Hello and welcome to the Tuesday, June 9th, 2006 edition of the SANS Internet Storm Center's Stormcast.

My name is Johannes Ulrich, recorded a day from Jacksonville, Florida.

And this episode is brought you by the Sands.edu undergraduate certificate program in cyber security fundamentals.

Well, for a couple weeks now, I keep saying that you should assume compromise when it comes to your supply chain.

The latest example here is the compromise of several Azure-related Microsoft GitHub repositories.

I don't know what you want to call this particular warm.

It's well the same kind of over again after, of course, some of the Chateauulu warms and

such were made public.

We've seen many, many variants spring up.

Step security has a good write-up on what they're calling Myasma Warm,

and that's the one that hit these Microsoft repositories.

It hit a total of 72 repositories.

But remember, they're not just stealing credentials.

They're also then actively attempting to spread into anybody using code from these affected repositories.

Now, Microsoft acted quite quickly here and disabled the repositories.

They didn't really even know why they disabled it, so there was a lot of confusion among developers

who depended on some of the

GitHub actions here, which actually was part of the problems. And as a result, their CI-CD pipelines

failed. Good thing if your CI-CD pipeline fails in this case, because that means, well, you

were not infected by this particular worm. So, yeah, don't complain too much

about Microsoft. It was the right quick response in order to prevent further harm from being done.

Of course, they probably should have done a little bit more ahead of time with hardened configurations and the like,

...