Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Malicious Chrome Extension Diverts Solana in Raydium Swaps: Supply Chain Breach 2024
In May 2024, researchers identified a malicious Chrome extension named 'Crypto Copilot' that was surreptitiously injecting unauthorized Solana (SOL) transfer instructions during Raydium swap transactions, redirecting user assets to an attacker-controlled wallet. Initially published on the Chrome Web Store by a developer under the alias 'sjclark76,' the extension posed as a crypto utility tool but covertly modified transaction data to exfiltrate funds without user knowledge. The breach highlighted the growing risk of supply-chain malware within browser ecosystems and exposed users to direct financial theft via manipulated decentralized finance (DeFi) operations. This incident exemplifies a broader trend of attackers leveraging browser extensions to exploit DeFi and cryptocurrency users at scale. With the proliferation of novel supply-chain vectors and the rise of open-source and web-based crypto tools, organizations and individuals must exercise heightened due diligence and implement robust extension vetting and monitoring practices.
Shai-Hulud v2 Strikes: Massive npm and Maven Supply Chain Breach Exposes Secrets
In November 2025, a major multi-ecosystem software supply chain attack was uncovered when the Shai-Hulud v2 campaign spread beyond the npm registry into Maven Central. Threat actors compromised over 830 npm packages and at least one Maven package (org.mvnpm:posthog-node:4.18.1), embedding malicious loaders and payloads that silently exfiltrated thousands of developer and organizational secrets. This attack leveraged highly automated techniques to inject stealthy code across registries, making mitigation and detection notably difficult. The campaign’s broad reach threatened applications, organizational infrastructure, and customers reliant on compromised components. This incident highlights a rising trend where sophisticated threat actors exploit trusted open-source software ecosystems, dramatically increasing supply chain risk. Recent surges in attacks targeting developer supply chains have prompted urgent calls for enhanced controls, continuous monitoring, stronger segmentation, and stricter compliance with software integrity standards.
Qilin Ransomware Orchestrates Major Supply Chain Attack on South Korean MSPs in 2025
In October 2025, a sophisticated supply chain attack targeted multiple South Korean financial sector organizations via a compromised Managed Service Provider (MSP). The threat was executed by the Qilin Ransomware-as-a-Service (RaaS) group, with indications of potential collaboration from North Korea-affiliated Moonstone Sleet actors. Attackers infiltrated the MSP’s infrastructure, leveraged lateral movement to access at least 28 client environments, and deployed the Qilin ransomware payload, resulting in mass data exfiltration and operational disruption. The group publicized stolen information on their so-called 'Korean Leaks' site to pressure victims for ransom, significantly impacting banking, insurance, and fintech operations region-wide. This attack underscores the growing risk of supply chain compromise, particularly where highly interconnected MSP platforms are leveraged to target multiple downstream entities simultaneously. The tactic reflects emerging ransomware trends seen globally, where threat actors exploit trusted service providers to maximize victim impact and amplify regulatory, reputational, and economic damage.
Malware Authors Leverage LLMs: 2024's Unprecedented Evasion Tactics
In early 2024, cybersecurity researchers identified a new campaign where advanced persistent threat (APT) groups incorporated large language models (LLMs) into malware strains to dynamically evade traditional security controls. Attackers leveraged generative AI prompts at runtime to modify payloads, change behavior signatures, and bypass both heuristic and signature-based detection solutions. This innovation enabled lateral movement within compromised environments, facilitated egress of sensitive data, and complicated incident response due to the malware's adaptive techniques. Several enterprise and public sector networks were affected, leading to significant operational disruptions and raising concerns about advanced AI-powered threats. The incident underscores a rapidly escalating trend: cybercriminals are weaponizing AI and LLMs to outpace enterprise defenses, blending evasion, lateral movement, and multi-cloud attack vectors. The urgency is heightened as regulatory frameworks evolve and organizations race to adopt zero trust, segmentation, and advanced anomaly detection to keep pace.
Inside the 2025 Digital Fraud Surge: How AI Supercharged Cybercrime
In early 2025, a wave of advanced persistent fraud targeted multiple global organizations as cybercriminals leveraged generative AI and automated bots to launch large-scale digital fraud schemes. Attackers used sophisticated deepfake technology and high-quality counterfeit IDs to penetrate identity verification systems, bypass account controls, and hijack customer accounts across banking, healthcare, and e-commerce sectors. The attacks exploited gaps in east-west traffic security and leveraged encrypted channels to evade detection for months. Businesses suffered significant financial losses, reputational damage, and were forced to bolster their compliance efforts in the wake of the breach. This incident marked a turning point in the evolution of digital fraud, as attackers embraced highly scalable automation and AI for identity-driven campaigns. The surge in industrial-scale fraud highlighted gaps in visibility, zero-trust segmentation, and anomaly detection while placing new urgency on regulatory compliance and modern defense architectures.
Executive Breach Brief: Scattered LAPSUS$ Hunters’ 2025 Salesforce Ransomware Campaign
In May 2025, the Scattered LAPSUS$ Hunters (SLSH) cybercriminal group orchestrated a wide-scale ransomware and data extortion campaign targeting the Salesforce environments of over thirty major corporations, including brands like Toyota, FedEx, Disney/Hulu, and UPS. Leveraging sophisticated voice phishing for initial access, SLSH tricked employees into connecting malicious apps to internal Salesforce portals, facilitating rapid exfiltration of sensitive corporate data. Public threats of mass data leaks via their extortion site, insider recruitment, and the deployment of the new ShinySp1d3r ransomware further amplified organizational and reputational risk, prompting companies and regulators to respond swiftly. This incident exemplifies the convergence of advanced social engineering and ransomware-as-a-service models, alongside a growing ecosystem of cybercrime collaboration. Attackers’ use of collaboration platforms, custom malware, and drive to monetize breaches through both data theft and extortion spotlights the need for zero trust and enhanced compliance controls in identity, SaaS, and egress security.
Inexpensive Hardware Bypass Exposes Flaws in AMD & Intel Memory Encryption (2024)
In early 2024, security researchers unveiled a significant vulnerability impacting AMD and Intel CPUs implementing memory encryption for confidential computing. By constructing an inexpensive hardware module, the team demonstrated how attackers could physically intercept and decrypt protected memory traffic between the main processor and RAM, effectively bypassing hardware-implemented encryption intended to secure sensitive workloads. This attack, which operates independently of software measures, exposes plaintext data and private keys, revealing a critical flaw in the foundation of memory encryption technologies relied upon for cloud, data center, and edge security. As a result, organizations using these processors for confidential computing may be at risk until hardware changes are introduced. This research underscores increasing scrutiny of hardware-level threats as confidential computing gains adoption. With the emergence of accessible hardware-based attacks, enterprises and regulators face renewed urgency to evaluate physical and low-level protections beyond traditional network and endpoint security controls.
DPRK’s FlexibleFerret Infiltrates macOS: Credential Theft at Scale
In early 2024, North Korea-linked threat group tracked as FlexibleFerret intensified targeted credential-theft campaigns focusing on macOS users, evolving their "Contagious Interview" social engineering lures. By masquerading as recruiters and leveraging tailored malware, the group tricked victims into opening malicious attachments, deploying a specialized macOS information stealer. The attackers' refinements enabled broader credential compromise, facilitating unauthorized access to sensitive accounts across professional and personal domains. This incident underscores a growing operational sophistication in DPRK-attributed campaigns and heightened risk to macOS environments previously perceived as less targeted. This case highlights a surge in credential-theft, social engineering, and platform-diverse malware, especially against enterprise macOS users. Security teams must adapt defenses to evolving threat actor tactics and close compliance and detection gaps regarding endpoint security and user education.
How Iran Blended Cyber and Kinetic Strikes: The 2024 Critical Infrastructure Attack
In early 2024, Iranian state-sponsored threat actors coordinated sophisticated cyber-attacks in parallel with kinetic strikes targeting maritime and land-based assets in the Middle East. Leveraging advanced reconnaissance and lateral movement within targeted networks, attackers exploited encrypted and unencrypted traffic flows to identify critical systems and facilitate precision missile and drone attacks. These operations, often timed to coincide with physical assaults, compromised internal infrastructure, leading to service disruption, operational delays, and data exfiltration impacting both regional governments and commercial enterprises. This incident highlights a rapidly evolving threat landscape where nation-state adversaries integrate cyber intrusions with physical warfare. The tactical use of data from east-west traffic, paired with real-time targeting for kinetic operations, signals the urgent need for organizations to elevate network segmentation, encryption standards, and visibility to meet new regulatory and threat actor challenges.
ShinySP1D3R Ransomware Hits Hybrid Clouds During Holiday 2024
In December 2024, organizations worldwide were targeted by the ransomware group known as ShinySP1D3R, identified as an offshoot of the Scattered LAPSUS$ Hunters collective. Attackers exploited vulnerabilities in unencrypted east-west and egress traffic to gain network access, rapidly deploying ransomware across hybrid cloud environments during the busy holiday season. The incident resulted in substantial service outages, data encryption, and led to operational delays for affected enterprises, reinforcing the dangers of sophisticated lateral movement paired with insufficient segmentation controls. This incident highlights a rising trend of threat actors striking during holidays when staffing is limited and detection/response windows are higher. The campaign’s use of advanced TTPs—such as distributed command and control and abuse of hybrid connectivity—emphasizes why zero trust architectures and continuous threat monitoring are now business-critical.
Malicious Underground AI Models Like WormGPT 4 Are Supercharging Cybercrime in 2024
In early 2024, cybersecurity researchers uncovered an expanding underground marketplace for custom large language models (LLMs) such as WormGPT 4 and KawaiiGPT, designed to facilitate cybercrime. These jailbroken and open-source models, advertised and sold across dark web forums, lower the technical barrier for attackers by offering tools to scan for vulnerabilities, automate malware development, and accelerate tasks like phishing and lateral movement. Their accessibility—with minimal setup time, user-friendly interfaces, and affordable pricing—has enabled a broader range of cybercriminals to automate sophisticated attacks previously requiring advanced skills. The emergence of malicious LLMs highlights a growing trend where generative AI is weaponized in cybercrime. Unlike earlier incidents, these tools are now commercialized and widely supported, signaling a shift from simple model jailbreaking to specialized AI-enabled attack platforms. This evolution increases the urgency for organizations to strengthen AI risk management, augment detection strategies, and adapt compliance controls to address the new threat landscape.
What the Gainsight–Salesforce Supply Chain Attack Teaches Us About SaaS Security in 2024
In late October 2024, Gainsight, a customer management SaaS provider, was implicated in a supply chain attack that impacted Salesforce environments. Attackers exploited the Gainsight connected app to obtain and abuse OAuth tokens, enabling unauthorized access to several Salesforce customer instances and raising concerns about lateral movement to other connected third-party applications. While initial reports from Salesforce identified compromised tokens and only a handful of affected customers, subsequent intelligence indicated the potential exposure of over 200 Salesforce instances. Mandiant and Salesforce collaborated to investigate the extent and mechanics of the attack, tracing earliest malicious activity to October 23, 2024. Despite ongoing forensics, Gainsight maintains that the breach impact was limited in scope, and no evidence has surfaced indicating a vulnerability within Salesforce’s platform itself. This incident reflects the growing trend of SaaS supply chain attacks that exploit authentication and integration mechanisms to reach downstream enterprise environments. The blend of fragmented disclosure, coordinated incident response, and rising third-party risks demonstrates the urgent need for improved visibility, segmented access, and standardized controls within interconnected SaaS ecosystems.