Dec 5, 2024
1 new incident, 1 with updates.
Started
- ClosedPatched
BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)
Attackers stole a BeyondTrust infrastructure API key for its Remote Support SaaS service and used it to reset local passwords and access 17 customer instances. The US Treasury, one of the customers, said a China state-sponsored actor accessed some Departmental Offices workstations and unclassified documents. During the investigation BeyondTrust found a critical command injection in Remote Support and Privileged Remote Access (CVE-2024-12356, CVSS 9.8) and patched it on 2024-12-16. Added to the CISA KEV catalog on 2024-12-19.
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS)Closed Dec 19, 2024
Updated
- ClosedPatched
Ultralytics PyPI releases backdoored with a crypto miner
Attackers compromised the Ultralytics YOLO project's GitHub Actions workflows (by poisoning the Actions cache) and published ultralytics 8.3.41 and 8.3.42 to PyPI with an XMRig cryptominer. They later pushed 8.3.45 and 8.3.46 using a leftover PyPI API token. All four versions were removed. PyPI's analysis credits Trusted Publishing attestations with making the attack auditable.
ultralytics (PyPI)Closed Dec 11, 2024
