Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The end of an era is upon us, as SAP has announced the end of life for their identity governance and administration (IGA) platform — a platform that supported several SAP products. Without this pivotal identity management tool, where are customers to go to protect the digital identities of their organization? And how can they know that any new platform will be trustworthy? SAP hasn’t left their customers in a lurch.

A new npm supply-chain compromise is targeting the SAP developer ecosystem. The affected packages we are tracking so far are: The pattern is familiar but also a bit different: a trusted package receives a new preinstall hook, the hook runs a new setup.mjs file, and that loader downloads the Bun JavaScript runtime to execute a large obfuscated payload named execution.js. The payload is an 11.7 MB credential stealer and propagation framework.

7 stolen GitHub tokens. 971 repositories. A self-replicating supply chain attack targeting SAP's Node.js packages — and it's still active. Here's what GitGuardian found.

This post covers a supply chain attack introducing a capability not seen before: using an AI coding assistant’s own GitHub access to commit malicious code to a corporate repository.

SAP environments, especially in the age of cloud work and hybrid infrastructures, are ripe with security complications. But SAP support and security is nothing to scoff at. Access controls alone in SAP environments require compliance capabilities for ultimate security, regardless of the security solution or deployment scenario.

DLP and Secude solutions work together to protect your IP data from creation to deletion - no matter where it travels. Here’s how. Engineering simulations. Machinery instructions. Prototype designs. CAD software is essential across the modern manufacturing production chain and contains manufacturers’ most confidential intellectual property (IP). Yet, much of the manufacturing industry still relies on Data Loss Prevention (DLP) tools to protect its CAD data.

DLP and Secude solutions protect your IP data from generation to storage to deletion - no matter where it travels. Here’s how. Building designs, mechanical drawings, structural plans. CAD software is the backbone of modern AECO projects and contains some of AECO’s most confidential intellectual property (IP). But most architects, engineers, construction firms and operations companies still rely on Data Loss Prevention (DLP) tools to protect their CAD data.

DLP and Secude solutions work alongside each other to protect your IP data from generation to storage and in transit. Here’s how. Submarine motors. Aircraft engines. Spatial systems. Command platforms. No matter the product, CAD software underpins the modern Defense production chain and contains Defense contractors’ most confidential intellectual property (IP).

To protect your IP, your CAD files need file-level security, unencrypted labelling, digital supply chain security and CAD file data governance. How seriously do you take IP protection? Architecture, Engineering, Construction and Operations (AECO) companies that treat IP protection as an afterthought are sleepwalking into disaster.

The BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) team are tracking an adversary luring users into downloading fake Concur browser extensions. The fake browser extension installer contains a FireClient Loader designed to gather host information and send to its command and control (C2) server. If execution succeeds with successful communication to the C2, the loader drops a backdoor BlueVoyant is naming FireClient Backdoor.