Major Incidents or Breaches

  • A former IT employee at an Iowa school district was sentenced to 21 months in prison after orchestrating a prolonged cyberattack against the district, causing significant disruption to classroom operations and deleting critical data[2].
  • Chinese state-sponsored hackers maintained undetected access for a decade on a target organization’s isolated network by hijacking the authentication stack, enabling long-term espionage and administrative visibility[3].

Newly Discovered Vulnerabilities

  • Splunk issued security updates for a critical vulnerability in Splunk Enterprise that allows unauthenticated attackers to perform file operations and execute remote code[1].

Notable Threat Actor Activity

  • Chinese threat actors demonstrated advanced persistence techniques by compromising authentication flows to spy on an isolated network over a ten-year period, maintaining administrative access throughout[3].

Trends, Tools, or Tactics of Interest

  • NPM version 12 will change its default script execution behavior to mitigate supply chain attacks; scripts from dependencies will no longer execute automatically during npm install unless explicitly permitted[5].

Regulatory or Policy Developments Affecting the Security Industry

  • No significant developments identified.

Sources#

  1. Ex-school district employee jailed for hacks on former employer - bleepingcomputer.com
  2. Chinese hackers hijack auth flow, spy on isolated network for a decade - bleepingcomputer.com
  3. Critical Splunk Enterprise Flaw Lets Attackers Run Code Without Authentication - thehackernews.com
  4. NPM 12 Will Change Script Execution Behavior to Prevent Supply Chain Attacks - securityweek.com