Find what you’re looking for
Browse everything
6,868 results in Threat Reports
Critical Gogs Zero-Day Exploited in Ongoing Supply-Chain Attacks
In early 2024, security researchers revealed that attackers had actively exploited a zero-day vulnerability in Gogs, a popular self-hosted Git service, for several months. The flaw, which allowed remote code execution (RCE), bypassed a previously disclosed patch, enabling unauthorized actors to compromise software supply chains by injecting code and potentially exfiltrating sensitive repositories. This sustained exploitation remained undetected until a disclosure by Wiz, highlighting that a patch was still unavailable at the time of reporting, therefore leaving many self-hosted Gogs deployments exposed and at risk. This incident underscores the increasingly sophisticated nature of supply-chain attacks and the challenges organizations face in managing security across open-source dependencies. With the rapid rise in software supply-chain exploits targeting CI/CD platforms, organizations are under mounting pressure to adopt stringent internal controls and layered defenses.
2025 Surge in Supply Chain Attacks Hits GitHub Actions: What Every DevSecOps Leader Must Know
In 2025, a surge in supply chain attacks targeted GitHub Actions, leveraging insecure workflows and misconfigured secrets to inject malicious code into the software development pipeline. Attackers exploited open source dependencies and automation gaps, enabling lateral movement and data theft across multiple organizations using compromised CI/CD environments. The incident, revealed through coordinated research at Black Hat Europe, highlighted how adversaries can escalate privileges and bypass traditional defenses by targeting both public and private repositories, resulting in widespread risk for organizations with weak DevSecOps controls. This incident underscores a pronounced trend: attackers are increasingly focusing on automated development environments and supply chains, not just production workloads. With more organizations adopting GitHub Actions and similar platforms, visibility, zero trust segmentation, and secure automation practices are now critical to thwart sophisticated threat actors targeting the software supply chain.
CISA Flags Exploited Vulnerability in Sierra Wireless AirLink ALEOS (CVE-2018-4063)
On December 12, 2025, CISA added CVE-2018-4063, a vulnerability impacting Sierra Wireless AirLink ALEOS, to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. This vulnerability allows unrestricted upload of potentially malicious files, granting attackers the ability to gain remote control over affected network devices. Such vulnerabilities in network infrastructure expose organizations—including federal agencies—to heightened risks of unauthorized access, lateral movement, and disruption of operations. Federal Civilian Executive Branch agencies are mandated to remediate this issue promptly under Binding Operational Directive 22-01, and CISA encourages all enterprises to act urgently in their own environments. This incident highlights the persistent targeting of edge network infrastructure by threat actors, a trend accelerated by increased reliance on remote and distributed operations. The rapid inclusion of this vulnerability in CISA’s KEV Catalog underscores the growing regulatory and operational pressure on organizations to adopt proactive vulnerability and network segmentation controls.
Hamas Espionage Malware Hits Middle East Diplomats: 2024 Breach Analysis
In early 2024, state-sponsored threat actors linked to Hamas intensified cyber-espionage campaigns targeting Middle Eastern diplomatic entities. Attackers leveraged tailored malware and advanced phishing schemes to infiltrate networks, harvest intelligence, and gain persistent access to government communications. The campaign utilized unpatched vulnerabilities, abused encrypted and lateral east-west traffic, and bypassed conventional perimeter defenses. These intrusions aimed to gather political intelligence and undermine regional security, impacting the operational confidentiality of affected governments and creating heightened diplomatic tensions. This incident reflects a broader escalation in politically motivated cyber-espionage across the region, as Hamas and allied groups continue to innovate with more sophisticated tooling and tactics. The evolving threat landscape underscores the urgency for robust east-west segmentation, encrypted traffic controls, and real-time threat detection among critical infrastructure and state agencies.
How Salt Typhoon Infiltrated US Telecoms: Lessons from the 2024 Nation-State Attack
In early 2024, multiple major US telecommunications providers were targeted in a sophisticated nation-state attack attributed to Salt Typhoon, a Chinese-affiliated APT group. The attackers exploited unencrypted and east-west traffic flows within provider networks, bypassing conventional perimeter defenses to gain persistent access to sensitive infrastructure and intercept data in transit. Salt Typhoon leveraged advanced lateral movement and covert exfiltration techniques, enabling them to collect confidential communications and network architecture details. The incident led to significant operational risks, regulatory scrutiny, and concern within the telecom and national security sectors. This breach highlights a surge in highly targeted attacks on critical infrastructure, as nation-state actors exploit unencrypted traffic and insufficient internal segmentation. Current attacks reflect a broader strategic trend, with organizations facing pressure to modernize controls to address evolving threat vectors and international cyber-risk dynamics.
Malware’s New Trick: Abusing the DLL EntryPoint in Windows (2024)
In December 2024, security researchers identified a Windows malware technique that leverages the DLL entry point (DllMain) to execute malicious code automatically upon DLL loading, even if no exported function is invoked. By embedding harmful operations—such as launching other processes—directly within DllMain, threat actors can evade typical detection methods that focus primarily on analyzing exported functions. This technique often harnesses trusted Windows utilities, like rundll32.exe or regsvr32.exe, as the initial execution vectors, making attacks stealthy and difficult to detect. The result is an elevated risk for lateral movement within environments and increased potential for undetected code execution. This method highlights a broader trend in which attackers abuse overlooked aspects of Windows internals to persist and evade controls. As adversaries continue to evolve, the need for better anomaly detection, code inspection, and zero trust segmentation becomes ever more critical for organizations defending against sophisticated malware delivery approaches.
LockBit Ransomware: Why Reputation Now Drives RaaS Attacks and Ransom Payments (2025 Analysis)
In early 2025, research into the LockBit ransomware-as-a-service (RaaS) gang revealed the pivotal role of reputation in both attacker and victim circles. At its peak, LockBit utilized a vast network of nearly 200 affiliates to gain initial access, exfiltrate sensitive data, and negotiate ransoms, with over half achieving payout settlements after system encryption and data theft. The incident highlights the attackers’ emphasis on trust during ransom negotiations and the widespread operational and financial disruptions suffered by targeted organizations, including critical recovery costs, business downtime, and severe reputational impact stemming from media coverage. The increasing maturity and professionalization of RaaS operations, typified by LockBit, have made sophisticated extortion tactics more common. As law enforcement and insurers adapt, companies face heightened risk not just from technical compromise, but from strategic reconnaissance that monetizes cyber insurance intelligence, further escalating the urgency for advanced protection and segmentation of sensitive data.
AI-Powered Attacks Break Smart Contracts: A 2025 Blockchain Breach Analysis
In late 2025, advanced AI models including Anthropic's Claude Opus 4.5, Claude Sonnet 4.5, and OpenAI's GPT-5 autonomously exploited vulnerabilities across a new smart contract benchmark (SCONE-bench) comprising 405 blockchain contracts. These AIs collectively discovered and weaponized vulnerabilities leading to $4.6 million in simulated or actual economic loss, proving AI-driven cyber capabilities have reached critical new thresholds. Further, simulations against nearly 2,850 newly deployed smart contracts with no previously known vulnerabilities resulted in successful zero-day discoveries and profitable exploits, despite only modest operational costs for the threat actors. This fundamentally changed the risk calculus for decentralized finance and blockchain-based businesses. These findings underscore a turning point, where the integration of conversational and agentic AI with offensive security tools directly translates to scalable, profitable cyberattacks. The incident highlights an urgent risk landscape: AI-driven exploitation is no longer theoretical, driving increased pressure for automated AI defensive strategies and regulatory focus in sectors reliant on smart contracts.
Eighth Chrome Zero-Day of 2025: Google Issues Emergency Patch Amid Active Exploitation
In early 2025, Google addressed its eighth actively exploited zero-day vulnerability in Chrome within the year, releasing an emergency update after threat actors leveraged the flaw to bypass browser security and execute malicious code. Attackers exploited a use-after-free bug to achieve remote code execution, targeting Chrome users worldwide. Quick detection and response by Google limited the potential damage, but the repeated appearance of critical zero-days raised new concerns among IT teams and users regarding browser safety and patch timeliness. The frequency and sophistication of recent browser-based zero-days reflect an upward trend in targeted attacks against mainstream software. As Chrome remains the dominant browser for consumers and enterprises alike, effective patch management and browser security have become business-critical to defend against rapid exploit deployment and reduce organizational risk.
Google Ads Push MacOS AMOS Infostealer via ChatGPT & Grok AI Guides in 2024
In early June 2024, a threat campaign leveraged Google search advertisements to promote fraudulent ChatGPT and Grok chatbot guides targeting macOS users. Victims who clicked on these ads were redirected to malicious sites and deceived into downloading the AMOS (Atomic) infostealer malware, which harvested sensitive credentials, cryptocurrency wallets, and other private data. The campaign exemplifies the use of topical lures—capitalizing on the mainstream popularity of AI chat platforms—to facilitate widespread malware distribution, bypassing native macOS security. Attackers used SEO poisoning and social engineering tactics, making detection and attribution challenging, while infostealer payloads exfiltrated key business and personal data. This incident underscores a rising trend: infostealer campaigns exploiting interest in emerging AI technologies, with search engine ads and convincing guides serving as the primary attack vector. As macOS adoption grows in enterprises and AI tools become mainstream, businesses face escalating risks from social engineering, supply chain misuse, and evolving malware techniques exploiting trusted sites and brand searches.
Gogs Zero-Day RCE Exploited: Hundreds of Git Servers Breached in 2024
In early June 2024, a critical and unpatched zero-day vulnerability in Gogs—an open-source, self-hosted Git service—was exploited by unnamed threat actors to achieve remote code execution on over 700 publicly accessible servers. Attackers leveraged a flaw in Gogs' authentication mechanism to gain administrative access, subsequently deploying malicious payloads and establishing persistent control over compromised systems. The campaign, detected by threat intelligence researchers, resulted in unauthorized access to sensitive development infrastructure, disruption of software delivery pipelines, and potential exposure of intellectual property and credentials. This incident underscores the escalating pace at which threat actors exploit zero-day vulnerabilities, particularly in widely adopted developer tools. The wave of attacks against Gogs highlights the urgent need for organizations to maintain up-to-date security controls and implement zero trust segmentation to limit lateral movement in cloud-native environments.
ConsentFix: How a Clever OAuth Attack Took Over Microsoft Accounts via Azure CLI in 2024
In June 2024, a new variation of the previously-identified ClickFix attack emerged—dubbed 'ConsentFix'—targeting organizations using Microsoft Azure. Threat actors leveraged social engineering to manipulate users into granting malicious OAuth permissions via the Azure CLI tool, resulting in full account compromise without requiring user passwords or bypassing multi-factor authentication (MFA). By tricking victims into executing crafted Azure CLI commands, attackers could hijack Microsoft accounts, potentially leading to widespread access to sensitive data, misconfiguration, or further lateral movement within affected cloud environments. This attack highlights the growing sophistication of consent phishing and the increased abuse of cloud automation tools, stressing the urgent need for organizations to review OAuth permission flows and harden identity-driven security controls. Rapid evolution in attacker tactics underscores critical risks within cloud access management and the threat landscape.