Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Broadcast Media

Breach intelligence, attack campaigns, and threat reports targeting the Broadcast Media sector.

42 threat reports
Page 1 of 4
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Broadcast Media Threat Reports

Showing 1–12 / 42 reports
CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action
CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action
Government Administration2 weeks ago

CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action

In October 2026, CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, spanning Plex Media Server (four CVEs covering SSRF, URI scheme injection, and path traversal), EG Secure Solutions SiteGuard Server Edition (OS command injection), and Siemens Software Center (uncontrolled search path element). These vulnerabilities collectively enable attackers to achieve initial access, remote code execution, and full system control. Federal agencies operating under BOD 26-04 face mandatory remediation timelines, while CISA urges all organizations to prioritize patching these high-risk flaws across publicly exposed assets before threat actors can leverage pre-patch compromise windows. This catalog addition reflects a sustained attacker focus on commercial media platforms, enterprise security gateways, and industrial software distribution infrastructure. The breadth of affected vendors—consumer-grade to OT-adjacent—signals that ransomware groups and nation-state actors are actively scanning for unpatched instances, making rapid remediation and network segmentation critical defensive priorities across all sectors.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AdFection: How Targeted Ads Became a Zero-Click Pipeline for Candiru Spyware
AdFection: How Targeted Ads Became a Zero-Click Pipeline for Candiru Spyware
Broadcast Media2 weeks ago

AdFection: How Targeted Ads Became a Zero-Click Pipeline for Candiru Spyware

Between March and June 2026, Israeli mercenary spyware vendor Candiru was deployed against at least 45 devices at Al Jazeera Media Network through a zero-click advertising attack technique dubbed AdFection by Citizen Lab researchers. The operation was orchestrated by Discover-Tech, a company acting as a broker between the surveillance industry and programmatic ad networks. Malicious JavaScript embedded in purchased ad placements contacted a NOAS server upon rendering, silently fingerprinting and selecting high-value targets for Candiru DevilsTongue spyware delivery—no user interaction required. The campaign placed 3.77 billion ad bids and won 442 million auctions, touching 75,373 mobile apps and 120,768 websites. AdFection marks the first publicly confirmed instance of commercial spyware delivered via targeted advertising infrastructure at scale, blurring the line between the ad-tech ecosystem and state-grade surveillance tooling. As mercenary spyware operators increasingly weaponize legitimate digital channels, organizations in media, civil society, and regulated industries face a novel and nearly invisible initial-compromise vector that bypasses traditional endpoint and perimeter defenses.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government
AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government
Marketing/Advertising/Sales3 weeks ago

AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government

In 2024, researchers at The Citizen Lab uncovered AdFection, the first documented zero-click mercenary spyware campaign delivered through targeted online advertising. The Israeli company Discover-Tech, operating as a legitimate advertising firm, facilitated infections by directing millions of devices to contact Candiru spyware servers through malicious ads displayed across 120,000 websites and 70,000 mobile apps. At least 45 devices at Al Jazeera were successfully compromised, with the spyware capable of remote device takeover, data theft, and surveillance through microphones and cameras. The campaign exposed critical vulnerabilities in the digital advertising ecosystem, prompting Google and IAB Europe to remove Discover-Tech from their vendor registries. This incident highlights the growing sophistication of surveillance-for-hire operations exploiting legitimate advertising infrastructure to conduct mass surveillance operations against media organizations, government agencies, and civil society targets worldwide.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Nikkei's Dual Email Breach Exposes Critical Cloud Security Gaps
Newspapers/Journalism1 month ago

Nikkei's Dual Email Breach Exposes Critical Cloud Security Gaps

Japanese media giant Nikkei disclosed two separate email account breaches in 2026, affecting both Google Workspace and Microsoft 365 platforms. In July, attackers compromised a Google Workspace account exposing personal information of 1,646 employees and business partners. A second incident in September involved threat actors accessing a Microsoft 365 account to launch 9,000 phishing emails targeting Nikkei staff and interviewees. The attacks highlight persistent targeting of the media organization, following previous incidents including a $29 million BEC attack in 2019, ransomware in 2022, and Slack breach affecting 17,000 users in 2025. This incident reflects the escalating threat landscape facing media organizations, where attackers increasingly target cloud email platforms to conduct secondary attacks and establish persistent access for future operations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
UTA0565 Exploits Chrome-Windows Zero-Day Chain in Sophisticated Campaign Against Asian Governments
UTA0565 Exploits Chrome-Windows Zero-Day Chain in Sophisticated Campaign Against Asian Governments
Government Administration1 month ago

UTA0565 Exploits Chrome-Windows Zero-Day Chain in Sophisticated Campaign Against Asian Governments

In September 2026, Chinese threat actor UTA0565 exploited a zero-day exploit chain targeting Google Chrome and Microsoft Windows vulnerabilities (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) to deploy CLEANGULP malware. The attackers used fake websites masquerading as legitimate media organizations and NGOs to target Asian government entities, particularly through phishing campaigns related to Hong Kong activist Chow Hang-tung. The exploit chain allowed attackers to break out of Chrome's sandbox and achieve remote code execution, demonstrating sophisticated coordinated efforts within the Chinese cyber espionage community. This incident highlights the growing sophistication of state-sponsored actors utilizing coordinated zero-day exploit chains and the increasing targeting of government entities through social engineering campaigns tied to geopolitical events.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Chinese APT Group UTA0565 Weaponizes Chrome and Microsoft Zero-Days in Coordinated Espionage Campaign
Chinese APT Group UTA0565 Weaponizes Chrome and Microsoft Zero-Days in Coordinated Espionage Campaign
Government Administration1 month ago

Chinese APT Group UTA0565 Weaponizes Chrome and Microsoft Zero-Days in Coordinated Espionage Campaign

In September 2024, Volexity researchers identified UTA0565, a Chinese state-aligned threat group, exploiting a triple-chain of zero-day vulnerabilities in Chrome and Microsoft Windows. The group leveraged CVE-2026-85046, CVE-2026-87491 (Chrome JavaScript engine RCE flaws), and CVE-2026-85880 (Windows ALPC privilege escalation) between September 3-4, before patches were available. UTA0565 deployed sophisticated phishing campaigns targeting Asian government entities with fake websites impersonating legitimate organizations, ultimately delivering the previously undocumented CLEANGULP malware family for espionage operations. This incident represents a concerning trend of coordinated exploit sharing within China's cyber espionage ecosystem, as multiple threat groups including APT31 have weaponized the same vulnerability chains. The sophisticated nature of these attacks and their targeting of government entities highlights the escalating capabilities and coordination among state-sponsored actors in exploiting zero-day vulnerabilities for strategic intelligence collection.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
APT37 Embeds Malware in Load Balancers to Spy on South Korean Industries
APT37 Embeds Malware in Load Balancers to Spy on South Korean Industries
Automotive1 month ago

APT37 Embeds Malware in Load Balancers to Spy on South Korean Industries

A North Korean advanced persistent threat group, likely APT37, conducted sophisticated espionage operations against South Korean media and automotive companies throughout 2025-2026. The attackers compromised HAProxy load balancers to deploy a custom Linux toolkit called 'TED', gaining access to decrypted communications and conducting long-term surveillance operations. The group harvested credentials, modified log files to hide their tracks, and maintained persistent access to target networks for intelligence collection on media sources and manufacturing technology. This incident represents a significant evolution in APT tactics, demonstrating how threat actors are embedding malicious code directly into production infrastructure rather than deploying traditional malware. The targeting of critical industrial sectors and the sophisticated load balancer compromise technique highlight the growing threat to network appliances and the need for enhanced infrastructure security.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Mass Plex Server Exposure: 36,000 Vulnerable Instances Highlight Critical Patch Management Gaps
Mass Plex Server Exposure: 36,000 Vulnerable Instances Highlight Critical Patch Management Gaps
Entertainment/Movie Production2 months ago

Mass Plex Server Exposure: 36,000 Vulnerable Instances Highlight Critical Patch Management Gaps

In September 2026, over 36,000 Plex Media Server instances remained exposed online and unpatched against critical security vulnerabilities affecting version 1.43.2 and earlier. Plex urgently warned users to upgrade to version 1.43.3, released in May 2026, to address multiple security flaws that lack CVE identifiers for easy tracking. The company took the unusual step of emailing customers directly about the severity of these vulnerabilities. Shadowserver's scanning revealed the massive scale of exposure, with tens of thousands of servers remaining vulnerable to potential exploitation as attackers could reverse-engineer the patches to develop exploits. This incident highlights the persistent challenge of vulnerability management in internet-exposed services, particularly as organizations increasingly rely on media streaming and file sharing platforms that may lack enterprise-grade security controls and patch management processes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical Plex Security Update: Multiple Vulnerabilities Patched in September 2026
Critical Plex Security Update: Multiple Vulnerabilities Patched in September 2026
Entertainment/Movie Production2 months ago

Critical Plex Security Update: Multiple Vulnerabilities Patched in September 2026

In September 2026, Plex urged users to immediately update their Media Server and Desktop applications following the discovery of multiple undisclosed security vulnerabilities. The streaming media service released patches in Plex Media Server version 1.43.3 and Plex Desktop 1.115.0, with CVE identifiers requested for the flaws. While technical details remain undisclosed, this follows a pattern of critical Plex vulnerabilities, including a high-severity authentication bypass flaw (CVE-2025-34158) patched in August 2025 that exposed server owner credentials to any authenticated user. This incident highlights the ongoing security challenges facing media streaming infrastructure, particularly as threat actors increasingly target home and small business servers. With over 360,000 Plex servers exposed to the internet and a history of exploitation including the 2022 LastPass breach chain, these vulnerabilities underscore the critical need for rapid patch deployment and network segmentation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Ted Backdoor Reveals Critical Gap in Load Balancer Security
Ted Backdoor Reveals Critical Gap in Load Balancer Security
Automotive2 months ago

Ted Backdoor Reveals Critical Gap in Load Balancer Security

In September 2026, North Korean state-sponsored actors deployed a sophisticated backdoor called 'Ted' by compromising HAProxy load balancers at two South Korean organizations in the automotive and media sectors. The attackers replaced legitimate HAProxy binaries with trojanized versions containing embedded malware that intercepted web traffic and served altered pages to selected visitors. The implant operated covertly by handling command-and-control requests without reaching backend servers, erasing traces from connection logs and statistics. The attack toolkit included additional trojans targeting system binaries like sshd and crond, along with a companion remote access trojan called curlRAT that maintained persistent access to compromised systems. This incident highlights the evolving sophistication of supply chain attacks where legitimate infrastructure components are weaponized to establish persistent footholds in critical networks. The attack demonstrates advanced techniques for traffic manipulation and steganographic communication that bypass traditional security controls focused on network perimeter defense.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Plex Issues Urgent Security Warning: Multiple Critical Vulnerabilities Require Immediate Patching
Plex Issues Urgent Security Warning: Multiple Critical Vulnerabilities Require Immediate Patching
Entertainment/Movie Production2 months ago

Plex Issues Urgent Security Warning: Multiple Critical Vulnerabilities Require Immediate Patching

In September 2026, Plex issued an urgent security advisory warning users to immediately update their media servers and desktop clients to patch multiple critical vulnerabilities affecting Plex Media Server v1.43.2 and earlier. The company released patched versions (Media Server 1.43.3 and Desktop 1.115.0) and took the unusual step of emailing customers directly about the severity of these flaws, though specific CVE details were not yet published. This follows Plex's history of serious security incidents, including a 2025 credential theft vulnerability (CVE-2025-34158) and a 2022 data breach that compromised user credentials and personal information. This incident highlights the growing trend of threat actors targeting popular media streaming platforms and home entertainment systems as attack vectors for lateral movement into personal and corporate networks, particularly as remote work continues to blur the lines between home and business environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Serbian Student Activists Targeted by Pegasus Zero-Click Spyware Campaign
Serbian Student Activists Targeted by Pegasus Zero-Click Spyware Campaign
Government Administration2 months ago

Serbian Student Activists Targeted by Pegasus Zero-Click Spyware Campaign

In December 2025 through January 2026, NSO Group's Pegasus spyware infected the iPhone of a Serbian student protest movement member using a zero-click iMessage exploit. The attack was part of a broader surveillance campaign targeting at least 14 Serbian activists, opposition politicians, and student leaders coinciding with March 2026 local elections. Citizen Lab and SHARE Foundation confirmed the infection, while a separate incident involved NoviSpy Android malware deployed during police detention of another student activist. This incident highlights the escalating use of commercial spyware against civil society, particularly as authoritarian governments increasingly weaponize surveillance technology to suppress political dissent and monitor opposition movements ahead of critical elections.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports