Author: DEROBS

The LiteLLM project has confirmed a security compromise affecting its software release pipeline. According to reports, attackers successfully infiltrated the project’s PyPI package repository, using the breach to distribute malicious payloads to unsuspecting users.

The compromised packages and associated malicious Docker images were designed to function as info-stealer malware. When executed, this payload actively scans for and exfiltrates sensitive information from the infected environment, including credentials, security secrets, and environment variables.

This incident underscores the ongoing risks associated with software supply chain security, particularly for open-source projects that serve as critical infrastructure for AI developers. By compromising the release pipeline, attackers can leverage the trust established in legitimate software distributions to deliver malicious code directly into development and production environments.

Users of the LiteLLM project are advised to verify their current installations and monitor for any indicators of unauthorized access to their systems or exposed environment variables. As the investigation into the scope of the compromise continues, developers relying on automated deployment pipelines should remain vigilant against similar supply chain attacks that target software package repositories.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/litellm-release-pipeline-hacked-to-distribute-info-stealer-malware/

A large number of grocery stores across the European Union have experienced financial losses totaling millions of euros, according to reports. These losses have been attributed to the use of outdated operational technology (OT) firmware managing the refrigeration and air conditioning systems within their facilities.

The affected businesses had engaged third-party providers to oversee the maintenance and management of these critical systems. The reliance on these external managers to keep the firmware current became a significant point of failure, as the outdated software left the systems susceptible to operational issues or security risks. The resulting technical failures in these climate-control systems led to substantial economic impact for the retailers.

Source: Dark Reading
Original article: https://www.darkreading.com/ics-ot-security/eu-grocers-unpatched-fridge-firmware-french

Japanese gaming publisher Capcom has formally confirmed that its internal membership service, CAPCOM ID, was compromised by unauthorized actors. The breach has resulted in the exposure of email addresses and associated personal information for more than 11.7 million registered users.

As of this reporting, the company has acknowledged the scope of the incident regarding its digital membership infrastructure. Further technical details concerning the nature of the unauthorized access or the specific methodology used by the attackers remain limited beyond the confirmation of the exposed account count.

This incident underscores the security challenges faced by major gaming organizations, which manage large-scale databases containing user credentials and personal identifiers. The exposure of such a significant volume of account data highlights the importance of robust security protocols for centralized identity management systems in the gaming industry.

Source: BleepingComputer
Original article: https://www.bleepingcomputer.com/news/security/capcom-confirms-data-breach-affecting-117-million-accounts/

U.S. federal authorities have conducted an enforcement action, referred to as “Operation Lonestar Justice,” aimed at dismantling infrastructure used by North Korean IT workers within the United States. The operation targeted systems described as “laptop farms” that were reportedly utilized to facilitate illicit digital operations.

While specific technical details regarding the size and location of the seized hardware are limited, the operation highlights ongoing efforts by U.S. authorities to address the threat posed by North Korean operatives who infiltrate corporate networks by misrepresenting their identities. These individuals often utilize remote-access infrastructure to secure employment and gain unauthorized access to corporate environments.

The incident serves as a reminder of the evolving challenges organizations face concerning insider threats and the exploitation of distributed work models. Further details regarding the scope of the operation and the implications for affected entities remain subject to ongoing investigation.

Source: Dark Reading
Original article: https://www.darkreading.com/insider-threats/texas-laptop-farms-north-korean-it-workers