Parse notes
Hugging Face's Safetensors service can be compromised to hijack user models, enabling supply chain attacks via malicious pull requests to other repos masquerading as the conversion bot. Hijacked conversion models allow changes to any repo on the platform.
Tornado Cash enables users to make transactions on the Ethereum network without leaving a trace. However, it was recently discovered that a developer snuck a snippet of malicious code into a governance proposal on January 1st that funneled deposit notes to an attacker-controlled server. The exploit only affects transactions made through an IPFS gateway.
Pharmaceutical giant Cencora, formerly AmerisourceBergen, experienced a cyberattack where data was stolen from its IT systems, potentially including personal information. The company contained the breach and is collaborating with authorities and cybersecurity experts to investigate further. No ransomware groups have claimed responsibility for the breach yet but Cencora has clarified that this isn't related to the Optum Change Healthcare ransomware incident.
This is the official release of version 2.0 of the NIST Cybersecurity Framework (CSF), the first major update since the framework's creation a decade ago. The CSF 2.0 is designed to help all organizations reduce risks, regardless of sector, size, or level of security sophistication.
Part 1 in a 3 part series on attacking Okta. The first part is a thorough introduction to Okta terminology and the Okta environment, covering primitives as well as a focus on authentication methods. It has a slight attacker perspective but could be useful for defenders looking to increase their Okta knowledge as well.
This post discusses a recent customer engagement that entailed responding to an AWS ransomware attack. The attacker deleted several S3 buckets and then left a ransom note (included in the post) and a recovery binary. The post goes through the CloudTrail actions taken by the attackers as well as an analysis of the recovery binary. It concludes by noting that the binary does not make any connections to AWS (or the internet in general) and would not be able to recover the data.
The Python Risk Identification Tool for generative AI (PyRIT) is an open-access automation framework that empowers security professionals and machine learning engineers to proactively find risks in their generative AI systems.
modpot is a modular web application honeypot framework written in Golang. It allows users to deploy simple HTML/JS honeypots that mimic web applications in order to detect requests and form entries that are related to attacks.
Security logging solutions vendor RunReveal introduced pql to offer an open-source alternative to proprietary languages used by major security vendors. The language is designed to easily integrate with existing products supporting SQL, allowing security teams to query logs efficiently. pql aims to become a standard query language for security professionals, providing an alternative to established platforms.
The LockBit ransomware group has relaunched its leak site just a week after a major coordinated takedown by global law enforcement on Feb. 19. The takedown operation seized infrastructure, code, stolen data, keys, and arrested affiliates. LockBit's backup systems remained untouched, enabling the operation to bounce back quickly.
Near was a data broker that specialized in location data. It claimed that it had the location data of 1.6B people across 44 countries. Sen. Ron Wyden requested that the FTC prevent the sale of this data when Near filed for bankruptcy, which they granted. This incident brought many to question who can acquire and license data from data brokers.
The US Commerce Department has blacklisted Sandvine Inc., a computer networking company, for supplying technology to the government of Egypt that enabled web monitoring and censorship, going against US national security and foreign policy interests. Sandvine's deep-packet inspection technology was used for internet surveillance and censorship in Egypt, leading to its ban from acquiring US technology components.
This report deep dives into the top industries and companies preferred by phishers. Amongst all industries, the social media sector accounted for the largest YoY increase in phishing URLs at 110%.
The Office of the National Cyber Director released a report calling on organizations to reduce the use of memory-unsafe languages like C and C++ in favor of memory-safe languages. The report specifically calls out Rust, Python, and Java as safer alternatives.
ThyssenKrupp's Automotive division in Saarland suffered a cyber attack, leading to the shutdown of IT systems.