Loading story…
Researchers reported a supply-chain attack involving BuddyBoss, describing how a compromise of the vendor’s software distribution or update path enabled malicious code to reach downstream customer environments. The incident was presented as a targeted intrusion with supply-chain characteristics, in which trusted BuddyBoss components were used as the delivery mechanism, increasing the likelihood that affected organizations would install the tampered software without immediate detection.
A follow-on incident analysis detailed the attack chain and its operational impact on victims, focusing on how the compromise was introduced, propagated, and identified. The reporting indicates that the case has become a notable example of third-party software risk, with defenders urged to review BuddyBoss-related deployments, validate software integrity, and investigate for signs that trusted application updates or packages were altered before reaching production systems.
Trace attribution and downstream blast radius.
1 event from the most recent confirmed update back to the earliest known activity.
Ctrl-Alt-Intel published research articles titled "The BuddyBoss Attack: Claude’s Supply-Chain Attack" and "The BuddyBoss Attack: Full Incident Analysis." The provided references indicate reporting and analysis of the BuddyBoss incident but do not include underlying event details to extract a fuller timeline.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Criminal and espionage-aligned actors are increasingly using **supply chain compromise** as a primary access strategy, chaining vendor breaches, open-source package poisoning, credential theft, and follow-on ransomware/extortion into a “self-reinforcing” cycle. Reporting on a Group-IB trends assessment described how compromises of software packages and third parties (including examples such as the **Shai-Hulud NPM worm**, package poisoning activity, and SaaS/OAuth abuse) are used to inherit trusted access into customer environments—particularly via high-leverage providers like **MSPs** and widely used business platforms (HR/CRM/ERP). The same reporting highlighted an expected acceleration in attack speed and scale as adversaries apply AI-assisted discovery across vendors and CI/CD pipelines, and a shift toward **identity-centric intrusions** that blend into normal user activity. Separate reporting described a large cross-platform campaign attributed to **“RU-APT-ChainReaver-L”** that used compromised distribution infrastructure—specifically file-sharing mirror services **Mirrored.to** and **Mirrorace.org** and hijacked GitHub repositories—to redirect users through deceptive chains and deliver **infostealer malware** signed with valid certificates and hosted via legitimate cloud services. Researchers tied the activity to credential theft observed on dark web markets and reported infrastructure at significant scale (100+ domains spanning redirectors, infection pages, and C2), with frequent tooling changes to evade antivirus detection. Other items in the set were general commentary on third-party risk, mobile-app supply chain exposure, and healthcare targeting trends, and did not provide additional, specific details about the same incidents beyond reinforcing that third-party and supply chain weaknesses are increasingly exploited for downstream compromise.
Jun 29, 2026
A supply chain attack compromised multiple **Checkmarx** distribution channels, including **KICS Docker images**, the **Checkmarx VS Code extension**, and the `ast-github-action` GitHub Action, with the malicious artifacts built to collect, encrypt, and exfiltrate secrets from affected environments. Reporting linked the activity to **TeamPCP**, which publicly claimed responsibility, and described the campaign as distinct from an earlier March incident involving Checkmarx. The activity later expanded to the **Bitwarden CLI** ecosystem, where a malicious version of the npm package `@bitwarden/cli` was briefly published. The trojanized VS Code extensions were also reported to target **npm tokens**, raising the risk of follow-on supply chain compromise, while some malicious Docker images were removed by about **18:20 UTC** on April 22; however, the compromised extensions reportedly remained available on **OpenVSX** into April 23.
Jun 29, 2026
Attackers leveraged trusted remote management software in two separate supply chain intrusions, including a ransomware case tied to **Kaseya VSA** and a credential-dumping operation delivered through a **Desktop Central** agent. In the Kaseya-linked incident, the intrusion chain used the Kaseya agent to create and decode malicious payloads, attempted to disable Microsoft Defender protections, and dropped ransomware-related components including `agent.exe` and `MsMpEng.exe`. In the second intrusion, the attackers used the Desktop Central agent to gain footholds, established persistence with scheduled tasks, forwarded traffic with **GO Simple Tunnel**, and deployed `setup0.exe` alongside `elevateutils.exe`, which analysis identified as a **Cobalt Strike Beacon** Malleable C2 stager communicating with `vmware[.]center`. Investigators contained the activity through root-cause analysis, IOC hunting, and endpoint isolation, underscoring how centralized management platforms can become high-impact supply chain attack vectors if not closely monitored and hardened.
Aug 14, 2026