Tag index

Generated from page-level ## Tags sections. Each tag below links to the pages that currently use it.

All tags

• 3CX (1)
• Accellion (1)
• ai-agent (1)
• Albania (1)
• appliance (1)
• AWS (1)
• Barracuda (1)
• Bash Uploader (1)
• Bitbucket (1)
• branch-name-injection (1)
• build-time compromise (1)
• CCleaner (1)
• CI/CD (9)
• CircleCI (1)
• Citrix (1)
• cloud (1)
• Cloudflare (1)
• Codecov (1)
• Coinbase (1)
• ConnectWise (1)
• credential theft (2)
• credential-theft (1)
• critical-infrastructure (1)
• CVE-2023-2868 (1)
• CVE-2023-4966 (1)
• CVE-2024-1708 (1)
• CVE-2024-1709 (1)
• CVE-2024-3094 (2)
• data theft (1)
• developer machines (1)
• DEWMODE (1)
• edge appliance (1)
• email (1)
• email gateway (1)
• energy-sector (1)
• ESG (1)
• espionage (3)
• extortion (1)
• faketivism (1)
• filename-injection (1)
• FTA (1)
• GCS (1)
• GitHub (1)
• GitHub Actions (6)
• GitHub OAuth (1)
• group (1)
• groups (2)
• hack-and-leak (1)
• HAR files (1)
• ICONICSTEALER (1)
• ICS (1)
• identity (1)
• Iran (1)
• Israel (1)
• legacy software (1)
• liblzma (1)
• Linux (1)
• macOS (1)
• maintainer persona (1)
• malicious releases (1)
• malware (2)
• MFA bypass (2)
• MOIS (1)
• MSP (1)
• NetScaler (1)
• npm (3)
• Okta (2)
• operations (19)
• ops (16)
• people (1)
• persistence (4)
• Piriform (1)
• prompt-injection (1)
• psychological operations (1)
• PyPI (1)
• release tampering (1)
• remote access (1)
• reviewdog (1)
• Russia (2)
• sabotage (1)
• ScreenConnect (1)
• script-injection (1)
• secret exposure (1)
• secrets (2)
• session hijacking (2)
• session theft (1)
• ShadowPad (1)
• signed updates (1)
• smishing (1)
• spearphishing (1)
• SSH (1)
• state-linked (1)
• supply-chain (13)
• tag tampering (1)
• TeamPCP (1)
• TeamViewer (1)
• Telegram (1)
• tj-actions (1)
• token theft (1)
• tooling (5)
• Trading Technologies (1)
• transnational repression (1)
• Twilio (1)
• watering-hole (1)
• Windows (2)
• wiper (1)
• worm (3)
• X_TRADER (1)
• xz (1)
• Zero Trust (1)

3CX

• 3CX desktop app compromise

Accellion

• Accellion FTA exploitation campaign

ai-agent

• HackerBot Claw

Albania

• Handala

appliance

• Barracuda ESG zero-day backdoor campaign

AWS

• CircleCI 2023 customer secret exposure incident

Barracuda

• Barracuda ESG zero-day backdoor campaign

Bash Uploader

• Codecov Bash Uploader compromise

Bitbucket

• CircleCI 2023 customer secret exposure incident

branch-name-injection

• HackerBot Claw GitHub Actions exploitation campaign

build-time compromise

• XZ Utils backdoor

CCleaner

• CCleaner signed-update compromise

CI/CD

• CircleCI 2023 customer secret exposure incident
• Codecov Bash Uploader compromise
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• LiteLLM compromise
• TeamPCP
• tj-actions and reviewdog compromise
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline

CircleCI

• CircleCI 2023 customer secret exposure incident

Citrix

• CitrixBleed session-hijack wave

cloud

• APT29

Cloudflare

• Okta support-system compromise

Codecov

• Codecov Bash Uploader compromise

Coinbase

• tj-actions and reviewdog compromise

ConnectWise

• ConnectWise ScreenConnect exploitation wave

credential theft

• LiteLLM compromise
• Trivy compromise

credential-theft

• APT29

critical-infrastructure

• Dragonfly

CVE-2023-2868

• Barracuda ESG zero-day backdoor campaign

CVE-2023-4966

• CitrixBleed session-hijack wave

CVE-2024-1708

• ConnectWise ScreenConnect exploitation wave

CVE-2024-1709

• ConnectWise ScreenConnect exploitation wave

CVE-2024-3094

• JiaT75
• XZ Utils backdoor

data theft

• Accellion FTA exploitation campaign

developer machines

• Trivy compromise

DEWMODE

• Accellion FTA exploitation campaign

edge appliance

• CitrixBleed session-hijack wave

email

• APT29

email gateway

• Barracuda ESG zero-day backdoor campaign

energy-sector

• Dragonfly

ESG

• Barracuda ESG zero-day backdoor campaign

espionage

• APT29
• Barracuda ESG zero-day backdoor campaign
• Dragonfly

extortion

• Accellion FTA exploitation campaign

faketivism

• Handala

filename-injection

• HackerBot Claw GitHub Actions exploitation campaign

FTA

• Accellion FTA exploitation campaign

GCS

• Codecov Bash Uploader compromise

GitHub

• JiaT75

GitHub Actions

• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• TeamPCP
• tj-actions and reviewdog compromise
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline

GitHub OAuth

• CircleCI 2023 customer secret exposure incident

group

• HackerBot Claw

groups

• APT29
• Dragonfly

hack-and-leak

• Handala

HAR files

• Okta support-system compromise

ICONICSTEALER

• 3CX desktop app compromise

ICS

• Dragonfly

identity

• 0ktapus phishing campaign

Iran

• Handala

Israel

• Handala

legacy software

• Accellion FTA exploitation campaign

liblzma

• XZ Utils backdoor

Linux

• XZ Utils backdoor

macOS

• 3CX desktop app compromise

maintainer persona

• JiaT75

malicious releases

• LiteLLM compromise

malware

• CanisterWorm
• TeamPCP

MFA bypass

• 0ktapus phishing campaign
• CitrixBleed session-hijack wave

MOIS

• Handala

MSP

• ConnectWise ScreenConnect exploitation wave

NetScaler

• CitrixBleed session-hijack wave

npm

• CanisterWorm
• TeamPCP
• Trivy → TeamPCP → CanisterWorm: compromise timeline

Okta

• 0ktapus phishing campaign
• Okta support-system compromise

operations

• 0ktapus phishing campaign
• 3CX desktop app compromise
• Accellion FTA exploitation campaign
• Barracuda ESG zero-day backdoor campaign
• CanisterWorm
• CCleaner signed-update compromise
• CircleCI 2023 customer secret exposure incident
• CitrixBleed session-hijack wave
• Codecov Bash Uploader compromise
• ConnectWise ScreenConnect exploitation wave
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• LiteLLM compromise
• Okta support-system compromise
• TeamPCP
• tj-actions and reviewdog compromise
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• XZ Utils backdoor

ops

• 0ktapus phishing campaign
• 3CX desktop app compromise
• Accellion FTA exploitation campaign
• Barracuda ESG zero-day backdoor campaign
• CCleaner signed-update compromise
• CircleCI 2023 customer secret exposure incident
• CitrixBleed session-hijack wave
• Codecov Bash Uploader compromise
• ConnectWise ScreenConnect exploitation wave
• HackerBot Claw GitHub Actions exploitation campaign
• LiteLLM compromise
• Okta support-system compromise
• tj-actions and reviewdog compromise
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• XZ Utils backdoor

people

• JiaT75

persistence

• CanisterWorm
• TeamPCP
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline

Piriform

• CCleaner signed-update compromise

prompt-injection

• HackerBot Claw GitHub Actions exploitation campaign

psychological operations

• Handala

PyPI

• LiteLLM compromise

release tampering

• Trivy compromise

remote access

• ConnectWise ScreenConnect exploitation wave

reviewdog

• tj-actions and reviewdog compromise

Russia

• APT29
• Dragonfly

sabotage

• Handala

ScreenConnect

• ConnectWise ScreenConnect exploitation wave

script-injection

• HackerBot Claw GitHub Actions exploitation campaign

secret exposure

• tj-actions and reviewdog compromise

secrets

• CircleCI 2023 customer secret exposure incident
• Codecov Bash Uploader compromise

session hijacking

• CitrixBleed session-hijack wave
• Okta support-system compromise

session theft

• CircleCI 2023 customer secret exposure incident

ShadowPad

• CCleaner signed-update compromise

signed updates

• CCleaner signed-update compromise

smishing

• 0ktapus phishing campaign

spearphishing

• Dragonfly

SSH

• XZ Utils backdoor

state-linked

• APT29

supply-chain

• 3CX desktop app compromise
• APT29
• CanisterWorm
• Codecov Bash Uploader compromise
• HackerBot Claw
• HackerBot Claw GitHub Actions exploitation campaign
• JiaT75
• LiteLLM compromise
• TeamPCP
• tj-actions and reviewdog compromise
• Trivy compromise
• Trivy → TeamPCP → CanisterWorm: compromise timeline
• XZ Utils backdoor

tag tampering

• tj-actions and reviewdog compromise

TeamPCP

• Trivy compromise

TeamViewer

• CCleaner signed-update compromise

Telegram

• 0ktapus phishing campaign

tj-actions

• tj-actions and reviewdog compromise

token theft

• Okta support-system compromise

tooling

• CanisterWorm
• HackerBot Claw
• LiteLLM compromise
• TeamPCP
• Trivy → TeamPCP → CanisterWorm: compromise timeline

Trading Technologies

• 3CX desktop app compromise

transnational repression

• Handala

Twilio

• 0ktapus phishing campaign

watering-hole

• Dragonfly

Windows

• 3CX desktop app compromise
• CCleaner signed-update compromise

wiper

• Handala

worm

• CanisterWorm
• TeamPCP
• Trivy → TeamPCP → CanisterWorm: compromise timeline

X_TRADER

• 3CX desktop app compromise

xz

• JiaT75

Zero Trust

• Okta support-system compromise