Find what you’re looking for
Browse everything
6,854 results in Threat Reports
ClickFix Hospitality Breach: Infostealer Attack Impacts Hotels and Their Customers
In early 2024, a cybercrime campaign known as "ClickFix" targeted hospitality providers globally using infostealer and remote access trojan (RAT) malware. Threat actors gained initial access via spear phishing and malicious links, compromising hotel systems to harvest sensitive booking data and customer contact information. Attackers leveraged this stolen data to conduct highly convincing secondary phishing attacks directed at hotel customers via both email and WhatsApp channels, exposing guests to social engineering, fraud, and further credential theft. This cascading impact emphasized the attacker's focus on exploiting trusted relationships across business and customer environments. The incident is notable for its dual-target strategy, harnessing a single breach to fuel broader downstream attacks and demonstrating attackers' sophisticated use of layered social engineering. As infostealer activity surges across the hospitality and service sectors, defenders must adapt to increasingly persistent, multi-stage campaigns that pose risks for both enterprise operations and their customers.
TEE.fail: 2025 Hardware Attack Cracks Latest Secure Enclaves
In November 2025, researchers disclosed a critical hardware attack known as TEE.fail, which compromised secure enclaves (trusted execution environments or TEEs) across Intel, AMD, and ARM chips. By placing a small hardware device between a DDR5 memory chip and the motherboard, and leveraging kernel-level privileges, attackers were able to bypass the most advanced TEE protections including Confidential Compute, SEV-SNP, and TDX/SDX. Once exploited, these secure enclaves could no longer be trusted to protect sensitive data in-use, raising major concerns for cloud providers, enterprises, and users reliant on confidential computing. The attack’s low cost, simplicity, and applicability to modern hardware make it a significant development, reflecting growing sophistication in hardware-level threats. Regulatory scrutiny and industry attention have intensified as organizations reevaluate their trust assumptions and risk models for sensitive workloads.
runC Vulnerabilities Threaten Container Security: Docker and Kubernetes Breach 2024
In June 2024, critical vulnerabilities (CVE-2024-21626, CVE-2024-21627, and CVE-2024-21628) were disclosed in the runC container runtime, which underpins Docker, Kubernetes, and many modern container platforms. These flaws could be exploited by attackers to break out of a container, bypassing isolation controls and gaining unauthorized access to the underlying host system. A successful exploit would allow lateral movement and potentially compromise entire cloud or on-premises environments. Prompt patching and risk assessment are essential, as proof-of-concept exploits have already been published in the wild. This incident underscores the increasing sophistication and focus of attackers on supply chain and containerization technologies, as organizations accelerate cloud and DevOps adoption. As regulatory expectations around zero trust and runtime controls intensify, keeping pace with container threat vectors is now mission-critical for enterprise security teams.
GlassWorm Supply Chain Attack: Malicious VSCode Extensions Threaten Open Source Ecosystem
In June 2024, the GlassWorm malware resurfaced in a significant supply chain attack on the OpenVSX and Visual Studio Code (VSCode) extension marketplaces. Threat actors uploaded three malicious extensions, which were collectively downloaded over 10,000 times before detection and removal. These extensions were designed to compromise developer environments by deploying malware capable of exfiltrating credentials and enabling persistent access. The attack leveraged trusted open-source ecosystems, making it difficult for end users and organizations to detect the compromise until indicators of compromise (IoCs) were published, potentially exposing sensitive data and intellectual property. This event underscores a broader rise in supply chain attacks targeting developer tools and open-source package ecosystems. The campaign highlights the urgent need for rigorous code vetting, extension auditing, and enhanced supply chain security controls as attackers increasingly exploit automated trust in widely used development platforms.
Microsoft's 'Whisper Leak' Side-Channel Attack Bypasses Encryption for AI Traffic
In late 2025, Microsoft researchers uncovered the 'Whisper Leak' side-channel attack, a novel method allowing passive adversaries to deduce the topics of conversations with streaming AI language models despite the use of encrypted, high-performance network protocols. Attackers exploited traffic analysis techniques, observing packet timing and size patterns, to infer sensitive discussion details traversing enterprise VPNs and encrypted links. Although private circuit encryption such as MACsec and IPsec was in place, the attack effectively bypassed traditional data-in-transit security controls, raising concerns for sectors leveraging AI in sensitive communications. This incident is significant as it highlights an emerging risk where encrypted cloud AI traffic can be compromised via sophisticated traffic analysis, just as generative AI adoption is surging across regulated industries. It illustrates evolving attacker sophistication beyond classical exploits, prompting urgent review of AI data security and zero trust segmentation strategies.
'Ransomvibing' Supply Chain Attack Strikes Visual Studio Extension Marketplace
In early 2024, a malicious Visual Studio Code extension named 'Ransomvibing' was discovered on the Visual Studio Marketplace. The extension used AI-generated code to encrypt and exfiltrate sensitive project data from developer environments, leveraging encrypted outbound traffic to evade traditional detection methods. Despite containing telltale signs of automation and suspicious behavior, the extension bypassed security controls and was downloaded before being taken down, exposing users to significant intellectual property and operational risks associated with a compromised development supply chain. This incident highlights growing risks in open-source and extension marketplaces, as attackers increasingly exploit trusted software ecosystems with novel supply-chain techniques. Organizations should prioritize continuous monitoring of third-party integrations and reinforce their zero trust controls in response to evolving adversary methods.
Landfall Malware: Covert Mobile Surveillance Hits Samsung Galaxy in 2024
In early 2024, cybersecurity researchers uncovered a sophisticated mobile surveillance campaign targeting Samsung Galaxy users through a malware strain dubbed 'Landfall.' Delivered primarily via malicious apps and phishing schemes, Landfall granted attackers covert access to device microphones, cameras, geolocation, and sensitive stored data. The threat actors capitalized on advanced evasion tactics to remain undetected, enabling them to record conversations, track user locations, collect photos, and exfiltrate contacts without the victims’ knowledge. The incident highlights the growing complexity of targeted mobile threats and the operational risks facing organizations with a mobile workforce. With the rise of mobile malware like Landfall exploiting modern smartphones’ vast attack surface, security teams must reassess their controls for device management, east-west traffic monitoring, and policy enforcement. This case underscores the urgency for enterprises to adopt zero trust defenses and adapt to evolving mobile threat tactics.
APT Groups Exploit Hybrid & Multicloud Gaps: Insights from ESET Q2–Q3 2025 Activity Report
In Q2 and Q3 of 2025, ESET Research identified a surge in advanced persistent threat (APT) activity, with multiple sophisticated threat actors targeting organizations across various industries and geographies. These groups leveraged techniques such as east-west lateral movement within hybrid and multicloud environments, encrypted traffic tunneling, and exploitation of zero trust segmentation gaps. Attackers infiltrated networks via phishing campaigns, supply chain vulnerabilities, and exploitation of unpatched cloud workloads, achieving persistent access and data exfiltration. The business impacts included service disruptions, data breaches, and regulatory scrutiny for affected organizations. This incident underscores the increasing complexity of APT operations in cloud-centric architectures and highlights the urgency of implementing comprehensive east-west visibility, zero trust controls, and robust anomaly detection. The trends reported by ESET indicate a continued escalation of multicloud security risks and a persistent threat landscape adapting to modern enterprise environments.
How State-Sponsored APTs Bypassed Multi-Cloud Defenses in 2025
Between Q2 and Q3 2025, ESET researchers identified a significant rise in sophisticated Advanced Persistent Threat (APT) attacks spanning multiple regions and industry verticals. State-sponsored actors leveraged encrypted communications and advanced lateral movement tactics to compromise organizations’ east-west cloud traffic, successfully bypassing conventional perimeter defenses. These campaigns exploited unmonitored internal traffic and insufficient network segmentation, leading to the exfiltration of sensitive data and critical infrastructure disruptions. The attackers demonstrated thorough knowledge of multi-cloud environments, combining zero-day exploits with stolen credentials to maintain persistent access and evade detection for weeks. This incident is emblematic of a broader trend—APT groups are accelerating the use of sophisticated, stealthy methods in hybrid cloud contexts. Modern enterprises must recognize the increased risk to east-west workloads, stay vigilant to evolving TTPs, and augment internal defenses in the face of rising geopolitical tensions and regulatory enforcement.
Landfall Spyware Campaign Exposes Samsung Galaxy Devices in the Middle East
In mid-2024, security researchers from Palo Alto Networks' Unit 42 uncovered 'Landfall', a sophisticated commercial-grade spyware campaign targeting Samsung Galaxy S22, S23, S24, and Fold/Flip devices in the Middle East, specifically in Iran, Iraq, Morocco, and Turkey. Attackers exploited a Samsung-specific zero-day vulnerability using malicious DNG image files, often distributed via WhatsApp, enabling zero-click infection without user interaction. Once compromised, Landfall enables extensive surveillance capabilities, such as microphone activation and unauthorized data collection—including contacts and photos. While attribution remains inconclusive, similarities in infrastructure hint at possible links to the Stealth Falcon APT group. This incident highlights the rising use of zero-click exploits and highly-targeted mobile spyware attacks against consumer devices. The sophistication and persistence of such campaigns are forcing device vendors, regulators, and enterprises to invest in rapid patching, threat detection, and zero trust mobile security strategies to counter fast-evolving mobile threats.
Yanluowang Ransomware & Access Broker Target U.S. Firms: Volkov Convicted
Between July 2021 and November 2022, multiple U.S. businesses—including an engineering firm and a bank—were targeted by the Yanluowang ransomware group, using access broker Aleksei Olegovich Volkov to gain initial entry. Volkov, operating as “chubaka.kor,” exploited vulnerabilities in victim networks, facilitated data theft and encryption, and coordinated ransom payments, some of which totaled $1.5 million. Victims suffered operational disruption, including temporary shutdowns and extortion attempts such as DDoS attacks and executive harassment. Forensic analysis linked the activities to Volkov via cryptocurrency tracing and communication evidence; $24 million in ransoms was demanded in total. This case highlights growing cooperation among cybercriminals, where access brokers sell or share footholds with ransomware operators, fueling larger-scale, multi-faceted cyber-extortion campaigns. The high-profile prosecution also sets precedent for international arrests and restitution, amid increasingly aggressive ransomware trends and evolving attack tactics.
Nation-State Attack Targets U.S. Congressional Budget Office in Major 2024 Data Breach
In June 2024, the U.S. Congressional Budget Office (CBO) suffered a cybersecurity breach after a suspected foreign nation-state threat actor infiltrated its network. The intrusion was discovered when unusual network activity was detected within CBO systems. Investigations suggest attackers may have accessed sensitive internal documents and communications, exposing potentially confidential government data. Although specifics of the exploited vulnerability remain undisclosed, early reports correlate the activity with sophisticated techniques associated with advanced persistent threats focused on harvesting intelligence from federal agencies. The CBO is coordinating with federal cyber authorities to assess the intrusion’s scope and impact. This event underscores an ongoing surge of nation-state cyber operations targeting U.S. government institutions. Recent patterns reveal an escalation in targeted attacks leveraging stealthy lateral movement and encrypted traffic bypasses, highlighting regulatory and operational pressure for federal agencies to strengthen zero trust principles and enhance east-west network defenses.