National CERT/CC

🚨CyberPulse Issue 16 | Cybersecurity Awareness Bulletin This week’s biggest threat: Binance has confirmed a security incident affecting about $6.3 billion in assets, the largest crypto heist on record, overtaking the $1.5 billion Bybit theft. Nearly $3 billion has been frozen so far. The breach reportedly started with a compromised laptop belonging to one Binance engineer, which gave the attacker access to submit unauthorised withdrawals. TRM Labs and Chainalysis have linked the attack to North Korea with high confidence. One compromised laptop, billions gone. Also flagged: ❗eMudhra CA Weak Keys: A script error caused this Indian certificate authority to generate weak intermediate CA keys. No publicly trusted certificates were affected, but it’s a reminder that even trust infrastructure has bugs. ❗GitHub Token Leak: A leaked GitHub token with publish access to widely used npm packages was found this week. One leaked token can threaten software that millions depend on. ❗ConnectWise Cloud Backup Breach: Attackers used stolen credentials and AI-assisted tools to reach downstream Microsoft 365 accounts, and the access keys they obtained reportedly still work even after the vendor’s fix. 💡Tip: After a major breach like Binance’s, scammers move fast with fake “compensation” or “verify your account” messages aimed at worried users. If you get a message claiming to be from an exchange after a breach, go directly to their official website instead of clicking any link. Protect yourself: ✔️Secure work laptops and the accounts on them ✔️Keep access tokens and keys private, and replace them if exposed ✔️Ignore “compensation” messages and use official websites only Read, share, help build a safer digital Uganda. #CyberPulse #CyberSecurity #CERTUg #PoweredByNITAU

🚨CyberPulse Issue 15 | Cybersecurity Awareness Bulletin This week's biggest threat: PHP rushed out an emergency patch for two critical flaws dubbed PHP2Shell, and attackers started exploiting them just 19 minutes later. The flaw sits in PHP itself, so even a well-secured website can be exposed if the language running it hasn't been updated. With so much of the web, including WordPress, built on PHP, this one reaches far. Also flagged: ❗AI-Powered Hacking: One hacker used autonomous AI agents to breach over 100 corporate websites, including Deere and Cummins, at about $50 per attack. ❗Burger King Japan Breach: Contact details, birth dates and regional data of over 11 million app users were exposed. Watch out for phishing messages. ❗OVHcloud Tool Hijacked: A compromised employee GitHub account was used to publish a malicious version of OVHcloud's official command-line tool. 💡Tip: This month, attackers hijacked a WordPress backup plugin's cloud service, a Siemens update tool and a cloud provider's own command-line tool, all software people already trusted. Before updating any tool that manages your infrastructure or backups, confirm the update came from your team, not a prompt you don't remember approving. Protect yourself: ✔️Update PHP on all your servers now ✔️Verify updates before installing them ✔️Be wary of unexpected messages after a data breach Read, share, help build a safer digital Uganda. #CyberPulse #CyberSecurity #CERTUg #PoweredByNITAU