Everyone needs policies and procedures that address the potential risk of business email compromise (BEC). That is when the threat actors through impersonation or compromised credentials get inside an email system and send malicious business instructions to your team pretending to senior people in your organisation or trusted partners. Here …
A couple of stories about supply chain compromise
The first is that threat actors have compromised a media company and are using its infrastructure to distribute malware: Hundreds of U.S. news sites push malware in supply-chain attack (bleepingcomputer.com) The company has not yet been named but the attack has impacted to many hundreds of news sites. The second …
Continue reading “A couple of stories about supply chain compromise”
Emotet is back
Just when it looked like the Emotet spamming/malware operation had stopped, there are widespread reports that it has restarted. Emotet botnet starts blasting malware again after 5 month break (bleepingcomputer.com) Infected Microsoft Office documents are Emotet’s favoured method of malware distribution. Once the email has slipped past your technical defences, …
Malicious Android smartphone apps
Here are a couple of the current examples of Android malware that could compromise your organisation, reported in the technical press this week. New SandStrike spyware infects Android devices via malicious VPN app (bleepingcomputer.com) Malicious Android apps with 1M+ installs found on Google Play (bleepingcomputer.com) They have different malicious intent …
Steal the code… Dropbox
Dropbox has admitted that 130 of its confidential private GitHub repositories were coped by a threat actor. Among the haul were secret APUI codes. They do reassure users that no user content, usernames or passwords were stolen. Well of course not. That is not the issue. Why bother stealing those …
