Supply chain attacks have surged by 250% from 2021 to 2024, with third-party vendor compromise accounting for 45% of incidents. These attacks have a longer average dwell time (287 days) compared to direct attacks (207 days), indicating significant detection challenges. The financial impact is substantial, with supply chain attacks costing an average of $5.12 million per incident. CISA has issued an emergency directive emphasizing zero-trust architecture, Software Bill of Materials (SBOM) requirements, and continuous vendor risk assessments to mitigate these threats. European organizations face heightened risks due to their reliance on complex vendor ecosystems and critical infrastructure. Countries with dense technology sectors and critical infrastructure, such as Germany, France, and the UK, are particularly vulnerable. Mitigation requires tailored vendor risk management, adoption of SBOM tools, and enhanced monitoring of supply chain interactions. Given the critical impact on confidentiality, integrity, and availability, ease of exploitation through trusted vendors, and broad scope, this threat is assessed as critical severity.
Red Hat confirms security incident after hackers breach GitLab instance
Source: https://www.bleepingcomputer.com/news/security/red-hat-confirms-security-incident-after-hackers-breach-gitlab-instance/
With the recent npm/Node.js supply chain incident (phished maintainer, 18 packages briefly shipping crypto-stealing code), I wanted to share a small project:
**Typo squat Detective,** a 2-3 minute browser game to practice spotting look-alike domains.
It covers:
• Numbers ↔ letters (1 ↔ l, 0 ↔ o)
• Unicode homoglyphs (Cyrillic/Greek lookalikes)
• Punycode (`xn--`) tricks
Play it here: [https://typo.himanshuanand.com/](https://typo.himanshuanand.com/)
Curious to hear which tricks fooled you and if you would like more levels/brands.
Nevada State Offices Halt Services After Cyber Incident
Source: https://www.databreachtoday.co.uk/nevada-state-offices-halt-services-after-cyber-incident-a-29290
Hi all, I discovered suspicious behavior and possible malware in a file related to the official MicroDicom Viewer installer. I’ve documented everything including hashes, scan results, and my analysis in this public GitHub repository:
[https://github.com/darnas11/MicroDicom-Incident-Report](https://github.com/darnas11/MicroDicom-Incident-Report)
Feedback and insights are very welcome!
