last year, JLR generated revenues of more than £28.99 billion ($38.75 billion), employing over 39,000 people across the globe. However, recent financial struggles have resulted in a 49 per cent drop in pre-tax profits for the company in the second quarter, owing in part to the fact that U.S. exports are slowed by tariffs. 

In addition to this attack, JLR has also joined Marks & Spencer, the Co-op, and Harrods among the growing list of high-profile British brands targeted by cyber attacks this year, adding the retailer to the list. In a recent report, the cyberattack is reported to have begun on Sunday, coinciding with the beginning of September, a time when the automotive industry in the UK is experiencing heightened importance, due to the introduction of new registration plate identifiers. 

A biannual change in vehicle prices usually occurs in March and September, and it is widely acknowledged as one of the most important promotional windows for manufacturers, as it drives a significant surge in vehicle sales. Therefore, the disruption has come at a particularly sensitive time for Jaguar Land Rover, since a large portion of the company's annual sales are attributed to these particular months, which are more critical than usual.

As reported by the BBC, the automaker discovered the attack while it was still unfolding, which prompted it to shut down potentially affected IT systems to limit the consequences. In its statement issued on 2 September, Jaguar Land Rover confirmed that work is underway to return global applications to service in a controlled manner. 

Even though retail and production operations remain severely affected, no evidence has been found that customer data has been compromised. There is a growing vulnerability in highly digitalised manufacturing environments, according to industry experts, and the incident underscores that. As a result of the integration of IT with operational technology, a single breach can freeze entire plants and ripple through the entire supply chain in a matter of seconds. 

As a result of any downtime, suppliers, retailers, and their partners are affected by loss of production, delayed sales, and disruptions. During his recent comment, Dray Agha, Senior Manager of Security Operations at Huntress, expressed his opinion that this example illustrates how one single IT system attack could shut down a multi-billion-dollar production line, causing direct sales to be negatively impacted, especially during a key period like a new registration period. 

It has been reported by SecurityScorecard’s Chief Threat Intelligence Officer, Ryan Sherstobitof, that in addition to forcing the shutdown of JLR’s Solihull factory, the cyberattack also prevented dealers in the UK from registering new cars and supplying parts. With no information available from the company as to what caused the breach or when it was expected to recover, the company did not provide details on the situation. 

After a cyber incident in March involving Jaguar Land Rover, which claimed that hackers had stolen the source code and tracking data, the disruption marks the second cyber incident to have struck Jaguar Land Rover this year. This recurrence raised concerns about the possibility of exploiting vulnerabilities that were previously exposed in the earlier breach, said Nick Tausek, Lead Security Automation Architect at Swimlane.

It is also important to emphasise, according to other cybersecurity specialists, that this episode highlights the urgency of strengthening cyber hygiene, robust authentication and authorisation practices, as well as tightening data flow protections. "Cyber resilience is fundamental to overall business resilience," said Jon Abbott, CEO of ThreatAware. He said that disruptions can be hugely destructive to a business. 

There are many manufacturers in the manufacturing sector that are so heavily dependent on the uptime of their operations that they would never want to become the subject of future headlines regarding cyber incidents. The recent developments at Jaguar Land Rover serve as a timely reminder that cybersecurity is no longer just a peripheral concern, but rather a vital component of operational continuity. 

It is becoming increasingly important for digital infrastructure to have resilience as cars become increasingly connected and production systems become more deeply intertwined with global supply chains, which has a direct impact on market stability and customer confidence. 

Manufacturers can do their part not just by implementing reactive containment measures, but also by investing in proactive measures—enhancing endpoint protection, implementing layered defences, and conducting rigorous penetration tests to identify hidden vulnerabilities in their systems. In addition to technology, it is equally important to cultivate a culture of cyber awareness throughout the organisation in order to ensure that every employee understands their role in safeguarding critical systems, regardless of the technology they use. 

It's widely believed that companies which embed cyber resilience into the very core of their business DNA will gain a competitive advantage over their peers in the long run. Investors and consumers alike will gravitate towards brands which can demonstrate resilience when dealing with ever-evolving digital threats. Ultimately, the incident represents more than a disruption, as it also highlights the need for cybersecurity to be deemed just as important as innovation, safety, and sustainability in the automotive industry as a whole.
Read more »
Vulnerabilities and Exploits
Business Security Data I/O Ransomware attack Supply Chain Vulnerabilities and Exploits

Data I/O Ransomware Attack Exposes Vulnerability in Global Electronics Supply Chain

 

Data I/O, a leading manufacturer specializing in device programming and security provisioning solutions, experienced a major ransomware attack in August 2025 that crippled core operations and raised industry-wide concerns about supply chain vulnerabilities in the technology sector.

The attack, first detected on August 16, 2025, used a sophisticated phishing campaign to compromise network credentials, enabling the attackers to exploit vulnerabilities in the company’s remote access systems and achieve lateral movement across network segments. 

This incident resulted in the encryption of critical proprietary data, including chip design schematics, manufacturing blueprints, sensitive communications, and firmware for products used by major clients such as Amazon, Apple, Google, and automotive manufacturers. 

Attack methodology 

Investigations mapped the attack to multiple MITRE ATT&CK techniques: T1566 for phishing, T1021 for remote services exploitation, T1486 for impact via data encryption, and possible use of T1078 via valid accounts. The attackers sent deceptive emails to Data I/O employees that tricked users into surrendering network credentials or accessing malicious links. After gaining access, the adversaries leveraged weaknesses in remote connectivity protocols to move laterally and encrypt essential files.

The ransomware incident caused widespread disruptions: internal and external communications, shipping, receiving, manufacturing production lines, and support functions were all impacted. The company activated incident response protocols, isolating affected systems and proactively taking critical platforms offline to prevent further spread. As of late August, some systems remained offline, without a clear timeline for full restoration. 

Broader implications 

Data I/O’s strategic role as a supply chain hub in electronics manufacturing made it a disproportionate target. Disruption reverberated across technology, automotive, and IoT sectors due to the company’s handling of security credentials and firmware for multi-billion-dollar products.

The incident underscores how ransomware operators increasingly target manufacturing entities, exploiting supply chain vulnerabilities to extract ransoms and maximize operational harm. The attackers reportedly demanded a ransom of $30 million, threatening to release encrypted data publicly if payment was not made within 72 hours. 

Data I/O engaged external cybersecurity experts and forensic professionals, initiated a full-scale investigation, and pledged transparency as more details emerged. The incident highlights urgent needs for improved remote access security, robust phishing defenses, and faster detection and response capabilities across the technology manufacturing sector. 

Analysts warn this attack may foreshadow future campaigns targeting critical infrastructure and high-tech supply chains, stressing the necessity for more resilient cybersecurity strategies.
Read more »
Supply Chain
Archive Cyber Security Open Source PyPI Supply Chain

PyPI's New Archival Feature Addresses a Major Security Flaw

 

The Python Package Index (PyPI) has informed users that no modifications are expected with the launch of "Project Archival," a new method that enables publishers to archive their projects. To assist users in making informed decisions regarding their dependencies, users will still be able to download the projects from PyPI, but they will be alerted of the maintenance status. 

The new tool aims to strengthen supply-chain security, as hacking developer accounts and sending malicious updates to widely used but abandoned projects is a typical occurrence in the open-source community. In addition to minimising user risk, it lowers support requests by guaranteeing clear communication of the project's lifecycle state. 

Project archiving modus operandi 

According to a detailed blog post by TrailofBits, the developer of PyPI's new project archival system, the feature includes a maintainer-controlled status that enables project owners to declare their projects as archived, informing users that there will be no more updates, patches, or maintenance. 

Although it is not mandatory, PyPI advises maintainers to publish a final version prior to project archiving in order to provide information and justifications for the decision. If the maintainers decide to pick up where they left off, they can unarchive their project whenever they like. 

Under the hood, the new system employs a LifecycleStatus model, which was initially designed for project quarantine and includes a state machine that allows for modifications between different states. 

When the project owner selects the 'Archive Project' option on the PyPI settings page, the platform automatically updates the metadata to reflect the new state. According to TrailofBits, there are plans to add other project statuses such as 'deprecated,' 'feature-complete,' and 'unmaintained,' giving users a better understanding of the project's status. 

The purpose of the warning banner is to alert developers to the need of identifying actively maintained alternative dependencies rather than sticking with out-of-date and potentially insecure projects. In addition, cybercriminals frequently target abandoned packages, taking over unmaintained projects and injecting malicious code via an update that may arrive many years after the last one. 

When deciding to halt work, maintainers sometimes decide to delete their projects, which might result in situations like "Revival Hijack" attacks. From a security standpoint, it is more preferable to provide those maintainers the option to archive. 

Ultimately, a lot of open-source projects are abruptly discontinued, leaving consumers to wonder if they are still being maintained. The new system eliminates uncertainty and gives a clear indication of a project's state, which should increase transparency in open-source project management.
Read more »
Supply Chain
Blue Yonder Cyber Security Ransomware Supply Chain

Blue Yonder Recovers from Ransomware Attack, Focuses on Resilience

 

Blue Yonder, a leading provider of supply chain solutions, is making steady progress in recovering from a ransomware attack that disrupted services for several of its clients.

On November 21, the company was targeted by a ransomware attack that impacted a significant number of customers. As of now, Blue Yonder has reported substantial progress in restoring its systems. Most affected clients are operational again, with additional recovery efforts ongoing.

A cybercrime group known as Termite has claimed responsibility for the attack. In response, Blue Yonder engaged law enforcement and cybersecurity experts to conduct a comprehensive investigation. While details of the breach remain unclear, the company remains committed to identifying the root cause and fortifying its systems against future incidents.

Impact on Key Clients

The ransomware attack affected major clients, including:

  • Starbucks: The coffee giant, which relies on Blue Yonder’s technology for employee scheduling, faced disruptions that forced a temporary shift to manual processes. Despite these challenges, Starbucks confirmed that its internal systems were not directly compromised. By December 13, the scheduling platform was fully restored.
  • Morrisons: The UK-based supermarket chain experienced interruptions in its warehouse management system for fresh goods. The issue has since been resolved, and Morrisons has resumed normal operations.

Commitment to Clients and Cybersecurity

Blue Yonder serves a diverse clientele, including retailers, logistics firms, manufacturers, and supermarket chains. This incident underscores the critical role such technology providers play in ensuring seamless supply chain operations.

To reaffirm its commitment, Blue Yonder is prioritizing enhanced cybersecurity measures to mitigate vulnerabilities and build greater resilience into its platforms. The company continues to work diligently to restore trust and minimize potential future disruptions.

The recent ransomware attack highlights the growing sophistication of cyber threats. Businesses must adopt proactive measures to safeguard their operations, particularly in the face of increasingly complex ransomware schemes. For essential technology providers like Blue Yonder, maintaining robust defenses is paramount to delivering uninterrupted services and retaining client confidence.

Read more »
supply chain security
Cyber Attacks Ransomware attack Ransomwares Software Providers Supply Chain supply chain attacks supply chain security

Ransomware Attack on Blue Yonder Disrupts Global Supply Chains

 

Blue Yonder, a leading supply chain software provider, recently experienced a ransomware attack that disrupted its private cloud services. The incident, which occurred on November 21, 2024, has affected operations for several high-profile clients, including major grocery chains in the UK and Fortune 500 companies. While the company’s Azure public cloud services remained unaffected, the breach significantly impacted its managed services environment. The attack led to immediate operational challenges for key customers. UK supermarket chains Morrisons and Sainsbury’s were among the most affected. 

Morrisons, which operates nearly 500 stores, reported delays in the flow of goods due to the outage. The retailer activated backup systems but acknowledged that its operations were still disrupted. Sainsbury’s similarly implemented contingency plans to address the situation and minimize the impact on its supply chain. In the United States, Blue Yonder serves prominent grocery retailers such as Kroger and Albertsons, though these companies have not confirmed whether their systems were directly affected. 

Other notable clients, including Procter & Gamble and Anheuser-Busch, also declined to comment on any disruptions they might have faced as a result of the attack. In response to the breach, Blue Yonder has enlisted the help of external cybersecurity firms to investigate the incident and implement stronger defenses. The company has initiated forensic protocols to safeguard its systems and prevent further breaches. While recovery efforts are reportedly making steady progress, Blue Yonder has not provided a timeline for full restoration. The company continues to emphasize its commitment to transparency and security as it works to resolve the issue. 

This attack highlights the growing risks faced by supply chain companies in an era of increasing cyber threats. Disruptions like these can have widespread consequences, affecting both businesses and consumers. A recent survey revealed that 62% of organizations experienced ransomware attacks originating from software supply chain vulnerabilities within the past year. Such findings underscore the critical importance of implementing robust cybersecurity measures to protect against similar incidents. 

As Blue Yonder continues its recovery efforts, the incident serves as a reminder of the potential vulnerabilities in supply chain operations. For affected businesses, the focus remains on mitigating disruptions and ensuring continuity, while industry stakeholders are left grappling with the broader implications of this growing threat.
Read more »
Vendors
Breaches Clean Energy Cyber Security Energy IT Security Ransomware resilience Risks Supply Chain Vendors

Energy Sector Faces Heightened Supply Chain Risks Amid Growing Dependence on IT and Software Vendors

 

The energy industry is experiencing a sharp increase in supply chain risks, largely driven by its growing reliance on external vendors. According to a recent report, two-thirds of security breaches in this sector now originate from software and IT vendors.

The study, conducted by SecurityScorecard and KPMG, titled "A Quantitative Analysis of Cyber Risks in the U.S. Energy Supply Chain," draws attention to frequent threats, including ransomware attacks targeting traditional IT systems.

Researchers have emphasized that as the transition to cleaner energy picks up pace, and as the grid becomes more interconnected and software-reliant, vulnerabilities in the energy sector are expected to increase.

Ryan Sherstobitoff, senior vice president of threat research and intelligence at SecurityScorecard, stated, “The energy sector's rising dependence on third-party vendors exposes a significant vulnerability—its security is only as robust as its weakest link."

He added that this growing reliance on external vendors introduces considerable risks, urging the industry to strengthen cybersecurity defenses before a breach escalates into a national crisis.

The report highlighted that third-party risks account for nearly half of all breaches in the energy sector—significantly higher than the global average of 29%. Over 90% of organizations that experienced multiple breaches were attacked through third-party vendors.

Additionally, the report found that software and IT vendors were responsible for 67% of third-party breaches, while only a small number were linked to other energy companies. A notable portion of these incidents stemmed from the MOVEit file transfer software vulnerability, which was exploited by the Clop ransomware group last year.

The report also pointed out application security, DNS health, and network security as some of the most significant weaknesses in the sector.

The findings come at a time when the U.S. Department of Energy is convening with energy sector leaders to promote the Supply Chain Cybersecurity Principles, urging companies to focus on reducing risks posed by software and IT vendors, which represent the highest third-party threats.

As part of this effort, energy operators are encouraged to ensure new technology purchases are secure by incorporating initiatives like CISA’s "Secure by Design" and following the Department of Energy’s Supply Chain Cybersecurity Principles. The industry must also bolster security programs to defend against supply chain risks and geopolitical threats, especially from nation-state actors, and analyze ransomware attacks affecting foreign counterparts to improve resilience.

“The energy sector is a complex system undergoing a significant generational shift, heavily reliant on a stable supply chain," said Prasanna Govindankutty, KPMG's principal and cybersecurity leader for the U.S. sector.

He further explained that with rising geopolitical and technology-based threats, the industry is facing a level of risk exposure that could negatively impact both businesses and citizens. Organizations that can quantify these risks and implement mitigation strategies will be better equipped to navigate the energy transition.
Read more »
Vulnerabilities
CPS critical Cyber Security Cyberattack Cybersecurity Digital Infrastructure National Security public safety Supply Chain Vulnerabilities

Cyberattacks on Critical Infrastructure: A Growing Threat to Global Security

 

During World War II, the U.S. Army Air Forces launched two attacks on ball bearing factories in Schweinfurt, aiming to disrupt Germany’s ability to produce machinery for war. The belief was that halting production would significantly affect Germany’s capacity to manufacture various war machines.

This approach has a modern parallel in the cybersecurity world. A cyberattack on a single industry can ripple across multiple sectors. For instance, the Colonial Pipeline attack affected American Airlines operations at Charlotte Douglas Airport. Similarly, the Russian NotPetya attack against Ukraine spilled onto the internet, impacting supply chains globally.

At the 2023 S4 Conference, Josh Corman discussed the potential for cascading failures due to cyberattacks. The creation of the Cybersecurity and Infrastructure Security Agency’s National Critical Functions was driven by the need to coordinate cybersecurity efforts across various critical sectors. Corman highlighted how the healthcare sector depends on several infrastructure sectors, such as water, energy, and transportation, to provide patient care.

The question arises: what if a cyber incident affected multiple segments of the economy at once? The consequences could be devastating.

What makes this more concerning is that it's not a new issue. The SQL Slammer virus, which appeared over two decades ago, compromised an estimated one in every 1,000 computers globally. Unlike the recent CrowdStrike bug, Slammer was an intentional exploit that remained unpatched for over six months. Despite differences between the events, both show that software vulnerabilities can be exploited, regardless of intent.

Digital technology now underpins everything from cars to medical devices. However, as technology becomes more integrated into daily life, it brings new risks. Research from Claroty’s Team82 reveals that insecure code and misconfigurations exist in software that controls physical systems, posing potential threats to national security, public safety, and economic stability.

Although the CrowdStrike incident was disruptive, businesses and governments must reflect on the event to prevent larger, more severe cyber incidents in the future.

Cyber-Physical Systems: A Shifting Threat Landscape

Nearly every facility, from water treatment plants to hospitals, relies on digital systems known as cyber-physical systems (CPS) to function. These systems manage critical tasks, but they also introduce vulnerabilities. Today, billions of tiny computers are embedded in systems across all industries, offering great benefits but also exposing the soft underbelly of society to cyber threats.

The Stuxnet malware attack in 2014, which disrupted Iran's nuclear program, was the first major cyber assault on CPS. Since then, there have been several incidents, including the 2016 Russian Industroyer malware attack that disrupted part of Ukraine’s power grid, and the 2020 Iranian attempt to attack Israeli water utilities. Most recently, Chinese hackers have targeted U.S. critical infrastructure.

These incidents highlight how cybercriminals and nation states exploit vulnerabilities in critical infrastructure to understand weaknesses and the potential impact on security. China, for example, has expanded its objectives from espionage to compromising U.S. infrastructure to weaken its defense capabilities in case of a conflict.

The CrowdStrike Bug and Broader Implications

The CrowdStrike bug wasn’t a malicious attack but rather a mistake tied to a gap in quality assurance. Still, the incident serves as a reminder that our dependence on digital systems has grown significantly. Failures in cyber-physical systems—whether in oil pipelines, manufacturing plants, or hospitals—can have dangerous physical consequences.

Although attacks on CPS are relatively rare, many of these systems still rely on outdated technology, including Windows operating systems, which account for over 25% of vulnerabilities in the CISA Known Exploited Vulnerabilities Catalog. Coupled with long periods of technological obsolescence, these vulnerabilities pose significant risks.

What would happen if a nation-state deliberately targeted CPS in critical infrastructure? The potential consequences could be far worse than the CrowdStrike bug.

Addressing the vulnerabilities in CPS will take time, but there are several steps that can be taken immediately:

  • Operationalize compensating controls: Organizations must inventory assets and implement network segmentation and secure access to protect vulnerable systems.
  • Expand secure-by-design principles: CISA has emphasized the need to focus on secure-by-design in CPS, particularly for medical devices and automation systems.
  • Adopt secure-by-demand programs: Organizations should ask the right questions of software vendors during procurement to ensure higher security standards.
Although CPS drive innovation, they also introduce new risks. A failure in one link of the global supply chain could cascade across industries, disrupting critical services. The CrowdStrike bug wasn’t a malicious attack, but it underscores the fragility of modern infrastructure and the need for vigilance to prevent future incidents
Read more »
Supply Chain
AI Attacks Cyber Security Cyber Security awareness digital safety Information Security Online Privacy Supply Chain

Safeguarding Your Digital Future: Navigating Cybersecurity Challenges

 

In the ever-expanding realm of technology, the omnipresence of cybercrime casts an increasingly ominous shadow. What was once relegated to the realms of imagination has become a stark reality for countless individuals and businesses worldwide. Cyber threats, evolving in sophistication and audacity, have permeated every facet of our digital existence. From cunning phishing scams impersonating trusted contacts to the debilitating effects of ransomware attacks paralyzing entire supply chains, the ramifications of cybercrime reverberate far and wide, leaving destruction and chaos in their wake. 

Perhaps one of the most alarming developments in this digital arms race is the nefarious weaponization of artificial intelligence (AI). With the advent of AI-powered attacks, malevolent actors can orchestrate campaigns of unparalleled scale and complexity. Automated processes streamline malicious activities, while the generation of deceptive content presents a formidable challenge even to the most vigilant defenders. As adversaries leverage the formidable capabilities of AI to exploit vulnerabilities and circumvent traditional security measures, the imperative for proactive cybersecurity measures becomes ever more pressing. 

In this rapidly evolving digital landscape, the adoption of robust cybersecurity measures is not merely advisable; it is indispensable. The paradigm has shifted from reactive defense mechanisms to proactive strategies aimed at cultivating a culture of awareness and preparedness. Comprehensive training and continuous education serve as the cornerstones of effective cybersecurity, empowering individuals and organizations to anticipate and counter emerging threats before they manifest. 

For businesses, the implementation of regular security training programs is essential, complemented by a nuanced understanding of AI's role in cybersecurity. By remaining abreast of the latest developments and adopting proactive measures, organizations can erect formidable barriers against malicious incursions, safeguarding their digital assets and preserving business continuity. Similarly, individuals can play a pivotal role in fortifying our collective cybersecurity posture through adherence to basic cybersecurity practices. 

From practicing stringent password hygiene to exercising discretion when sharing sensitive information online, every individual action contributes to the resilience of the digital ecosystem. However, the battle against cyber threats is not a static endeavor but an ongoing journey fraught with challenges and uncertainties. As adversaries evolve their tactics and exploit emerging technologies, so too must our defenses adapt and evolve. The pursuit of cybersecurity excellence demands perpetual vigilance, relentless innovation, and a steadfast commitment to staying one step ahead of the ever-evolving threat landscape. 

The spectrum of cybercrime looms large in our digital age, presenting an existential threat to individuals, businesses, and society at large. By embracing the principles of proactive cybersecurity, fostering a culture of vigilance, and leveraging the latest technological advancements, we can navigate the treacherous waters of the digital domain with confidence and resilience. Together, let us rise to the challenge and secure a safer, more resilient future for all.
Read more »
Vulnerabilities and Exploits
BMC Flaw Silent Flaw Supply Chain Vulnerabilities and Exploits

The Silent Flaw: How a 6-Year-Old BMC Vulnerability Went Unnoticed


A six-year-old vulnerability has recently come to light, affecting Intel and Lenovo servers. Let’s delve into the details of this silent flaw and its implications. 

About vulnerability

The vulnerability resides within the Lighttpd web server, a lightweight and efficient open-source server commonly used for high-traffic websites. Researchers at the Binary firmware security firm stumbled upon this flaw, which had remained unnoticed for years. The flaw lies in the handling of “folded” HTTP request headers, leading to a heap out-of-bounds (OOB) read vulnerability.

The Culprit: Lighttpd Web Server

The Lighthttpd developers stealthily patched the issue in version 1.4.51 without issuing a tracking ID (CVE), even though it was resolved in August 2018.

Because of this, the AMI MegaRAC BMC developers overlooked the change and neglected to incorporate it into the final version. As a result, system vendors and their clients were affected further down the supply chain by the vulnerability.

The Impact

BMCs are microcontrollers that are integrated into server-grade motherboards, such as those found in cloud and data center systems, and allow for firmware updates, remote management, restarting, and monitoring of the device.

Binary discovered that AMI neglected to implement the Lighttpd patch from 2019 until 2023, which resulted in the deployment of numerous devices that were susceptible to the remotely exploitable flaw throughout this time.

The vulnerability allows attackers to exfiltrate process memory addresses, a critical piece of information. Armed with this data, malicious actors can bypass security mechanisms like Address Space Layout Randomization (ASLR). In essence, the flaw undermines the very protection mechanisms designed to prevent unauthorized access.

Supply Chain Fallout

The story takes an unexpected twist as we trace the flaw’s journey through the supply chain. The maintainers of Lighttpd patched the vulnerability silently in August 2018 (version 1.4.51), without assigning a tracking ID (CVE). Unfortunately, this stealthy fix allowed the flaw to persist in the wild.

The Vendors and Their Devices

Several vendors unwittingly shipped devices with this vulnerability, including Intel, Lenovo, and Supermicro. Let’s explore the impact of each:

Intel

The vulnerability affects the M70KLP series firmware (latest version).

Internal identifier: BRLY-2024-002.

Approximately 2000+ Intel server models remain vulnerable.

Lenovo

Lenovo’s BMC firmware (latest version) harbors the same flaw.

Impacted server models: HX3710, HX3710-F, and HX2710-E.

Internal identifier: BRLY-2024-003.

Supermicro

While not explicitly mentioned, Supermicro devices are likely affected due to their reliance on Lighttpd. The flaw underscores the need for thorough security assessments across the board.

The Hackable Hardware

The oversight in communication between vendors, maintainers, and end-users has resulted in the shipment of hackable hardware. These devices unwittingly expose sensitive information, jeopardizing the security of data centers, cloud services, and critical infrastructure.

The Urgent Call to Action

As the flaw’s existence becomes public knowledge, vendors must act swiftly:

Patch and Update: Vendors should release patches addressing the vulnerability promptly.

Security Audits: Rigorous security audits are essential to identify and rectify hidden flaws.

Transparency: Clear communication channels between maintainers, vendors, and end-users are crucial.

Read more »
Supply Chain
Community breach Cyber Crime Emails Hacking Microsoft Midnight Blizzard Supply Chain

Russian Hackers Breach Microsoft's Security: What You Need to Know

 


In a recent set of events, reports have surfaced of a significant cyberattack on Microsoft, allegedly orchestrated by Russian hackers. This breach, attributed to a group known as Midnight Blizzard or Nobelium, has raised serious concerns among cybersecurity experts and the public alike.

The attack targeted Microsoft's source code repositories, exposing sensitive company information and communications with partners across various sectors, including government, defence, and business. While Microsoft assures that no customer-facing systems were compromised, the breach has far-reaching implications for national and international security.

Cybersecurity experts warn of the potential for increased zero-day vulnerabilities, which are undiscovered security flaws that can be exploited by hackers. Access to source code provides attackers with a "master key" to infiltrate systems, posing a significant threat to organisations and users worldwide.

The severity of the breach has prompted strong reactions from industry professionals. Ariel Parnes, COO of Mitiga, describes the incident as "severe," emphasising the critical importance of source code security in the digital age. Shawn Waldman, CEO of Secure Cyber Defense, condemns the attack as a "worst-case scenario," highlighting the broader implications for national security.

The compromised data includes emails of senior leadership, confidential communications with partners, and cryptographic secrets such as passwords and authentication keys. Larry Whiteside Jr., a cybersecurity expert, warns of potential compliance complications for Microsoft users and partners, as regulators scrutinise the breach's impact on data protection laws.

As the fallout from the breach unfolds, there are growing concerns about the emergence of zero-day vulnerabilities and the need for proactive defence measures. Experts stress the importance of threat hunting and incident response planning to mitigate the risks posed by sophisticated cyber threats.

The incident underscores the ongoing battle in the global cyber warfare landscape, where even tech giants like Microsoft are not immune to attacks. With cybercriminals increasingly targeting supply chains, the need for enhanced security measures has never been more urgent.

The breach of Microsoft's systems serves as a wake-up call for individuals and organisations alike. It highlights the ever-present threat of cyberattacks in an increasingly interconnected world and underscores the need for enhanced cybersecurity measures. By staying vigilant and proactive, establishments can mitigate the risks posed by cyber threats and protect their digital assets from exploitation.

As the field of cybersecurity keeps changing and developing, stakeholders must work together to address the underlying threats and ensure the protection of critical infrastructure and data. This recent breach of Microsoft's security by Russian hackers has raised serious concerns about the vulnerability of digital systems and the need for robust cybersecurity measures.


Read more »
Supply Chain
Cyber Attacks Evasive Panda MgBot State Sponsored Hackers Supply Chain

China State-Sponsored Spies Hack Site and Target User Systems in Asia


Chinese threat actors strike again

Users of a Tibetan language translation app and website visitors to a Buddhist festival were compromised by a focused watering-hole malware connected to a Chinese threat group.

According to recent data from ESET, the so-called Evasive Panda hacking team's cyber-operations campaign started in September 2023 or earlier and impacted systems in Taiwan, Hong Kong, Taiwan, Australia, and the United States.

During the campaign, the attackers gained access to the websites of three different businesses: a development company that provides translations into Tibetan; an organization based in India that promotes Tibetan Buddhism; and the news website Tibetpost, which unintentionally contained dangerous applications. Specific global geographic visitors to the sites were infected with droppers and backdoors, which included Nightdoor, a relatively new backdoor application, and the group's favourite MgBot.

Adversary in the middle attacks

According to ESET researcher Anh Ho, who uncovered the attack, the organization used an astonishing range of attack vectors in the campaign, including phishing emails, watering holes, and adversary-in-the-middle (AitM) attacks via software updates that took advantage of development servers.

"The fact that they orchestrate both a supply chain and watering-hole attack within the same campaign showcases the resources they have," according to him. "Nightdoor is quite complex, which is technically significant, but in my opinion, Evasive Panda's [most significant] attribute is the variety of the attack vectors they have been able to perform."

A relatively small unit called Evasive Panda is usually assigned to surveillance missions in Asia and Africa, mostly targeting individuals and organizations. As reported by SentinelOne, the organization is linked to attacks on telecom companies in 2023 under the code name Operation Tainted Love. According to Microsoft, it is also related to the attribution group Granite Typhoon, née Gallium. Symantec refers to it as Daggerfly as well, and Google Mandiant reports that it shares similarities with a group of cybercriminals and spies known as

Supply chain and watering holes compromises

The group, which has been active since 2012, is well-known for its supply chain attacks and for using stolen code-signing credentials and program upgrades in 2023 to infect users' PCs in China and Africa.

The organization commandeered a website for the Tibetan Buddhist Monlam festival in this most recent campaign, according to ESET's published analysis, to provide a backdoor or downloader tool that downloaded malicious payloads from a compromised Tibetan news site.

The hackers utilized Trojanized programs to infect Mac OS and Windows machines and also compromised a vendor of Tibetan translation software to further target consumers.

Cyber espionage links

Evasive Panda has created MgBot, a proprietary malware framework with a modular architecture that can download other components, run code, and steal data. MgBot modules can download further capabilities and spy on victims who have been hacked, among other things.

Using the MgBot downloader to deliver final payloads, Evasive Panda targeted users in India and Hong Kong in 2020, according to Malwarebytes, which connected the organization to earlier assaults in 2014 and 2018.

The organization released Nightdoor in 2020 as a backdoor that can be used to issue commands, upload data, and build a reverse shell by communicating with a command-and-control server.


Read more »
Supply Chain Attack
Artifcial Intelligence Cyber Hackers Data Breach Hacking Supply Chain Supply Chain Assaults Supply Chain Attack

Hugging Face's AI Supply Chain Escapes Near Breach by Hackers

 

A recent report from VentureBeat reveals that HuggingFace, a prominent AI leader specializing in pre-trained models and datasets, narrowly escaped a potential devastating cyberattack on its supply chain. The incident underscores existing vulnerabilities in the rapidly expanding field of generative AI.

Lasso Security researchers conducted a security audit on GitHub and HuggingFace repositories, uncovering more than 1,600 compromised API tokens. These tokens, if exploited, could have granted threat actors the ability to launch an attack with full access, allowing them to manipulate widely-used AI models utilized by millions of downstream applications.

The seriousness of the situation was emphasized by the Lasso research team, stating, "With control over an organization boasting millions of downloads, we now possess the capability to manipulate existing models, potentially turning them into malicious entities."

HuggingFace, known for its open-source Transformers library hosting over 500,000 models, has become a high-value target due to its widespread use in natural language processing, computer vision, and other AI tasks. The potential impact of compromising HuggingFace's data and models could extend across various industries implementing AI.

The focus of Lasso's audit centered on API tokens, acting as keys for accessing proprietary models and sensitive data. The researchers identified numerous exposed tokens, some providing write access or full admin privileges over private assets. With control over these tokens, attackers could have compromised or stolen AI models and supporting data.

This discovery aligns with three emerging risk areas outlined in OWASP's new Top 10 list for AI security: supply chain attacks, data poisoning, and model theft. As AI continues to integrate into business and government functions, ensuring security throughout the entire supply chain—from data to models to applications—becomes crucial.

Lasso Security recommends that companies like HuggingFace implement automatic scans for exposed API tokens, enforce access controls, and discourage the use of hardcoded tokens in public repositories. Treating individual tokens as identities and securing them through multifactor authentication and zero-trust principles is also advised.

The incident highlights the necessity for continual monitoring to validate security measures for all users of generative AI. Simply being vigilant may not be sufficient to thwart determined efforts by attackers. Robust authentication and implementing least privilege controls, even at the API token level, are essential precautions for maintaining security in the evolving landscape of AI technology.
Read more »
Supply Chain
Australia Christmas Goods Cyber Attacks Shipping Company Supply Chain

Cyberattack Could Lead to a Shortage of Christmas Goods in Australia

 

A cyberattack over the weekend partially closed four major Australian ports, raising concerns about cascading effects. 

Forty percent of the freight that enters the country is handled by DP World Australia, which discovered a security breach on Friday and immediately turned off its internet connection. 

This meant that throughout the weekend, the company's port operations in Sydney, Melbourne, Brisbane, and Fremantle were shut down. 

The company could not estimate how long it would take to recuperate from the cyberattack, but experts believe it could take weeks, prompting price hikes and rising inflationary pressure. 

According to AMP chief economist Shane Oliver, a lengthy disruption in the operations of UAE-owned DP World could have a ripple effect on the overall economy and help trigger another interest rate hike. 

He stated that the attack on DP World, as well as its inability to move goods in or out of its ports, constituted a supply shock, and that a prolonged closure could push up commodity prices, forcing the Reserve Bank to consider another interest rate hike at its December meeting.

“It goes to the nature of the supply shock here, and this could have an impact on the prices, and inflation rate, of goods, which has been coming down. If this stops that, or it pushes up prices, then the Reserve Bank could be looking at it at their December meeting,” Oliver noted. 

However, senior Westpac economist Justin Smirk stated that the Reserve Bank is beginning to consider disruptive incidents such as cyberattacks on supply chain infrastructure. 

The founder of the data breach tracker Have I Been Pwned and cybersecurity researcher Troy Hunt warned that disruptions to Australian consumers could last for weeks and have an impact on Christmas delivery. 

Hunt told this masthead, "If you look back to COVID, look at the sheer number of things that got disrupted just because bits and pieces couldn't get delivered." "It depends on the actions taken here as well; have the internal systems of [DP World] been destroyed?" 

He cited preliminary research from cybersecurity veteran Kevin Beaumont, who discovered that DP World was most likely the victim of a ransomware attack enabled by a vulnerability in Citrix NetScaler software. 

According to Hunt, ransomware groups are now far more professional than they used to be, with websites listing every victim and a countdown timer indicating how much longer they had to pay. 

“There’s … a financial motive for this sort of stuff,” Hunt noted. “Of course, we’ve seen this in Australia recently with the Medibank situation, we’re seeing this more and more. If you have a spin through some of the dark web ransomware websites, it’s just stunning the number of organisations that are listed on there.”
Read more »
Telegram
cryptocurrency Cyberattacks Cybersecurity Data Theft Google python Software Supply Chain Telegram

Data Theft Alert: Malicious Python Packages Exposed – Stay Secure

 


Researchers have observed an increasing complexity in the scope of a malicious campaign, which has exposed hundreds of info-stealing packages to open-source platforms over the past half-year, with approximately 75,000 downloads being recorded. 

Checkmarx's Supply Chain Security team has been monitoring the campaign since it started at the beginning of April. Analysts discovered 272 packages with code intended to steal confidential information from systems that have been targeted by this campaign. 

There has been a significant evolution of the attack since it was first identified. The authors of the packages have started integrating increasingly sophisticated obfuscation layers and detection-evading techniques to attempt to prevent detection. 

The concept of an info stealer has evolved from humble beginnings over time to become a powerful info stealer capable of stealing information associated with everyone. 

Crypto and Data Theft 


As the researchers point out, "the Python ecosystem started showing a pattern of behaviour in early April 2023." For example, the “_init_py” file was found to load only when it was confirmed that it was running on a target system rather than in a virtualized environment. This is the usual sign of a malware analysis host, according to the researchers. 

This malware will check for the presence of an antivirus on the compromised endpoint, search for task lists, Wi-Fi passwords, system information, credentials, browsing history, cookies, and payment information saved in your browser as well as cryptocurrency data from wallet apps, Discord badges, phone numbers, email addresses, Minecraft data, and Roblox data. As you can see, the malware checks for these things as well. Additionally, it will also take screenshots of any data that is considered to be of importance and upload it directly. 

Aside from that, the malware causes the compromised system to take screenshots and steal individual files such as those in the Desktop, Pictures, Documents, Music, Videos, and Downloads directories to spread to other systems. 

In addition, the malware monitors constantly the victim's clipboard for cryptocurrency addresses, and it swaps the addresses with the attacker's address to divert the payment to wallets controlled by the attacker. 

Approximately $100,000 worth of cryptocurrency is estimated to have been directly stolen by this campaign, according to the analysts. 

An Analysis of The Attack's Evolution 


There was no doubt that the malicious codes and files from this campaign were found in April packages, since the malicious code was plain text, as reported by the researchers. The researchers also noticed that a multilayered anti-obfuscation had been added to two of the packages by the authors in May to hinder analysis of the packages. 

However, in August, a researcher noted that many packages now have multi-layer encryption. There are currently at least 70 layers of obfuscation used by two of the most recent packages tested by Checkmarx's researcher Yahuda Gelb, as noted in a separate report. 

There was also an announcement that the malware developers planned to develop a feature that could disable antivirus software, added Telegram to the list of targeted applications, and introduced a fallback mechanism for data exfiltration during August. 

There are still many risk factors associated with supply chain attacks, according to the researchers, and threat actors are uploading malicious packages to widely used repositories and version control systems daily, such as GitHub, or package repositories such as PyPi and NPM, as well as to widely used package repositories such as GitHub. 

To protect their privacy, users should carefully scrutinize their trustworthiness as well as be vigilant against typosquatting package names in projects and packages that they trust.
Read more »
Subscribe to: Posts (Atom)