Other World Computing to Showcase Thunderbolt 5 Solutions at COMPUTEX TAIPEI 2025

Posted in Commentary with tags on May 19, 2025 by itnerd

Other World Computing today announced it will showcase its award winning family of Thunderbolt 5 storage and connectivity solutions, as well as its unparalleled roster of end-to-end workflow solutions – including memory cards and readers, portable SSDs, desktop and shared storage, docks, hubs, and LTO backup and archiving, at COMPUTEX TAIPEI 2025. 

Attendees visiting OWC Booth #J0527a at 1F of the Taipei Nangang Exhibition Center, Hall 1 (TaiNEX 1), will experience firsthand how the OWC Envoy Ultra, OWC Thunderbolt 5 Hub, OWC ThunderBlade X12, and the newly announced OWC Thunderbolt 5 Dock deliver unmatched speed, connectivity, and efficiency to accelerate creative workflows and professional productivity:

  • OWC Envoy Ultra – Boasting ultra compatibility with Macs, PCs, iPad Pros, Chromebooks, and Surface devices, this portable SSD is ready for rugged, on-the-go use, with bus-powered convenience, a built-in cable, and blazing real-world speeds of over 6000MB/s.
  • OWC Thunderbolt 5 Hub – Transforms a single Thunderbolt 5 connection into three additional Thunderbolt 5 ports and one USB-A port, with support for up to 80Gb/s bi-directional data transfer and up to 120Gb/s bandwidth for high-res displays.
  • OWC Thunderbolt 5 Dock – With 11 versatile ports, it combines exceptional speed, broad device compatibility, and support for high-res displays into one streamlined solution that makes expanding workflows completely effortless.
  • OWC ThunderBlade X12 – This production shuttle and editing RAID SSD makes seemingly impossible video workflows fast, simple, and seamless, with peak and sustained write speeds of up to 6600MB/s and 5990MB/s, respectively.

OWC will also showcase its full ecosystem of storage, connectivity, and backup/archiving solutions during the COMPUTEX TAIPEI 2025 event. Each is designed to simplify and accelerate every step of the workflow, from capture to completion. That includes everything from high-performance memory cards and portable SSDs to powerful desktop and shared storage, flexible docks and hubs, and reliable LTO archiving.

  • OWC Memory Cards and Readers – Built for photographers, videographers, and content creators, delivering the speed, reliability, and seamless integration, especially with OWC’s Innergize software, to keep workflows smooth from capture to completion.
  • OWC Portable SSDs – Ultra-fast, rugged, and bus-powered storage solutions, like the Envoy Pro FX and Express 1M2, designed for creative professionals who demand top-tier performance, cross-platform compatibility, and durable reliability in the field.
  • OWC Desktop Storage – High-capacity, high-performance storage solutions, like the Mercury Elite Pro and ThunderBay series, with versatile connectivity options and robust RAID support, catering to the demanding needs of creative professionals and businesses.
  • OWC Jellyfish – The OWC Jellyfish is a high-performance, easy-to-use shared storage solution, offering capacities ranging from terabytes to petabytes, designed specifically for video teams. It enables seamless collaboration on 4K, 6K, and up to 12K projects without dropped frames. With intuitive management software, built-in security features, and scalable storage options, the OWC Jellyfish empowers creative professionals to streamline their post-production workflow efficiently.
  • OWC Docks and Hubs – A full range of docks and hubs (in addition to Thunderbolt 5 solutions), including Thunderbolt 4, Thunderbolt 3, and USB-C options, that expand connectivity, power delivery, and workflow flexibility for users at home, in the studio, or on the go.
  • OWC Archive Pro Ethernet – Fast and reliable network-based LTO backup and archiving solution engineered for media and entertainment (M&E) pros, government agencies, and any-sized business that needs to protect large volumes of critical data

Leave a comment »

Starburst Unveils New AI Platform Capabilities to Accelerate Enterprise AI and Agents

Posted in Commentary with tags on May 19, 2025 by itnerd

 Starburst, the data platform for apps and AI, today announced a comprehensive set of product innovations across its flagship offerings: Starburst Enterprise Platform and Starburst Galaxy. The new Starburst AI Agent and new AI Workflows are designed to accelerate enterprise AI initiatives and support the transition to a future-ready data architecture built on a data lakehouse. By bringing distributed, hybrid data lakeside to power AI, apps and analytics, Starburst enables faster, more secure, and collaborative data access. With native AI tooling, the Starburst Data Catalog, and advancements to data ingestion, table maintenance and governance, enterprises can unlock the full power of the modern data lakehouse.

AI is pushing the limits of existing enterprise data architecture and most organizations are held back by fragmented data spread across clouds, formats, and teams. Building AI workflows often means stitching together brittle pipelines, coordinating across siloed tools, and managing sensitive data without consistent governance. Legacy architectures make it difficult to access the right data, involve the right stakeholders, and enforce the right policies: slowing experimentation, increasing risk, and delaying results.

Introducing Starburst AI Agents: Unlock the Value of All Enterprise Data for Agent Intelligence

At the heart of Starburst’s latest innovations is Starburst AI Workflows, a purpose-built suite of capabilities that speeds AI experimentation to production for enterprises. AI Workflows connect the dots between vector-native search, metadata-driven context, and robust governance, all on an open data lakehouse architecture. Starburst is also launching Starburst AI Agent, an out-of-the-box natural language interface for Starburst’s data platform that can be built and deployed by data analysts and application-layer AI agents to bring faster insights to business stakeholders. With AI Workflows and the Starburst AI Agent, enterprises can build and scale AI applications faster, with reliable performance, lower cost, and greater confidence in security, compliance and control. 

New Starburst Data and AI Innovations include: 

  • Starburst AI Agent – A built-in conversational interface for governed natural language data product documentation and insight generation, in your secure Starburst environment. Availability: In Private Preview
  • Starburst AI Workflows – With the introduction of Starburst AI Workflows, Starburst is addressing a key challenge in AI: unlocking governed, proprietary data fast enough to drive real outcomes. With AI Workflows, teams can search unstructured data, orchestrate prompts and tasks with SQL, and govern model access, delivered through the unified Starburst platform. AI Workflows combine AI Search to transform unstructured data into vector embeddings in Iceberg using your choice of embedding model, AI SQL Functions to run prompts and built-in LLM tasks from SQL, and AI Model Access Management to control usage and enforce governance – all without pipelines or data movement. Availability: In Private Preview
  • Simplify AI Governance and Collaboration – Galaxy’s AI-Powered Auto-Taggingsimplifies governance by using LLMs to detect sensitive data like PII at the column level. With human-in-the-loop review and support for custom user-defined classifiers, teams can confidently scale ABAC policies and enable secure, self-service access to business users, without requiring manual policy enforcement. Availability: In General Availability
  • Interoperability Without Lock-In: Starburst Data Catalog – Starburst also unveiled Starburst Data Catalog, a modern, enterprise-grade metastore solution purpose-built to replace Hive Metastore in Starburst Enterprise. With native Iceberg support, seamless Hive migration, and a flexible foundation for future multi-engine integration, it helps organizations reduce metadata sprawl, improve query performance, and simplify governance – without vendor lock-in. Availability: In Private Preview
  • Fully Managed Iceberg Pipelines – Starburst Galaxy delivers a fully managed, end-to-end Icehouse lakehouse experience on Iceberg, combining automated maintenance and multiple ingestion options to simplify data readiness at scale. Built-in Live Table Maintenance with built-in maintenance features including compaction, snapshot cleanup, and orphan file removal to keep Iceberg tables performant and cost-efficient with no manual tuning required. Customers can choose between Streaming Ingest for near real-time updates from Kafka or File Loader for batch-style loads from S3, all fully managed in Galaxy. File Loader Generally Available in July, Streaming Ingest and Live Table Maintenance Generally Available now
  • Scale Iceberg Workloads – Starburst Galaxy now streamlines large-scale Iceberg operations with Automated Table Maintenance to manage compaction, cleanup, and retention across deployments, to reduce storage costs and improve query performance with minimal operational overhead. Native support for AWS S3 Table buckets unlocks high-performance querying on Amazon’s new auto-managed storage format, while Nanosecond Timestamp Type Support adds precision for time-sensitive analytics. Automated Table Maintenance is Generally Available; AWS S3 Tables and Iceberg Nanosecond Timestamp Type are in Public Preview.
  • Faster, Reliable Query Performance with Starburst-Native ODBC – Starburst enhances analytics performance with a high-performance ODBC driver built for secure, scalable BI access across both Galaxy and Starburst Enterprise. By eliminating third-party dependencies, the Starburst-Native ODBC enables deeper integration with Trino’s spooling extension, OAuth authentication, and Tableau’s generic connector, and ships alongside Enhanced Power BI Support. Availability: Public Preview, GA in June
  • Starburst Enterprise Gets Even Stronger – Iceberg Parity and Operational Simplicity – Starburst continues to deepen its commitment to advanced features on Starburst Enterprise with new Iceberg-powered capabilities, including Automated Table Maintenance, scheduled materialized view refreshes with Iceberg MV Automatic Refresh, and full support for Data Products on Iceberg – providing a streamlined path to a scalable, collaborative Iceberg lakehouse architecture suitable for AI workloads. Availability: Public Preview
  • Drive Efficiency with Automatic Query Routing – Starburst Galaxy now routes queries to the right cluster based on load or user role, improving performance and simplifying access at scale. User Role-Based Routing directs queries to pre-configured clusters based on a user’s role, maximizing price-performance. Deployment Set Routing supports resilient, large-scale deployments by routing queries across a defined set of clusters – ideal for high concurrency and resilient workloads. User Role-Based Routing is Generally Available, Deployment Set Routing is Private Preview beginning May 30th.
  • Starburst: Data-to-AI Readiness Blueprint –  A new services offering designed to help organizations align their data infrastructure with evolving AI strategies. This comprehensive engagement evaluates the readiness of existing data architecture, streamlines access and integration across hybrid and multi-cloud environments, and ensures robust security and governance to support scalable AI workloads. Customers receive a tailored solution roadmap, architecture blueprint, and data product design guidance—empowering them to build a future-proof, high-performance data foundation optimized for AI innovation and success. Availability: Now

Register for Starburst Launch Point | May 28 (Virtual)

Join Starburst on May 28th for a virtual event where the company will unveil its vision for AI and walk through several exciting new announcements to its platform for data apps and AI. Attendees will hear from CEO Justin Borgman, Starburst product leadership, customers, and data professionals as they share product innovations and insights.

Register for EMEA/NORAM

Register for APAC

Leave a comment »

Creative Labs Memorial Day Sale Announced

Posted in Commentary with tags on May 19, 2025 by itnerd

Creative Labs is kicking off the Memorial Sale season with big savings on some of its most popular audio gear. Here is the early word out on the most attractive deals happening from May 26th, 2025 to June 1st, 2025. 

Aurvana Ace 2 – 47% off!

Original Price: $149.99

Memorial Sale Price: $79.99 + Free Shipping

Powered by xMEMS technology, the Aurvana Ace 2 unleashes the full potential of lifelike sound. It offers superior CD-quality clarity and precision, enhanced by Snapdragon Sound with Qualcomm aptX Lossless technology and Qualcomm Adaptive Active Noise Cancellation. These premium features are beautifully complemented by an aesthetically pleasing translucent compact charging case, perfectly blending performance and style.

SXFI CARRIER – 32% OFF

Original Price: $999.99

Memorial Sale Price: $679.99 + Free Shipping

Jointly developed by Creative and Dolby Laboratories, SXFI CARRIER has the same sound signature as the 15.2 Sonic Carrier at less than half the size and at a fraction of the price. Compact yet powerful, the SXFI Carrier delivers room-filling audio, virtual surround, and Creative’s award-winning Super X-Fi® headphone holography—ideal for both movies and gaming.

Outlier Free Pro+ – 33% OFF

Original Price: $149.99

Memorial Sale Price: $99.99 + Free Shipping

Perfect for active lifestyles, these wireless bone conduction headphones come with an IPX8 waterproof rating, a built-in 8 GB MP3 player, and Bluetooth 5.3. The Outlier Free Pro+ makes it easy to enjoy music or podcasts while staying aware of the surroundings—whether running, swimming, or cycling.

Creative Zen Hybrid 2 – 14% OFF

Original Price: $69.99

Memorial Sale Price: $59.99 + Free Shipping

A go-to headphone for work, travel, and everything in between. The Zen Hybrid 2 packs in hybrid ANC, up to 67 hours of battery life, and 40mm drivers—all in a sleek, foldable design. Great for tuning out distractions and staying focused wherever the day takes you.

Sound Blaster G6 – 22% OFF

Original Price: $179.99

Memorial Sale Price: $139.99 + Free Shipping

The Sound Blaster G6 is a compact and powerful gaming DAC and amp designed to take gaming and music to the next level. With 32-bit/384 kHz audio, Dolby Digital support, and Scout Mode for better in-game awareness, it delivers incredible sound on both console and PC—making every gaming session and music playlist sound amazing.

Creative BT-W6 – 10% OFF

Original Price: $49.99

Memorial Sale Price: $44.99 + Free Shipping

Upgrade your wireless connection with this compact Bluetooth 5.3 audio transmitter. Featuring aptX Adaptive, aptX HD, and LE Audio, the BT-W6 ensures low-latency, high-fidelity transmission for gaming, streaming, and music.

To discover more of Creative’s great deals, head over to creative.com/sale

Leave a comment »

Review: OWC Thunderbolt 5 Hub

Posted in Products with tags on May 16, 2025 by itnerd

When I did my last office setup, I got this monitor and I ran a lot of my USB devices through it. While it was functionally fine, there were three things that I was not a fan of:

  • This monitor only charges my MacBook Pro at 65W.
  • The USB ports were limited to 5 Gbps in terms of speed.
  • The USB ports were limited to a max of 7.5W depending on the port.

Now I did highlight these in my review of the monitor. But I did want to address that and add some convenience to my setup. Thus after some research, I went to OWC’s website and ordered this.

This is the OWC Thunderbolt 5 Hub. I picked this hub because I wanted to future proof myself for when I replace my M1 Pro MacBook Pro with a newer model that supports Thunderbolt 5. Pictured above is the hub at the top. The power brick on the left along with a AC power cable at the bottom. Finally there’s a Thunderbolt 5 cable that’s 0.8M long and appears to be of very good quality. I do have a minor gripe about the power brick though. I would honestly have preferred that OWC took the approach that they did with the Thunderbolt Go Dock to integrate the power brick into the device. That would have made cable management a whole lot easier for me as I have a standing desk. Ideally, I would like to only to deal with cable managing one long cable as opposed to cable managing one cable and a power brick. But in the case of this hub, I had to account for the brick in both the standing and sitting positions that the desk offers. I eventually found a location on my desk for the hub, which in turn facilitated a route underneath my desk for the cable that allowed the brick to sit on the floor when the desk was in the sitting position, and have the brick slightly off the floor in the standing position. That’s not ideal, but it’s the best that I could come up with and I may revisit this at some point in the future to see if I can do better. Having said that, OWC might want to either rethink the brick as a whole, or make the cable with the barrel end connector that goes into the hub another foot longer to accommodate use cases like mine.

One thing that you will notice on the bottom of the power brick is a QR code that goes to OWC’s website where you will find any instructions that you need. There’s another just like it at the bottom of the hub itself. Bonus points to OWC for doing that as it reduces the chances that someone won’t RTFM and get into trouble as a result. Another thing that you will notice is that while the sides of the hub are aluminium, the top is made of plastic and is a bit of a fingerprint magnet.

On the back of the hub, you get a Kensington lock slot, the barrel connector for AC power, and three Thunderbolt 5 ports that do 80 Gbps bi-directionally, or 120 Gbps one way for video to say a 6K or 8K monitor. The one on the left goes to your computer and can charge it at 140W. The port next to it is where I plugged my monitor into which has this webcam, this light, and this card reader plugged into it. The port on the right is where I plugged in these speakers which allowed me to get rid of an audio cable and a USB power adapter in the process as the Thunderbolt 5 ports provide power. Plus because the speakers are now plugged into a Thunderbolt 5 port, the sound that they produce is marginally better. That’s a win right there as I get better sound and I have to deal with one less cable to manage along with having to use one less power adapter.

When it comes to monitors, the hub supports:

  • Up to three 8K monitors @ 60Hz
  • or two 8K monitors @ 120Hz
  • or three 4K monitors @ 144Hz

All of that assumes you have a Mac or PC with Thunderbolt 5. But I had no issue running my 4K monitor at 144 Hz or at an adaptive refresh rate of up to 120 Hz on my MacBook Pro which has Thunderbolt 4. In case you’re wondering what the holes are above the Thunderbolt 5 ports, they’re for OWC ClingOn cable stabilizer mounts which you can use to help prevent accidental cable disconnections. Those need to be purchased separately.

Now to the front of the hub where you get a USB-A 3.2 Gen 2 port that does 10 Gbps and a Thunderbolt 5 port. By having these ports on the front makes life easy for me in terms of when I need to plug in a device like a hard drive. Speaking of hard drives, I tested the speed of this hub by using this OWC hard drive. Here’s what I got:

These speeds are pretty close to the speeds that I got when I tested the same drive directly connected to my MacBook Pro. Thus I have no complaints here.

On the left side is a power button that’s flush with the rest of the hub’s case. Thus the possibility of accidental presses is basically eliminated.

On the bottom are lights that indicate the power status and Thunderbolt connectivity. It’s cool that they put these lights on the bottom as they don’t add to the light pollution that exists in my home office because of my various devices having LED lights that I can’t easily disable or hide.

Setting up the hub was pretty easy as I literally plugged everything in and was up and running in minutes. The only thing that I did not do was install the OWC Dock Ejector software. Now while I do have an Apple SuperDrive kicking around, I have not used it to burn a CD or DVD in years other than to test an OWC product. I should note that the Dock Ejector software has been completely rewritten to address what I had noticed when I reviewed the Thunderbolt Go Dock. Also, you don’t need to have an OWC dock or hub to use it as it will eject anything (disks and the like) from any vendor. More details on this latest version of OWC Dock Ejector can be found here.

Here’s the hub in place and in operation. Yes I will get around to cleaning up the cabling as I am not a fan of it either as it looks messy.

In daily usage, the hub never got anything other than warm to the touch, and I have had no issues in terms of plugging devices in and having them available for use. And I guess I should answer why I went the hub route rather than getting a dock with even more ports. Simply put, it was overkill for my needs as docks typically have things like Ethernet, card readers and the like built in. I already have a card reader and none of my computers use Ethernet. So the hub is the best way to go for me. While it would have been nice to have one more Thunderbolt 5 port on this hub, I could always daisy chain another hub with this one to get more ports.

The OWC Thunderbolt 5 Hub goes for $189 USD. Though I will note that OWC does put them on sale from time to time. This hub is a welcome addition to my office setup and frankly, I should have gotten it sooner as it solved a number of irritants that I had with my setup. Thus making my setup much more functional for me.

Leave a comment »

US Retailers Now Targeted by Hackers Behind UK Retail Attacks

Posted in Commentary with tags on May 15, 2025 by itnerd

Google has warned that the hackers using Scattered Spider tactics against retail chains in the UK have now started targeting retailers in the US in ransomware and extortion operations

More details here: https://www.bleepingcomputer.com/news/security/google-scattered-spider-switches-targets-to-us-retail-chains/  

But here’s the TL:DR:

“The US retail sector is currently being targeted in ransomware and extortion operations that we suspect are linked to UNC3944, also known as Scattered Spider,” John Hultquist, Chief Analyst at Google Threat Intelligence Group, told BleepingComputer.

“The actor, which has reportedly targeted retail in the UK following a long hiatus, has a history of focusing their efforts on a single sector at a time, and we anticipate they will continue to target the sector in the near term. US retailers should take note.”

Martin Jartelius, CISO at cybersecurity company Outpost24, commented:

“Well, there is often a geographic element to campaigns, of course, but the difference between cyber and regular crime is that you have billions of neighbors on the internet.

A transition from one primarily English-speaking region to another is less adaption of scripts and makes good sense. Social engineering is related to marketing in that it aims to entice a desired behavior in another individual, which requires both a well-tailored script and an element of culture suited for those you target for it to work out. We see this in smaller fraud as well, where a method is reused, and in those cases scripts, that is ways of working the social engineering, is even sold between criminals.”

Hopefully US retailers are paying attention as UK retailers have been pwned in epic fashion over the last couple of weeks. Which in turn caused some amount of chaos. Thus I would not like to see history repeat itself in the US.

Leave a comment »

England’s NHS demands supplier cyber commitments in open letter

Posted in Commentary with tags on May 15, 2025 by itnerd

The UK’s Department of Health and Social Care and NHS England are calling on all current and prospective NHS suppliers to commit to stronger cybersecurity practices by signing a new voluntary Cyber Security Charter. The move comes amid a sharp increase in ransomware attacks targeting the healthcare supply chain.

Wade Ellery, Field CTO, Radiant Logic had this to say:

“Healthcare is doubly vulnerable because of its deep reliance on legacy identity infrastructure and vendor sprawl and the literal life and death impact of such an attack. Many providers operate with decades-old IAM systems, scattered data sources, and minimal visibility into who has access to what—and why. Identity observability offers a path forward: unifying and monitoring all identity and access data in real time, so threats like ransomware don’t go undetected until it’s too late.”

I’ve been saying for a long time that because health care is low hanging fruit for threat actors, more must be done in that sector to make it less attractive to threat actors. This qualifies as more in my books. And I would love to see this copied elsewhere as this will make a difference.

3 Comments »

Nucor Pwned In Some Sort Of Cyberattack

Posted in Commentary with tags on May 15, 2025 by itnerd

News has surfaced that Nucor, the largest steel manufacturer in the US, shut down production operations after discovering its servers had been penetrated. 

Nucor Corporation (the “Company”) recently identified a cybersecurity incident involving unauthorized third party access to certain information technology systems used by the Company. Upon detecting the incident, the Company began promptly taking steps to contain and respond to the incident, including activating its incident response plan, proactively taking potentially affected systems offline and implementing other containment, remediation, or recovery measures. The Company is actively investigating the incident with the assistance of leading external cybersecurity experts and has notified federal law enforcement authorities.As of the date of this filing and in an abundance of caution, the Company temporarily and proactively halted certain production operations at various locations. However, the Company is currently in the process of restarting the affected operations.

As the investigation of the incident is ongoing, the Company will continue to monitor the timing and materiality of the incident.

Javvad Malik, Lead Security Awareness Advocate at KnowBe4 had this to say: 

“The Nucor situation represents yet another concerning example of critical infrastructure disruption due to a cyber incident. While their response in the SEC filing offers very little by way of details, the incident highlights the persistent vulnerability of manufacturing environments to both nation-state actors and criminal enterprises.”

“The economic impact for such victims is particularly challenging. When production stoppages create immediate financial impact and supply chain disruptions, the pressure to resolve quickly—potentially through ransom payment—becomes intense, as demonstrated by the Colonial Pipeline incident.”

“This case should serve as a reminder that operational technology security requires investment proportional to its critical importance. For manufacturers like Nucor, cybersecurity isn’t restricted to IT but a fundamental business continuity issue.”

Rebecca Moody, Head of Data Research at Comparitech added this: 

“While Nucor hasn’t disclosed the nature of the attack and no gangs have claimed responsibility for the attack as of yet, there’s a high probability that we could be looking at a ransomware attack. So far this year, we’ve seen 19 such attacks on US manufacturers. Not only can these attacks cause widespread disruption, like we’re seeing with Nucor, but the majority of these attacks (18) have also seen data breached. Over 33,000 records are confirmed to have been impacted in these attacks, highlighting the ongoing double-extortion tactics used by ransomware gangs.”

“This is why the manufacturing sector is a key target for ransomware gangs: 1) because it can ill-afford downtime (our recent study found manufacturing companies lose an average $1.9 million per day of downtime after a ransomware attack) and 2) because these companies often have key data that can be exploited, too.”

“If this is indeed a ransomware attack, it’s likely data will have been stolen and, given the company’s size, this breach could be extensive.”

Chris Hauk, Consumer Privacy Champion at Pixel Privacy follows up with this:

“With multiple steel mills, reducing centers, and fabrication plants in the U.S., Nucor is an attractive target for a ransomware attack. A company like Nucor can’t afford extended downtime, so it will likely be willing to pay a ransom to get its systems released by the bad guys. Nucor may also have been targeted due to the ongoing trade war between the U.S. and China. China is not above using hackers to disrupt U.S. industry during such trade wars.”

“While not a direct piece of the U.S. infrastructure, Nucor definitely is a major supplier to companies that make up the infrastructure, also making them an attractive target for the bad actors of the world.”

I would be interested in hearing the details of this attack. Hopefully we get those as given the scant level of information, this attack could be bad, or really bad.

Leave a comment »

SecurityBridge to Showcase AI-Powered CVA and Microsoft Sentinel Integration at SAP Sapphire 2025 

Posted in Commentary with tags on May 15, 2025 by itnerd

 SecurityBridge, the Cybersecurity Command Center for SAP, today announced its participation in SAP Sapphire 2025, taking place May 19–21 at the Orange County Convention Center in Orlando, Florida. SecurityBridge will be exhibiting at booth #414, demonstrating the latest innovations in SAP cybersecurity, including its newly released AI-powered Code Vulnerability Analyzer (CVA) and enhanced integration with Microsoft Sentinel.

SAP Sapphire is SAP’s flagship annual event, bringing together thousands of global business and technology leaders to explore the future of enterprise transformation. SecurityBridge will use the conference to highlight how organizations can enhance SAP security by streamlining code remediation and consolidating threat visibility across the enterprise.

Within its booth, SecurityBridge will showcase the SecurityBridge CVA, which uses artificial intelligence to analyze and explain custom ABAP code, helping developers and security teams understand and fix vulnerabilities more quickly and efficiently. Key capabilities include:

  • Explain ABAP Code – The integrated AI engine breaks down complex code snippets into simple explanations, enabling faster onboarding and debugging.
  • Describe Vulnerabilities – AI-generated risk analysis highlights specific security flaws, their implications, and provides remediation guidance.
  • Critical Asset Identification – The AI solution automatically identifies and prioritizes high-risk ABAP programs and function modules.

SecurityBridge will also present its integration with Microsoft Sentinel, which enables real-time SAP security events to be pushed to Microsoft’s cloud-native SIEM platform. This integration enhances situational awareness for security teams by bringing SAP data into their existing Security Operations Center (SOC) workflows.

Leave a comment »

Earth Ammit Targets Drone Supply Chain Says Trend Micro

Posted in Commentary with tags on May 15, 2025 by itnerd

Trend Micro has identified a Chinese-linked threat actor, Earth Ammit, responsible for multi-wave supply chain attacks on organizations across Taiwan and South Korea between 2023 and 2024. The group executed two major campaigns—Venom and Tidrone—targeting military, industrial, technology, satellite, media, and healthcare sectors.

Andrew Obadiaru, CISO, Cobalt had this to say:

“Long-term supply chain intrusions like this are exactly why security validation needs to extend beyond your own environment. You’re only as secure as the least-tested component in your ecosystem—and in aerospace and defense, that often means legacy systems and smaller vendors without rigorous security programs. Offensive security helps close this gap by identifying the weak links attackers look for first. Whether it’s certificate abuse or persistence techniques buried deep in outdated firmware, you can’t defend what you don’t test. There must be a comprehensive VMP process as a key component in mitigating this risk as well as a recognition that an attack of this nature demonstrates that cybersecurity threats are no longer limited to digital boundaries; they’re embedded in the physical products and systems we rely on. A secure defense infrastructure requires regular pentesting, continuous visibility and proactive threat modeling.”

Supply chain attacks are becoming increasingly pervasive. Just look at this high profile example from earlier this week. Thus organization’s defence strategy has to be based around this new reality.

Leave a comment »

Guest Post – ESET Research uncovers Operation RoundPress: Russia-aligned Sednit targets entities linked to the Ukraine war to steal confidential data

Posted in Commentary with tags on May 15, 2025 by itnerd

ESET researchers have uncovered a Russia-aligned espionage operation, which ESET named RoundPress, targeting webmail servers via XSS vulnerabilities. Behind it is most likely the Russia-aligned Sednit (also known as Fancy Bear or APT28) cyberespionage group, holding the ultimate goal of stealing confidential data from specific email accounts. Most of the targets are related to the current war in Ukraine; they are either Ukrainian governmental entities or defense companies in Bulgaria and Romania. Notably, some of these defense companies are producing Soviet-era weapons to be sent to Ukraine. Other targets include African, EU, and South American governments.

“Last year, we observed different XSS vulnerabilities being used to target additional webmail software: Horde, MDaemon, and Zimbra. Sednit also started to use a more recent vulnerability in Roundcube, CVE-2023-43770. The MDaemon vulnerability — CVE-2024-11182, now patched — was a zero day, most likely discovered by Sednit, while the ones for Horde, Roundcube, and Zimbra were already known and patched,” says ESET researcher Matthieu Faou, who discovered and investigated Operation RoundPress.

Sednit sends these XSS exploits by email; the exploits lead to the execution of malicious JavaScript code in the context of the webmail client web page running in a browser window. Therefore, only data accessible from the target’s account can be read and exfiltrated.

In order for the exploit to work, the target must be convinced to open the email message in the vulnerable webmail portal. This means that the email needs to bypass any spam filtering, and the subject line needs to be convincing enough to entice the target into reading the email message — abusing well-known news media such as Ukrainian news outlet Kyiv Post or Bulgarian news portal News.bg. Among the headlines used as spearphishing were: “SBU arrested a banker who worked for enemy military intelligence in Kharkiv” and “Putin seeks Trump’s acceptance of Russian conditions in bilateral relations”.

The attackers unleash JavaScript payloads SpyPress.HORDE, SpyPress.MDAEMON, SpyPress.ROUNDCUBE, and SpyPress.ZIMBRA upon the targets. Those are capable of credential stealing; exfiltration of the address book, contacts, and log-in history; and exfiltration of email messages. SpyPress.MDAEMON is able to set up a bypass for two-factor authentication protection; it exfiltrates the two-factor authentication secret and creates an app password, which enables the attackers to access the mailbox from a mail application.

“Over the past two years, webmail servers such as Roundcube and Zimbra have been a major target for several espionage groups, including Sednit, GreenCube, and Winter Vivern. Because many organizations don’t keep their webmail servers up to date, and because the vulnerabilities can be triggered remotely by sending an email message, it is very convenient for attackers to target such servers for email theft,” explains Faou.

The Sednit group — also known as APT28, Fancy Bear, Forest Blizzard, or Sofacy — has been operating since at least 2004. The U.S. Department of Justice named the group as one of those responsible for the Democratic National Committee (DNC) hack just before the 2016 U.S. elections and linked the group to the GRU. The group is also presumed to be behind the hacking of global television network TV5Monde, the World Anti-Doping Agency (WADA) email leak, and many other incidents.

For a more detailed analysis and technical breakdown of Sednit’s tools used in Operation RoundPress, check out the latest ESET Research blogpost “Operation RoundPress” on WeLiveSecurity.com. Make sure to follow ESET Research on Twitter (today known as X), BlueSky, and Mastodon for the latest news from ESET Research.

Leave a comment »

« Older Entries
Newer Entries »