This open-source collaborative effort to share global AI security standards, regulations, and knowledge aims to mitigate risk and boost AI cybersecurity for all.
In December 2020, a cybersecurity company alerted the world to a major cyberattack against the U.S. software development company, SolarWinds, through the company's Orion software product ("SolarWinds Attack").
Share
ESET researchers have uncovered a supply-chain attack on the website of a government in Southeast Asia.
Just a few weeks after the supply-chain attack on the Able Desktop software, another similar attack occurred on the website of the Vietnam Government Certification Authority (VGCA): ca.gov.vn. The attackers modified two of the software installers available for download on this website and added a backdoor in order to compromise users of the legitimate application.
ESET researchers uncovered this new supply-chain attack in early December 2020 and notified the compromised organization and the VNCERT. We believe that the website has not been delivering compromised software installers as of the end of August 2020 and ESET telemetry data does not indicate the compromised installers being distributed anywhere else. The Vietnam Government Certification Authority confirmed that they were aware of the attack before our notification and that they notified the use
We have identified a global campaign that introduces a compromise into the networks of public and private organizations through the software supply chain, FireEye CEO Kevin Mandia announced in a Sunday blog post. This compromise is delivered through updates to a widely used IT infrastructure management software - the Orion network monitoring product from SolarWinds. The campaign demonstrates top-tier operational tradecraft and resourcing consistent with state-sponsored threat actors.
Left unsaid in Mandia s statement was that FireEye was one of the victims of the campaign against an unknown number of SolarWinds customers, which include hundreds of the world s largest companies and government agencies, including the U.S. National Security Agency.