Kaspersky details Black Owl APT breach of software vendor eyeing supply-chain attack
cyb3rops · x · 2026-11-12
Kaspersky ICS CERT reports a months-long compromise of a software developer's network by the Black Owl (BO Team) APT group:
- Detected in June 2025 via anomalous SMB connections on admin machines; malware with BO Team hallmarks found on day one.
- Attackers seized nearly all key infrastructure: domain, servers and network gear, mail, virtualization, Ansible orchestration, backups, security systems, plus web servers and the DNS zone.
- Critically, they compromised the CI/CD pipeline and the software digital-signature server, indicating a supply-chain attack intent.
- Unlike BO Team's usual ransomware-and-Telegram-bragging pattern, there was no data destruction or PR — instead they entrenched with command channels and backdoors for persistent access.
A reminder that signing servers and CI/CD are now prime APT targets for software supply-chain compromise.
More from Infra
- LeapQuant: training-free quantization makes linear attention up to 4.25x faster — tianyin_xu · 2026-11-12
- Microsoft's MAI Transcribe 2 sees 12x usage growth, hitting 8.5M weekly transcriptions — mustafasuleyman · 2026-11-12
- gVisor joins CNCF with Modal as co-maintainer after upstreaming GPU and training support — josh_wills · 2026-11-12
- Local vs Cloud AI Coding Agents: Benchmarks, Hardware Costs, Performance — luisdans · 2026-11-12
- Agent Substrate 1.0 GA: microVM-sandboxed agent runtime with zero ambient credentials — rakyll · 2026-11-12
- WSJ: Nvidia is preparing to oust CEO Jensen Huang — jbredeche · 2026-11-12