news
Security and Windows TCO Leftovers
-
Security Week ☛ 1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom
The compromised Lightning and Intercom packages have a combined monthly download count of nearly 10 million.
-
Security Week ☛ Two US Security Experts Sentenced to Prison for Helping Ransomware Gang
Ryan Goldberg of Georgia and Kevin Martin of Texas were each sentenced to four years in prison.
-
SANS ☛ Malicious Ad for Homebrew Leads to MacSync Stealer, (Fri, May 1st)
Introduction
-
LWN ☛ Security updates for Friday
Security updates have been issued by AlmaLinux (fence-agents), Debian (chromium, dovecot, and kernel), Fedora (chromium, dotnet10.0, dotnet8.0, dotnet9.0, emacs, glow, jfrog-cli, openbao, pyp2spec, python3.6, rust-rustls-webpki, vhs, and xen), Oracle (grafana, grafana-pcp, PackageKit, sudo, vim, and xorg-x11-server), Red Hat (rhc), SUSE (avahi, bouncycastle, chromium, container-suseconnect, firewalld, gdk-pixbuf, grafana, java-25-openjdk, kernel, libixml11, libmozjs-140-0, libpng12-0, libsodium, libssh, mariadb, Mesa, ntfs-3g_ntfsprogs, openCryptoki, openexr, packagekit, prometheus-postgres_exporter, python-jwcrypto, python-mako, python-Pygments, python-pynacl, python311, python311-pyOpenSSL, python315, radare2, sed, and vim), and Ubuntu (kmod and zulucrypt).
-
Security Week ☛ In Other News: Scattered Spider Hacker Arrested, SOC Effectiveness Metrics, NSA Tool Vulnerability
Other noteworthy stories that might have slipped under the radar: OFAC hits Iranian central bank crypto reserves, ADT data leak, CISA guidance for zero trust in OT.
-
Security Week ☛ Hugging Face, ClawHub Abused for Malware Distribution
Threat actors are relying on social engineering to lure users into downloading files containing malicious instructions.
-
Windows TCO / Windows Bot Nets
-
Bruce Schneier ☛ A Ransomware Negotiator Was Working for a Ransomware Gang
Someone pleaded guilty to secretly working for a ransomware gang as he negotiated ransomware payments for clients.
-
Security Week ☛ Sophisticated Deep#Door Backdoor Enables Espionage, Disruption
The stealthy Python-based backdoor framework deploys a persistent backdoored Windows implant likely designed for espionage.
-