Find what you’re looking for
Browse everything
6,854 results in Threat Reports
Rondo Botnet Exploits Pentaho URL Mapping Flaws: Lessons from the 2022 Breach
In late 2022, the Hitachi Vantara Pentaho Business Analytics Server was targeted by attackers exploiting CVE-2022-43939 and CVE-2022-43769, leveraging flaws in URL mapping and URL-based access control. Threat actors, including the 'Rondo' botnet group, exploited a template injection vulnerability that allowed unauthenticated command execution by bypassing authentication controls via specific URL paths. This enabled attackers to remotely execute arbitrary code, potentially gaining control over affected systems, exfiltrate data, and laterally move within enterprise networks. The automation and scale of these attacks highlighted application misconfigurations, lapses in secure access control design, and the ongoing risk of vulnerable web application endpoints. This incident underscores a broader trend of threat actors exploiting subtle misconfigurations in URL handling and web server rules. Organizations are now under increased regulatory and operational pressure to audit legacy web applications and APIs, implement zero trust segmentation, and rigorously validate access control rules as attackers aggressively pursue these weaknesses.
Salesloft Drift SaaS Breach: How Excessive Trust Unlocked CRM Data
In early 2024, the Salesloft Drift SaaS integration breach unfolded when attackers exploited security weaknesses in the Drift chatbot’s OAuth implementation. Malicious actors obtained chatbot OAuth tokens—intended for secure system integrations—and leveraged these for legitimate API calls against customer CRM environments, such as Salesforce. Because the tokens remained valid and were often granted excessive standing privileges, attackers could exfiltrate sensitive business records, contact information, support data, and even embedded credentials across over 700 organizations, all without immediate detection. This breach underscored a powerful new threat vector involving identity and permissions sprawl in SaaS and AI-driven environments. As organizations increasingly rely on deeply integrated third-party systems with broad and persistent access, similar attacks targeting privileged automation and identity-based authorizations are expected to surge without robust governance and continuous monitoring.
Iberia Data Breach (2024): Supply Chain Compromise Exposes Airline Customer Data
In June 2024, Spanish airline Iberia disclosed a significant data breach originating from the compromise of an external supplier. Attackers leveraged a third-party network to steal approximately 77 GB of sensitive customer data, including contact information, travel details, and partial payment card data. The breach was first publicized on underground forums, with threat actors claiming possession of the data days before Iberia notified its customers. The incident underscores how supply chain vulnerabilities can directly jeopardize core business operations and customer trust, disrupting service continuity and triggering regulatory scrutiny for the airline industry. This breach illustrates the ongoing escalation of supply chain attacks, where organizations are exposed through weak vendor controls. With similar tactics increasingly exploited against critical infrastructure, maintaining robust controls over partners is now essential in light of growing attacker sophistication and tightening data protection requirements.
CISA Issues Urgent Alert: Oracle Identity Manager Zero-Day (CVE-2025-61757) Exploited in Active Attacks
In June 2025, CISA issued an emergency warning following the discovery of active exploitation against Oracle Identity Manager (OIM), targeting a critical remote code execution vulnerability tracked as CVE-2025-61757. Attackers leveraged this flaw, possibly as a zero-day, to gain unauthorized access to governmental and enterprise identity infrastructures. Evidence shows threat actors performed arbitrary code execution on affected systems, enabling privilege escalation and potential lateral movement within targeted networks. This breach presents serious risks to the integrity and availability of authentication systems, exposing sensitive data and potentially undermining access controls across impacted organizations. The incident stands out due to a surge in direct attacks targeting identity infrastructure and core authentication providers. The increasing reliance on identity management platforms makes these systems high-value targets, highlighting a broader trend towards exploiting supply chain and zero-day vulnerabilities with immediate, widespread consequences.
Unpacking the Qilin Ransomware Attack: Lessons from a ScreenConnect Breach
In early 2024, a Qilin ransomware attack demonstrated the risks of third-party remote access tools when threat actors gained entry via ScreenConnect to a corporate endpoint. Leveraging this precarious foothold, attackers navigated the environment, launched failed infostealer payloads, then successfully executed ransomware—all while evading detection due to severely limited log visibility. Despite these blind spots, incident responders from Huntress used endpoint forensics and cross-correlation of minimal artifacts to reconstruct the entire attack path, including lateral movement attempts and the precise ransomware execution timeline. This incident highlights the growing sophistication of ransomware actors using remote IT management software for covert entry. As RMM tool vulnerabilities and minimal logging become more prevalent, organizations face heightened risk and pressure to implement deeper east-west threat detection and robust zero trust network segmentation.
WhatsApp’s 2024 API Flaw: 3.5 Billion Accounts Exposed via Automated Scraping
In early 2024, a significant data exposure incident affected WhatsApp when researchers discovered and exploited a vulnerability in the platform's contact-discovery API. The API lacked effective rate limiting and permitted mass enumeration of registered user accounts by automating queries, enabling adversaries to harvest data on approximately 3.5 billion mobile phone numbers and associated details. No evidence suggests the involvement of a deliberate threat actor beyond security researchers, but the scale and scope highlight serious privacy and operational risks for both users and WhatsApp’s business integrity. The incident underscores ongoing risks for messaging applications leveraging public-facing APIs without stringent access and abuse controls. This breach is highly relevant as API abuse and large-scale account enumeration techniques are increasingly exploited by attackers seeking personal data. Regulatory scrutiny is poised to intensify, and similar flaws are being reported across numerous communications platforms, making robust API security and anomaly detection critical in today’s threat landscape.
Cox Enterprises Data Breach 2024: Oracle Zero-Day Exploit Compromises Sensitive Data
In June 2024, Cox Enterprises disclosed a significant data breach where attackers exploited a zero-day vulnerability in Oracle E-Business Suite to gain unauthorized access to the company’s network. The exploitation enabled the threat actors to bypass existing security controls, potentially exfiltrating sensitive personal data of customers and employees. The breach was detected after anomalous network activity was flagged, prompting a forensic investigation and subsequent notification to affected individuals. The incident underscores the ongoing risks associated with unpatched enterprise software and the increasing sophistication of threat actors in targeting supply-chain and business applications. This breach is particularly relevant amid a surge in zero-day exploits targeting enterprise management platforms, highlighting the urgency for robust vulnerability management, continuous monitoring, and rapid incident response. Organizations must reassess their exposure to similar risks due to heightened regulatory scrutiny and the evolving tactics used by cybercriminals.
CISA Flags Critical Oracle Identity Manager Zero-Day as Actively Exploited
In June 2025, a critical zero-day vulnerability (CVE-2025-61757) affecting Oracle Identity Manager was added to CISA’s Known Exploited Vulnerabilities catalog, following credible reports of active exploitation. Attackers leveraged a missing authentication flaw in a critical function, allowing remote, pre-authenticated access and full compromise of affected systems. Organizations using Oracle Identity Manager faced a risk of unauthorized access, credential theft, and lateral movement, with potential for widespread service disruption and data exfiltration across enterprise networks. Remediation required rapid deployment of patches and security controls to prevent further breaches. This incident underscores the rising impact of identity-driven attack vectors targeting core authentication systems, with adversaries increasingly exploiting zero-day flaws in widely-used identity platforms. The exploitation highlights an urgent need for strengthened identity protection, patch management, and zero-trust segmentation as attackers target the intersection of critical infrastructure and identity orchestration.
Matrix Push C2 Phishing Exposes Fileless Browser Attacks in 2025
In November 2025, a sophisticated phishing campaign was uncovered utilizing a novel command-and-control (C2) platform called Matrix Push C2. The threat actors exploited browser push notifications, fake alerts, and fileless redirection to lure users across multiple operating systems into interacting with malicious links. Researchers observed that the campaign delivered phishing payloads without traditional downloads, thereby evading many endpoint defenses and expanding its cross-platform reach. Impacted organizations reported heightened risks of credential theft, business email compromise, and data exfiltration stemming from the hard-to-detect, browser-native behavior of Matrix Push C2. This incident highlights the escalating threat of fileless attacks and creative social engineering, particularly as businesses increasingly rely on browser-based workflows. The abuse of browser notifications as a phishing vector presents a growing challenge for security teams and underscores the importance of proactive browser and endpoint defenses.
Salesforce Data Breached Again: ShinyHunters Exploit Third-Party Gainsight in 2024 Attack
In June 2024, several Salesforce customers experienced a significant data breach perpetrated by the ShinyHunters extortion group. Attackers exploited vulnerabilities in a third-party vendor, Gainsight, which had integrations with Salesforce platforms. By compromising Gainsight, ShinyHunters acquired credentials or access tokens, enabling them to exfiltrate sensitive Salesforce customer data from multiple organizations. The breach demonstrates the persistent risk of attacks originating from trusted third-party software supply chains, resulting in the exposure of business and customer information and raising concerns about the security posture of major SaaS ecosystems. This breach highlights a continued trend in which attackers bypass direct controls by targeting vendors in a SaaS environment, leveraging weak third-party access and inadequate segmentation. As businesses increase SaaS adoption and interconnectivity, these attacks demonstrate the urgent need for enhanced third-party risk management and more granular network and identity controls.
APT31 Orchestrates Stealthy Cloud-Based Attack on Russian IT Firms (2024–2025)
Between 2024 and 2025, the advanced persistent threat group APT31, linked to China, conducted a series of covert cyberattacks against Russia’s IT sector, specifically targeting firms involved in government contracting. Leveraging cloud services and encrypted traffic, the attackers infiltrated networks while remaining undetected for long periods. APT31 employed sophisticated lateral movement, abuse of multicloud visibility gaps, and zero trust segmentation bypasses, resulting in the exfiltration of sensitive data and potential compromise of government-integrator communication flows. This incident reflects growing tensions and evolving threat tactics in state-sponsored cyberespionage, where cloud infrastructure, stealthy east-west movements, and advanced evasion are exploited. The attack underscores the critical need for enforced segmentation, robust cloud-native security, and proactive anomaly detection to defend against advanced persistent threats targeting the IT supply chain.
LINE Messaging Bugs Expose Millions to Asian Cyber Espionage in 2024
In June 2024, security researchers disclosed several critical vulnerabilities in the LINE messaging app, widely used across Asia, arising from its use of a proprietary and flawed cryptographic protocol. The bugs enable attackers to intercept and replay message traffic, impersonate users, and siphon sensitive chat data, despite the app's claims of end-to-end encryption. No specific threat actor has been confirmed, but the flaws create opportunities for state-sponsored espionage and criminal data compromise. The weaknesses persist in both in-app and network-level communication, putting millions of users’ private conversations at risk. This incident highlights the dangers of custom security implementations and is of urgent concern given LINE’s importance in business and personal use across Asia. With attackers increasingly targeting messaging platforms and governments ramping up regulatory scrutiny around privacy and secure communications, organizations must prioritize rigorous security architecture and compliance.