Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Dartmouth College Data Breach: Clop Ransomware Targets Oracle EBS in 2024 Attack
In March 2024, Dartmouth College confirmed a data breach after the Clop ransomware gang published confidential information allegedly exfiltrated from the institution's Oracle E-Business Suite servers. The attackers exploited a zero-day vulnerability (associated with the MOVEit Transfer incidents) and infiltrated the college’s systems, ultimately stealing sensitive data, including personal and financial records of students, faculty, and staff. Dartmouth detected suspicious activity following Clop’s dark web disclosures, began forensics, and reported the incident to regulatory agencies. Disruptions to business operations and heightened security controls followed, with legal notifications sent to affected parties. The Dartmouth breach highlights the persistent targeting of higher education by ransomware groups exploiting supply chain and enterprise software vulnerabilities. With ransomware attacks involving exfiltration and public data leaks surging in 2024, institutions face mounting regulatory pressure and reputational risks, underscoring the urgent need for robust segmentation, encrypted traffic controls, and real-time threat detection.
FBI Alert: $262M Stolen in 2024 Account Takeover Fraud by Bank Impersonators
In early 2024, the FBI reported a dramatic surge in account takeover (ATO) fraud targeting U.S. banking customers through sophisticated social engineering. Cybercriminals, primarily via phone and digital messages, impersonated legitimate bank support teams to exploit unsuspecting individuals. Attackers tricked victims into revealing credentials and one-time passcodes, enabling unauthorized access to bank accounts. Since January, over $262 million has been stolen in these highly coordinated campaigns, impacting both major financial institutions and their customers, with funds rapidly funneled out—often through cryptocurrency exchanges or money-mule accounts. This incident highlights an escalating trend of identity-driven attacks leveraging increasingly convincing social engineering tactics. As financial fraud rises sharply, financial institutions face mounting regulatory pressures to improve anomaly detection and secure authentication, while consumers must remain vigilant against evolving ATO schemes.
Banks and Governments Exposed: Code Beautifiers Leak Credentials in 2024
In early 2024, researchers discovered that thousands of sensitive credentials, API keys, and authentication tokens belonging to global banks, government agencies, and technology companies were inadvertently exposed through public submissions to online code formatting tools such as JSONFormatter and CodeBeautify. These web-based beautifier platforms, commonly used by developers to format or debug code, were found to be storing users’ uploads—including confidential configuration files—in publicly accessible repositories without adequate warning or access control. As a result, threat actors could easily discover and exploit these exposed secrets to compromise critical infrastructure or initiate supply chain attacks. This incident underscores the ongoing risks of third-party tool usage in secure development lifecycles. With data exposures driven by everyday tooling, organizations face mounting regulatory and operational scrutiny to audit developer practices, harden supply chain security, and implement broader controls for inadvertent credential leakage.
How the OnSolve CodeRED Cyberattack Disrupted America’s Emergency Alert Infrastructure
In June 2024, Crisis24 confirmed that its OnSolve CodeRED platform—used by state and local governments, police, and firefighting agencies—suffered a cyberattack disrupting emergency notification systems nationwide. Attackers gained unauthorized access to critical infrastructure, resulting in outages that hindered the timely dissemination of emergency alerts and public safety updates. While the investigation is ongoing, the breach demonstrates significant operational risks associated with service provider platforms in the public safety sector, impacting communities’ emergency preparedness and response effectiveness. This incident underscores growing threats targeting third-party vendors in critical sectors, where cyberattacks exploit platform dependencies to cause widespread and immediate disruption. With increasing regulatory scrutiny and a surge in ransomware and extortion campaigns against essential services, organizations must reassess supply chain, segmentation, and incident response controls to maintain operational and compliance resilience.
CISA Uncovers 2025 Spyware Assaults on Signal and WhatsApp Users
In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert regarding active espionage campaigns exploiting commercial spyware and remote access trojans (RATs) to compromise high-value users on secure messaging apps including Signal and WhatsApp. Attackers utilized sophisticated social engineering techniques—such as phishing and malicious links—to covertly deliver malware, enabling unauthorized access to users' encrypted chats, sensitive attachments, and even device controls. The victims ranged from executives and journalists to government officials, highlighting the background emergence of advanced social engineering paired with novel spyware kit deployment. The incident triggered heightened scrutiny of both messaging app security and endpoint defense controls. This event is emblematic of a growing surge in targeted surveillance operations against individuals using encrypted communication platforms. It raises concern over the effectiveness of endpoint security, user awareness, and the need for proactive threat intelligence, while highlighting an evolution in adversary tactics toward cloud-based and identity-driven infiltration.
Hackers Weaponize Blender 3D Assets to Spread StealC V2 Malware
In late 2025, cybersecurity researchers identified a prolonged campaign in which attackers weaponized Blender 3D asset files (.blend) on popular asset-sharing platforms such as CGTrader. By implanting malicious files that executed the StealC V2 information-stealing malware, threat actors compromised unsuspecting users when they opened downloaded assets. Over at least six months, the campaign enabled attackers to harvest login credentials, browser data, and sensitive information from artists and professionals in gaming, animation, and design industries, leading to significant data theft and potential downstream attacks on organizations relying on Blender assets. This incident highlights the growing abuse of trusted creative software supply chains and open asset marketplaces. As creative and industrial processes increasingly depend on third-party digital assets, attackers are evolving to target creators, leveraging social engineering and supply chain weaknesses.
How Online Formatting Tools Exposed Thousands of Credentials: The JSONFormatter & CodeBeautify Leak
In late 2025, researchers uncovered that thousands of sensitive credentials, including passwords and API keys from governments, telecoms, and critical infrastructure organizations, were exposed after being pasted into public web-based code formatting tools such as JSONFormatter and CodeBeautify. This inadvertent data exposure occurred over several years, as users leveraged these tools for convenience, unaware that information was being logged and stored without proper security. Security experts at watchTowr Labs discovered over 80,000 files containing this data, raising alarm over the significant risk posed to organizations relying on manual and unsecured workflows. This incident has highlighted the growing risks of shadow IT and insecure use of web utilities in enterprise environments. It mirrors a broader trend of misconfigured third-party tools creating substantial vulnerabilities, elevating concerns amid regulatory crackdowns and increased exploitation of exposed secrets by attackers.
ToddyCat's 2025 Attack: How APTs Are Hijacking Microsoft 365 Email Tokens
In late 2025, the Advanced Persistent Threat (APT) group known as ToddyCat launched a sophisticated cyber espionage campaign targeting corporate environments across Europe and Asia. The attackers leveraged a new custom tool, TCSectorCopy, to steal Microsoft Outlook emails and Microsoft 365 OAuth 2.0 access tokens. By compromising user endpoints and abusing browser-based authentication flows, ToddyCat successfully exfiltrated sensitive email data and bypassed perimeter controls. The campaign, marked by its stealthy techniques, enabled attackers to maintain persistent access and move laterally within affected networks, significantly increasing the risk to sensitive enterprise communications and intellectual property. This incident highlights the growing reliance of threat actors on token theft and cloud-based attack vectors, posing new challenges for organizations with hybrid or cloud-first environments. It underscores the urgent need for advanced detection capabilities, Zero Trust network segmentation, and comprehensive identity protection strategies to counter emerging APT tactics.
JackFix Campaign Exploits Fake Windows Updates to Spread Infostealers in 2025
In late 2025, cybersecurity researchers uncovered a campaign orchestrated by the JackFix group using cloned adult websites as a phishing lure, distributed primarily through malvertising channels. Victims visiting these sites were presented with fake Windows update pop-ups designed to imitate critical security notifications. Unsuspecting users were tricked into executing malicious payloads that installed multiple information stealers, enabling the attackers to exfiltrate credentials, session tokens, and sensitive browser data. This attack illustrates how adversaries exploit popular platforms and social engineering to bypass traditional security controls, posing significant risks to both individuals and enterprises. The incident is particularly significant given the continued adoption of sophisticated phishing techniques and the blending of legitimate web content with highly convincing fraudulent prompts. Enterprises must remain vigilant as such campaigns highlight persistent weaknesses in endpoint protections, user awareness, and lateral movement defenses against infostealers.
Critical Buffer Overflow Flaws in Ashlar-Vellum Software Threaten Industrial Security
In November 2025, Ashlar-Vellum disclosed two critical software vulnerabilities—an Out-of-Bounds Write (CVE-2025-65084) and a Heap-based Buffer Overflow (CVE-2025-65085)—impacting its Cobalt, Xenon, Argon, Lithium, and Cobalt Share products (version 12.6.1204.207 and prior). Identified by security researcher Michael Heinzl and published via CISA, these flaws could allow local attackers to gain information disclosure or execute arbitrary code on affected engineering systems, primarily used in the Critical Manufacturing sector worldwide. The vulnerabilities are rated high (CVSS v4 score 8.4), but no exploitation has been reported to date. This incident reinforces the urgent need for robust vulnerability management and regular software patching within industrial control environments. Manufacturers and operators face increasing regulatory and operational pressure to proactively address new threats in their digital supply chains and critical OT infrastructure.
Rockwell Automation Arena Simulation Buffer Overflow (2025): Risks to Industrial Control Systems
In November 2025, Rockwell Automation disclosed a stack-based buffer overflow vulnerability (CVE-2025-11918) in its Arena Simulation software (versions 16.20.10 and earlier). The flaw, reported by security researcher Michael Heinzl, enables local attackers to execute arbitrary code by tricking users into opening a malicious DOE file. While the vulnerability is not exploitable remotely, it presents a significant risk to organizations leveraging Arena for critical manufacturing automation, especially when adequate segmentation and endpoint security controls are lacking. No public exploitation has been reported to date, and the vendor has released a security update to address the issue. This incident is a reminder of the persistence of file parsing vulnerabilities in industrial software, which continue to enable initial compromise via local vectors like engineered files or insider threats. The increase in similar vulnerabilities and the possibility of operational technology (OT) system breaches intensify the call for zero-trust and defense-in-depth strategies within the manufacturing sector.
Zenitel TCIV-3+ 2025: Critical ICS Vulnerabilities Enable Remote Attacks
In November 2025, Zenitel disclosed multiple critical vulnerabilities affecting its TCIV-3+ intercom systems, widely deployed in communications-critical infrastructure worldwide. Security researchers from Claroty Team82 identified three separate OS command injection flaws (CVE-2025-64126, -64127, -64128), as well as a severe out-of-bounds write and a reflected cross-site scripting vulnerability. These issues allowed threat actors to remotely execute arbitrary code or cause denial-of-service conditions without authentication, putting operational technology environments at significant risk of disruption or compromise. The vulnerabilities require only low-complexity attacks and no user interaction, amplifying their business impact. This incident highlights the ongoing critical importance of securing industrial control system components exposed to remote exploitation. With threat actors increasingly targeting IoT and OT devices in critical communications infrastructure, these types of vulnerabilities are seeing a dramatic rise globally, and patching urgency is at an all-time high.