The Federal Bureau of Investigation (FBI) is releasing this FLASH to highlight the tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) associated with the cyber criminal group TeamPCP. TeamPCP actors have conducted large-scale software supply chain compromises by targeting widely used developers and security tools, gaining access to victim environments and extracting sensitive data, including but not limited to cloud access tokens, SSH keys, and Kubernetes secrets. The FBI encourages organizations to contact the FBI if they have been compromised, and to implement the actions in the Recommendations section to reduce the likelihood and impact of compromise by TeamPCP actors.
Read more…
Source: U.S. Federal Bureau of Investigation Cyber Division
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Russian retail chain ‘DNS’ confirms hack after data leaked online
October 3, 2022
Russian retail chain ‘DNS’ (Digital Network System) disclosed yesterday that they suffered a data breach that exposed the personal information of customers and employees. DNS is Russia’s second-largest computer and home appliance store chain, with 2,000 branches and 35,000 employees. According to the scant details provided in the announcement, a group of hackers residing outside the Russian ...
- BlackCat malware lashes out at US defense IT contractor
October 2, 2022
The BlackCat ransomware gang, also known as ALPHV, has allegedly broken into IT firm NJVC, a provider of services to civilian US government agencies and the Department of Defense. DarkFeed, which monitors the dark web for ransomware intelligence, tweeted this week that BlackCat had added NJVC to its victims’ list, along with sharing a screenshot allegedly ...
- Lazarus hackers abuse Dell driver bug using new FudModule rootkit
October 1, 2022
The notorious North Korean hacking group ‘Lazarus’ was seen installing a Windows rootkit that abuses a Dell hardware driver in a Bring Your Own Vulnerable Driver attack. The spear-phishing campaign unfolded in the autumn of 2021, and the confirmed targets include an aerospace expert in the Netherlands and a political journalist in Belgium. According to ESET, which ...
- BEC attacks: Most victims aren’t using multi-factor authentication – apply it now and stay safe
September 29, 2022
There has been a big rise in Business Email Compromise (BEC) attacks – and most victims work at organisations which weren’t using multi-factor authentication (MFA) to secure their accounts. BEC attacks are one of the most lucrative forms of cyber crime: according to the FBI, the combined total lost is over $43 billion and counting, with ...
- Upgraded Prilex Point-of-Sale malware bypasses credit card security
September 29, 2022
Security analysts have observed three new versions of Prilex PoS-targeting malware this year, indicating that its authors and operators are back in action. Prilex started as ATM-focused malware in 2014 and it pivoted to PoS (point of sale) devices in 2016. While development and distribution peaked in 2020, the malware disappeared in 2021. Kaspersky analysts now report ...
- Singapore firms see 54 cybersecurity incidents daily, struggle to keep up
September 29, 2022
The cybersecurity threat landscape is evolving so quickly companies in Singapore are finding it tough to keep up. Half feel “inundated” by an endless stream of cyber attacks, describing this as one of their biggest work frustrations. Just 25% of cybersecurity professionals in Singapore felt “very confident” in their organisation’s ability to adapt to new threats, ...