Deep Dive: Why a recent supply-chain attack singled out security firms Checkm...
The pushed malware scoured infected machines for repository tokens, SSH keys, and other credentials. It has been a bad six weeks for security firm Checkmarx. Over the past 40 days, it has been the victim of at least one supply-chain attack that delivered malware to customers on two separate occasions. Now it has been hit by a ransomware attack from prolific fame-seeking hackers. The streak of misfortunes started on March 19 with the supply-chain attack of Trivy, a widely used vulnerability scanner. The attackers behind the breach first breached the Trivy GitHub account and then used their access to push malware to Trivy users, one of which was Checkmarx.
Both a target and delivery mechanism
Or so Checkmarx thought.Read full article Comments Four days later, Checkmarx’s GitHub account was compromised and began pushing malware to the security firm’s users. The company contained and remediated the breach and replaced the malware with the legitimate apps.
Related Articles
- Double Fine, Creator of Psychonauts, Joins Unionization Wave at Microsoft-Owned Studios
- How to Craft a Response to the UK’s Digital ID Consultation: Lessons from EFF’s Submission
- Hantavirus Hunt in Patagonia: Scientists Track Rodent Carriers After Cruise Ship Outbreak
- React Native 0.83 Launches with React 19.2 and Major DevTools Upgrades, Security Advisory Issued
- Airbnb's Privacy-First Identity Overhaul: How Context-Aware Profiles Protect User Data
- Mastering Your MacBook Neo Order: A Step-by-Step Guide to Navigating May's Delivery Windows
- Anchorage Digital and M0 Launch Joint US Stablecoin Issuance Platform for Enterprises
- Kubernetes v1.36 Unleashed: 7 Essential DRA Updates You Need to Know