[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fo2NkdwPhyGP5ulRS7uZTFmCp5z4zSDm2V8QjYyiuJ5M":3},{"article":4,"iocs":52,"watch_terms":56,"solutions":57,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":34},"cd22a458-b790-405c-b047-063c47454af2","NCSC – CERT-SE veckobrev v.46","ncsc-cert-se-veckobrev-v-46-8d4dec","I veckan deltog John Billow, chef för Nationellt cybersäkerhetscenter (NCSC), på en pressträff om cybersäkerhet tillsammans med minister för civilt försvar Carl-Oskar Bohlin, med anledning av den senaste tidens cyberangrepp.","The NCSC-CERT-SE weekly brief from Sweden highlights recent cyberattacks, including extensive disruptions to Microsoft services affecting users in 74 countries. It also details intrusions at furniture company Kinnarps, a data breach at Maersk involving the WhiteArmor ransomware, and exposed booking data from IT provider Amadeus impacting airlines like SAS. Additionally, Sega reported a breach at a third-party vendor exposing customer email addresses, and a threat actor exploited compromised IAM credentials to access multiple customer AWS environments via the Qubole data platform.","Swedish cybersecurity agencies issue weekly brief highlighting recent cyberattacks and phishing campaigns.","https:\u002F\u002Fwww.cert.se\u002F2026\u002F11\u002Fncsc-cert-se-veckobrev-v46.html",null,"2026-11-13T10:00:00+00:00","2026-11-13T11:00:20.607942+00:00",7,[17,20,22,24,26,28],{"name":18,"type":19},"Microsoft","vendor",{"name":21,"type":19},"Maersk",{"name":23,"type":19},"Amadeus",{"name":25,"type":19},"SAS",{"name":27,"type":19},"Finnair",{"name":29,"type":19},"Norwegian","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":30,"icon":12,"name":32,"slug":33},"Threat Intelligence","threat-intelligence",[35,40,45,50],{"category":36},{"id":37,"icon":12,"name":38,"slug":39},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":41},{"id":42,"icon":12,"name":43,"slug":44},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":46},{"id":47,"icon":12,"name":48,"slug":49},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":51},{"id":30,"icon":12,"name":32,"slug":33},[53],{"type":49,"value":54,"context":55},"WhiteArmor","Ransomware actor claimed responsibility for Maersk breach.",[18,21,23],{"controls":58,"vendors":143},[59,88,114],{"slug":60,"name":61,"problem":62,"products":63},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":89,"name":90,"problem":91,"products":92},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[93,98,106],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":94,"product_name":95,"url":96,"description":97},"incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","mandiant-incident-response","Mandiant Incident Response","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fconsulting\u002Fmandiant-incident-response-services","Incident response services from Mandiant, available on retainer.",{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",{"slug":115,"name":116,"problem":117,"products":118},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[119,127,135],{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"securityscorecard","SecurityScorecard","\u002Fvendor-logos\u002Fsecurityscorecard.png","security-ratings","SecurityScorecard Ratings","https:\u002F\u002Fsecurityscorecard.com\u002Fsolutions\u002Fuse-cases\u002Fsecurity-ratings\u002F","Outside-in security ratings and monitoring of suppliers.",[144],{"slug":145,"name":18,"logo_path":146,"roles":147},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":159},"compromised-iam-credentials-and-third-party-vendor-breaches-expose-customer-data-across-multiple-org","Compromised IAM Credentials and Third-Party Vendor Breaches Expose Customer Data Across Multiple Organizations","This weekly brief illustrates how a single weak link in the supply chain — whether a third-party vendor like Sega's unnamed partner, the Amadeus IT provider, or the Qubole data platform — can cascade into widespread customer data exposure. In the AWS case, a threat actor exploited compromised IAM credentials to pivot laterally across multiple customer environments, demonstrating how poor credential hygiene in a shared platform magnifies blast radius. Organizations are often unaware of the security posture of their technology partners until a breach occurs. This matters because customer trust, regulatory obligations, and operational continuity all depend on the security controls of vendors that organizations may have little direct visibility into.",[154,155,156,157,158],"NIS2 Article 21(2)(d)","NIS2 Article 21(2)(i)","NIST SP 800-53 AC-6: Least Privilege","CIS Control 6: Access Control Management","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships",{"NIS2 Article 21(2)(d)":160,"NIS2 Article 21(2)(i)":161,"NIST SP 800-53 AC-6: Least Privilege":162,"CIS Control 6: Access Control Management":163,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":164},"This incident directly involves security failures in supply chain relationships — third-party vendors (Amadeus, Qubole, Sega's partner) were the entry points for breaches affecting the primary organizations.","The AWS compromise via Qubole stemmed from compromised IAM credentials, which falls squarely under the access control and asset management obligations this point requires.","If IAM roles granted to Qubole had been scoped to minimum necessary permissions, the attacker's ability to access multiple customer AWS environments would have been significantly limited.","This control requires managing credentials and access rights for all users and service accounts, which would have prevented the reuse of compromised IAM credentials across customer environments.","This control requires organizations to define and implement processes to manage information security risks associated with suppliers, which would have surfaced the security weaknesses at Amadeus, Qubole, and Sega's vendor."]