In today’s cybersecurity news…
Malicious Nx Packages leak GitHub, Cloud, and AI Credentials
A warning from the maintainers of the nx build system of a supply chain attack that allowed threat actors to “publish malicious versions of the popular npm package and other auxiliary plugins with data-gathering capabilities.” Specifically, the packages containing the name S1ngularity contained code that could “scan the file system, collect credentials, and post them to GitHub as a repo under the user’s accounts.” The maintainers said this in an advisory published Wednesday. According to researchers at Wiz, 2,349 distinct credentials were leaked, “most of them for GitHub OAuth keys and personal access tokens (PATs), followed by API keys and credentials for Google AI, OpenAI, Amazon Web Services, OpenRouter, Anthropic Claude, and Datadog.
North Korean remote worker scheme boosted by generative AI
The U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) has announced new sanctions against two individuals and two entities “for their role in the North Korean remote information technology (IT) worker scheme,” in which overseas IT workers, embed malware, steal data and credentials and demand ransoms. A report published Wednesday from Anthropic shows how this operation uses generative AI powered tools like Claude “to create convincing professional backgrounds and technical portfolios, tailor resumes to specific job descriptions and even deliver actual technical work.” Anthropic stated, “the most striking finding is the actors’ complete dependency on AI to function in technical roles…these operators do not appear to be able to write code, debug problems, or even communicate professionally without Claude’s assistance. Yet they’re successfully maintaining employment at Fortune 500 companies (according to public reporting), passing technical interviews, and delivering work that satisfies their employers.”
The Netherlands announces Salt Typhoon penetration
The Netherlands Ministry of Defence announced yesterday that it has been targeted by a Chinese cyber-espionage campaign tracked as Salt Typhoon and RedMike. The attacks were not large scale as compared to other countries but focused on smaller internet service and hosting providers.” Dutch investigators stated that “the Chinese hacking organization had access to routers belonging to the Dutch targets.”
CISA helps Nevada get back in the game
Following up on a story we covered on Wednesday, CISA has announced it has been working with the FBI and other agencies to help get the state of Nevada get back online while “investigating the origins of the attack and rebuilding systems.” The state asked CISA to send its “threat hunting” teams “to assist in mitigating any ongoing threats and identify the full scope of the incident.” The agency said it also helped Nevada access incident response grants offered by the Federal Emergency Management Agency. There is no further update as to whether this was a ransomware attack or who was responsible.
Huge thanks to our sponsor, Prophet Security
TransUnion announces data breach
Consumer credit reporting company TransUnion has announced that “it suffered a data breach exposing the personal information of over 4.4 million people in the United States.” It is one of the three major credit bureaus in the United States, alongside Equifax and Experian, “collecting and maintaining credit information on over 1 billion consumers worldwide, with approximately 200 million of those based in the U.S.” The breach occurred on July 28 and was discovered two days later. The company states the incident “involved a third-party application serving the company’s consumer support operations.” Data stolen was in the company’s words, “limited” and did not include credit reports or core credit information.
Healthcare Services Group announces 2024 breach
This U.S.-based company that provides housekeeping, laundry, dining, and nutritional services to healthcare facilities, primarily nursing homes, assisted living centers, and hospitals has stated in a filing to the Maine Attorney General’s Office that the breach affects more than 620,000 people and occurred between September 27 and October 3 of last year. Data stolen includes Social Security numbers, driver’s license numbers, state identification numbers, financial account information and full access credentials. No further details about the attack have been disclosed.
South Korea telecom punished for security bungle
Following up on a story we covered in May, South Korea’s SK Telecom has been fined the equivalent of $97 million, after the country’s privacy commission found that the mobile giant had “left its network wide open to hackers through a catalog of bungles.” The breach had been announced in April. Hackers had gained access to the universal subscriber identity module (USIM) data of almost 27 million subscribers. The country’s Personal Information Protection Commission (PIPC) said that the country’s biggest carrier “did not even implement basic access controls between its internet-facing systems and internal management network.” It added that “SKT failed at almost every layer of defense,” including dumped thousands of server credentials in plaintext on a management network server.” A more complete accounting of this incident is available as a link in the show notes to this episode.
CrowdStrike makes acquisitions to boost autonomous threat detection capabilities
On Wednesday, CrowdStrike announced plans to acquire data pipeline management provider Onum. This, it says, forms “part of its goal to enhance the Falcon Next-Gen SIEM platform with autonomous detection capabilities…given that traditional SIEMs cannot keep up with the large volume of data.” CrowdStrike president Michael Sentonas, announcing the acquisition in a blog post says the move will help analysts who must currently sift through the noise manually as well as security teams who must decide between options “such as shrinking data retention windows or leaving out certain data sources, in order to reduce data storage costs.”