FlagThis - #supplychainsecurity

A malicious Python package named 'discordpydebug' has been discovered on the Python Package Index (PyPI) repository, posing a significant threat to Discord developers. The package, disguised as a simple utility for debugging Discord bots, actually contains a remote access trojan (RAT). This RAT allows attackers to execute commands and exfiltrate data from infected systems via a covert command-and-control (C2) channel. The 'discordpydebug' package was uploaded on March 21, 2022, and has since been downloaded over 11,000 times, putting numerous developer systems at risk.

The 'discordpydebug' package targets developers who build or maintain Discord bots. The attackers took advantage of the fact that PyPI doesn't enforce strict security audits, misleading developers with a legitimate-sounding name and copying code from popular projects to appear trustworthy. The package establishes communication with an attacker-controlled server at "backstabprotection.jamesx123.repl[.]co", and includes features to read and write arbitrary files based on commands received from the server, along with the ability to run shell commands.

The simplicity of the RAT is what makes it effective. The package avoids inbound connections, instead opting for outbound HTTP polling to bypass firewalls and security monitoring tools, especially in less controlled development environments. This discovery highlights the increasing danger of software supply chain attacks and the importance of vigilance when installing packages from open-source repositories. The Socket Research Team urges developers to be cautious and scrutinize any third-party tools or code snippets shared within the Discord developer community.


References :

• socket.dev: Malicious PyPI Package Targets Discord Developers with Remote Access Trojan
• The Hacker News: Researchers Uncover Malware in Fake Discord PyPI Package Downloaded 11,500+ Times
• www.scworld.com: RAT-laced PyPI package sets sights on Discord developers
• thecyberexpress.com: Article highlighting the malicious discord developer package and its purpose

Classification:

• HashTags: #PyPIMalware #SupplyChainSecurity #RemoteAccessTrojan
• Company: PyPI
• Target: Discord Developers
• Product: PyPI
• Feature: Malicious Package
• Malware: discordpydebug
• Type: Malware
• Severity: Major

Hertz Corporation has announced a data breach affecting customers of its Hertz, Thrifty, and Dollar car rental brands. The breach stems from the exploitation of Cleo zero-day vulnerabilities in late 2024. Customer data, including personal information and driver's licenses, was stolen. The company confirmed the breach on February 10, 2025, stating that an unauthorized third party acquired Hertz data by exploiting vulnerabilities within Cleo's platform in October and December 2024.

The stolen data varies depending on the region, but generally includes customer names, dates of birth, contact information, driver's licenses, payment card information, and workers' compensation claims. In some instances, Social Security numbers and other government-issued identification numbers were also compromised. Notices about the breach have been posted on Hertz websites for customers in Australia, Canada, the European Union, New Zealand, the United Kingdom, and several U.S. states, including California, Maine, and Texas. Hertz has disclosed that at least 3,400 customers in Maine and some 96,665 customers in Texas were affected.

The company attributed the breach to vulnerabilities in Cleo's software, which was targeted by the Clop ransomware gang in 2024. This breach highlights the significant cybersecurity risks associated with third-party vendors and the potential for mass data theft. It is another example of the widespread consequences that can occur from zero-day exploits in widely used enterprise file transfer products. Those affected have been advised to take precautions to protect their personal and financial information.


References :

• securityaffairs.com: Hertz disclosed a data breach following 2024 Cleo zero-day attack
• techcrunch.com: Hertz says customers’ personal data and driver’s licenses stolen in data breach
• The DefendOps Diaries: Hertz Data Breach: Lessons in Cybersecurity and Vendor Management
• www.bleepingcomputer.com: Hertz confirms customer info, drivers' licenses stolen in data breach
• Zack Whittaker: New by me: Car rental giant Hertz has confirmed a data breach affecting customers' personal information, driver's licenses, and payment card data. Customers worldwide are being notified.
• techcrunch.com: Hertz says customers' personal data and driver's licenses stolen in data breach
• BleepingComputer: Car rental giant Hertz Corporation warns it suffered a data breach after customer data for its Hertz, Thrifty, and Dollar brands was stolen in the Cleo zero-day data theft attacks.
• www.itpro.com: Cleo attack victim list grows as Hertz confirms customer data stolen – and security experts say it won't be the last
• Malwarebytes: Hertz data breach caused by CL0P ransomware attack on vendor Cleo
• PCMag UK security: Hackers Stole Credit Card, Driver's License Info in Hertz Data Breach
• Zack Whittaker: Hertz won't say how many are affected by its breach, but continues to notify U.S. states, giving a little indication of the numbers. Per its filing in Texas today, Hertz said 96,665 Texas residents are affected. Plus 3,400 people in Maine and that's already 100,000+ people in two states alone.
• www.cybersecuritydive.com: Hertz says personal data breached in connection with Cleo file-transfer flaws
• ComputerWeekly.com: Hertz warns UK customers of Cleo-linked data breach
• The Register - Security: Where it Hertz: Customer data driven off in Cleo attacks
• cyberinsider.com: Hertz Confirms Data Breach Following Clop Ransomware Leaks
• cyberinsider.com: Analysis of how the Clop ransomware group exploited zero-day vulnerabilities to compromise Hertz's systems
• Help Net Security: Car rental company Hertz suffers a data breach from exploitation of vulnerabilities in third-party software.
• hackread.com: Hertz Confirms Data Breach After Hackers Stole Customer PII

Classification:

• HashTags: #DataBreach #Hertz #CleoSoftware
• Company: Hertz
• Target: Hertz Customers
• Product: Customer Data
• Feature: Customer Data
• Malware: Cleo zero-day exploit
• Type: DataBreach
• Severity: Major