supply chain attacks6 articles
How US Air Force Pilots Flew Missions With Malware-Infected USB Sticks From Kabul Bazaars
In the early 2000s, US Air Force pilots in Afghanistan routinely used USB drives purchased from local vendors — sometimes in cities like Kabul — interchangeably across both classified and unclassified systems when planning missions, creating serious security vulnerabilities. Junior IT security staff who raised concerns were largely ignored by senior officers who didn't fully understand the risks of transferring malware between systems via removable media. This practice had serious consequences, as adversaries began planting infected USB drives with local vendors, ultimately contributing to the 2008 Agent.BTZ malware infection of the Department of Defense, which took 14 months to eradicate.
Extortionists Are Coming for Your AI Models, Google's Threat Hunters Warn
Google's threat intelligence team has warned that extortion groups are increasingly targeting companies' proprietary AI assets — including source code, models, and research data — threatening to leak them publicly unless ransoms are paid, with victims spanning healthcare, technology, and media sectors in North America and Europe. One group, TeamPCP (UNC6780), has been particularly active, conducting large-scale supply chain attacks and using multiple methods to steal cloud and AI credentials. Google also notes a growing trend of attackers integrating agentic AI into their operations, enabling autonomous, multi-stage attacks with minimal human intervention, signalling an escalating threat landscape.
AI Is Now Both the Weapon and the Bullseye: CrowdStrike's 2025 Threat Report Makes for Grim Reading
AI is increasingly being used as both an attack tool and a target, with AI-enabled cyberattacks rising 89% in 2025, according to CrowdStrike's annual Threat Hunting Report. Criminal groups and nation-state actors — most notably North Korea's Famous Chollima — are leveraging AI to launch sophisticated attacks, including credential theft, supply-chain compromises, and the creation of fake companies to support insider threat operations. AI is also accelerating vulnerability exploitation, with 88% of observed attacks using public proof-of-concept code occurring within 48 hours of release, effectively rendering traditional 30-day patching windows obsolete.
Roundup: Iranian Spooks Track US Troops Via Ad Data, macOS Malware Plays Dead, and a Textile Firm Goes Bust After Six Weeks of Ransomware Hell
This SecurityWeek roundup covers a broad range of cybersecurity developments, including a German manufacturer filing for bankruptcy after a six-week production shutdown caused by a cyberattack, and Iranian threat actors exploiting advertising and cellular roaming data to track US military personnel's smartphones. Other highlights include the discovery of CrashStealer, a new macOS information-stealing malware that disguises itself as a legitimate crash reporter, and a joint CISA guide providing organisations with a framework for establishing Coordinated Vulnerability Disclosure programs. Additional stories touch on supply chain breaches affecting Lidl customers, ransomware targeting an Asian IT firm, and a cybercrime group claiming to have stolen over 1TB of data from naval defence manufacturer Thyssenkrupp Marine Systems.
One Hacker Group Is Turning Software Supply Chains Into a Self-Replicating Nightmare
A cybercriminal group called TeamPCP has carried out an unprecedented wave of software supply chain attacks, hiding malware in hundreds of open source tools to breach companies including GitHub, OpenAI, and the European Commission's website. Their self-perpetuating strategy involves stealing developer credentials to compromise more tools, recently automated through a self-spreading worm called Mini Shai-Hulud, resulting in over 500 corrupted software packages across 20 attack waves in just a few months. Security experts warn that organisations should rotate authentication tokens regularly, avoid auto-updating open source tools, and vet new code before deployment, as the group shows no signs of slowing down.
One Hacker Group Is Turning Software Supply Chain Attacks Into a Production Line
A cybercriminal group called TeamPCP has carried out an unprecedented wave of software supply chain attacks, embedding malware in over 500 open source tools to infiltrate hundreds of companies, including GitHub, Anthropic, and the European Commission's public website. The group exploits a self-perpetuating cycle — compromising developer tools to steal credentials, then using those credentials to poison more tools — and has recently automated attacks using a self-spreading worm called Mini Shai-Hulud. Security experts warn that organisations must practice better credential hygiene, carefully vet software updates, and avoid automatically installing the latest versions of open source packages to protect themselves.