Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Broadcast Media

Breach intelligence, attack campaigns, and threat reports targeting the Broadcast Media sector.

42 threat reports
Page 3 of 4
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Broadcast Media Threat Reports

Showing 25–36 / 42 reports
UNSW's 'Capture the Narrative' Wargame Reveals AI's Power in Social Media Manipulation
Government Administration6 months ago

UNSW's 'Capture the Narrative' Wargame Reveals AI's Power in Social Media Manipulation

In 2025, the University of New South Wales (UNSW) conducted 'Capture the Narrative,' a pioneering wargame where students developed AI-driven bots to influence a simulated election on a fictional social media platform. Over four weeks, participants generated over 7 million posts, with more than 60% of content produced by these bots. The exercise demonstrated how AI can be leveraged to manipulate public opinion, resulting in a 1.78% swing that altered the election outcome. This experiment underscores the growing threat of AI-powered influence operations in real-world scenarios. ([unsw.edu.au](https://www.unsw.edu.au/newsroom/news/2026/01/social-media-wargame-reveals-how-ai-bots-can-swing-election?utm_source=openai)) The relevance of this incident is heightened by the increasing use of AI in disinformation campaigns. For instance, Microsoft reported that China has begun employing generative AI to create realistic images supporting divisive U.S. political content, marking a significant evolution in influence operations. ([axios.com](https://www.axios.com/2023/09/08/china-ai-disinformation-microsoft?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Massiv Android Banking Malware: A New Threat in 2026
Banking/Mortgage8 months ago

Massiv Android Banking Malware: A New Threat in 2026

In early 2026, cybersecurity researchers identified a new Android banking malware named Massiv, which masquerades as IPTV applications to infiltrate devices. Once installed, Massiv employs screen overlays and keylogging to steal sensitive information, including banking credentials, and can remotely control compromised devices. Notably, it targeted the Portuguese government's Chave Móvel Digital app, potentially allowing attackers to bypass KYC verifications and access banking accounts. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-massiv-android-banking-malware-poses-as-an-iptv-app/?utm_source=openai)) This incident underscores a growing trend where cybercriminals exploit popular app themes, like IPTV, to distribute malware. The increasing sophistication of such attacks highlights the urgent need for enhanced mobile security measures and user vigilance against downloading apps from unverified sources.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerability in KiloView Encoder Series: Unauthenticated Admin Account Takeover
Broadcast Media9 months ago

Critical Vulnerability in KiloView Encoder Series: Unauthenticated Admin Account Takeover

In January 2026, a critical vulnerability (CVE-2026-1453) was identified in KiloView Encoder Series devices, allowing unauthenticated attackers to create or delete administrator accounts, thereby gaining full administrative control. This flaw, stemming from missing authentication checks on critical functions, affects multiple versions across the E1, E1-s, E2, G1, P1, P2, and RE1 hardware series. The vulnerability has a CVSS score of 9.8, indicating its severity. ([thehackerwire.com](https://www.thehackerwire.com/vulnerability/CVE-2026-1453/?utm_source=openai)) The absence of authentication mechanisms in these devices underscores the importance of implementing robust security measures in critical infrastructure components. Organizations utilizing KiloView Encoder Series devices should prioritize immediate mitigation strategies to prevent potential exploitation. ([isssource.com](https://www.isssource.com/no-fix-for-kiloview-encoder-series/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How NoName057(16) Used DDoSia to Drive Hacktivist DDoS Attacks in 2024
Government Administration10 months ago

How NoName057(16) Used DDoSia to Drive Hacktivist DDoS Attacks in 2024

In early 2024, the pro-Russian hacktivist group NoName057(16) leveraged their custom DDoS tool, DDoSia, to orchestrate large-scale distributed denial-of-service attacks targeting government, media, and institutional websites in Ukraine and Western countries. By mobilizing a network of volunteer participants through its affiliate model, NoName057(16) was able to coordinate and intensify attacks, resulting in substantial website downtime and service disruptions for organizations with links to Ukraine and the West. The campaign highlighted the effectiveness of modern hacktivist crowd-sourcing tactics and the increasing difficulty of defending against well-organized, politically motivated DDoS operations. This incident is particularly relevant in 2024 as DDoS-as-a-service tools and volunteer-driven hacktivist campaigns are on the rise, blurring the lines between state-driven threats and amateur activism. Organizations should review their DDoS mitigation and incident response defenses amid heightened geopolitical tensions and expanding threat capabilities among hacktivist collectives.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Condé Nast 2024 Breach: Hacker Leaks 2.3M WIRED Subscriber Records
Broadcast Media10 months ago

Condé Nast 2024 Breach: Hacker Leaks 2.3M WIRED Subscriber Records

In March 2024, a hacker claimed to have breached Condé Nast's systems, exfiltrating and leaking a database containing over 2.3 million subscriber records from WIRED. The attacker published samples of the data on a known cybercrime forum, alleging access to databases belonging to other major Condé Nast brands and threatening to release up to 40 million more records. The exposed data reportedly included names, email addresses, postal codes, company names, and subscription specifics but did not involve payment card information. The breach highlights ongoing risks associated with third-party access, inadequate segmentation, and insufficient detection controls in the media sector. This incident underscores the growing trend of targeting high-profile media companies for large-scale data theft, aligning with broader increases in B2C sector breaches and information theft campaigns. Increased regulatory scrutiny and investor attention on data security make robust segmentation, encrypted transit, and rapid anomaly detection particularly relevant.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Inside Kimwolf: How 1.8 Million Android TVs Became a DDoS Botnet Army
Entertainment/Movie Production10 months ago

Inside Kimwolf: How 1.8 Million Android TVs Became a DDoS Botnet Army

In December 2025, cybersecurity researchers discovered the Kimwolf botnet had hijacked over 1.8 million Android-based smart TVs, set-top boxes, and tablets globally. The attackers leveraged the NDK (Native Development Kit) to compile malware that turned these consumer devices into a massive botnet used primarily for launching large-scale distributed denial-of-service (DDoS) attacks. The infected endpoints were recruited silently and spread across both residential and enterprise networks, enabling the attackers to conduct coordinated, high-bandwidth attacks and evade conventional network defenses. Initial findings also suggest a link between Kimwolf and the previously observed AISURU botnet, indicating possible collaboration or shared tooling between threat actors. This incident highlights a disturbing trend: threat actors increasingly targeting loosely protected IoT and smart device ecosystems for botnet creation. The scale and performance of Kimwolf underscore the growing risk posed by unpatched consumer electronics, calling for urgent improvements in east-west traffic security, segmentation, and network visibility across hybrid environments.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
CopyCop: Unmasking Russia's AI-Driven Disinformation Offensive in 2024
Broadcast Media10 months ago

CopyCop: Unmasking Russia's AI-Driven Disinformation Offensive in 2024

In early-to-mid 2024, cybersecurity researchers uncovered the extensive "CopyCop" campaign, a Russian-connected influence operation leveraging AI technologies to scale disinformation globally. The operation orchestrated over 300 AI-generated fake news sites mimicking legitimate Western media outlets, flooding North America, Europe, and other regions with fabricated stories and deepfakes targeting public perception about the conflict in Ukraine. CopyCop used self-hosted large language models to mass-produce convincing articles, fake fact-checkers, and synthetic visuals, eroding trust in authentic journalism and amplifying Kremlin narratives. The sophisticated use of generative AI and automation enabled unprecedented speed, reach, and content variability, evading traditional detection tactics and spreading misinformation at scale. This incident highlights an accelerating trend: threat actors and nation-state proxies are operationalizing generative AI for influence campaigns, making synthetic media and coordinated digital manipulation a top concern for governments, enterprises, and critical infrastructure organizations worldwide.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SmartTube Android TV App Breached via Supply Chain: Malicious Update Hits Users
Entertainment/Movie Production10 months ago

SmartTube Android TV App Breached via Supply Chain: Malicious Update Hits Users

In April 2024, the widely used open-source SmartTube YouTube client for Android TV suffered a significant supply chain attack when a malicious actor obtained the developer's signing keys. This access enabled the attacker to publish a trojanized version of the app as a seemingly legitimate update, which was downloaded by users through both official and unofficial channels. The compromise jeopardized user devices as the malicious update could facilitate data theft and other unauthorized activities, threatening the integrity of the SmartTube ecosystem and user trust in third-party app marketplaces. This breach exemplifies the increasing risk of supply chain attacks targeting open-source software and underscores the ongoing challenges around secure code signing and software distribution. As organizations and individuals increasingly depend on third-party applications, the incident highlights the urgent need for stronger controls and detection capabilities to protect software supply chains.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
OpenAI’s Sora 2 Release Fuels New Deepfake Security Risks in 2024
Broadcast Media10 months ago

OpenAI’s Sora 2 Release Fuels New Deepfake Security Risks in 2024

In late 2024, OpenAI released Sora 2, a powerful AI-powered video generation model, without the robust guardrails needed to prevent deepfake abuse. Within weeks, numerous instances emerged of Sora 2 being used to create convincing disinformation, impersonate public figures, and generate unmoderated content, despite minimal or easily removable watermarking. The lack of initial safeguards—such as restrictions on political figures or copyrighted content—and insufficient content provenance led to viral circulation of malicious deepfakes and nonconsensual depictions, raising significant operational, reputational, and regulatory risks for both OpenAI and affected individuals. This incident highlights a critical phase in AI/ML risk management: rapid technology advancement is outpacing the establishment and enforcement of ethical and technical controls. Growing regulatory and societal scrutiny underscores the need for defensible guardrails, provenance tracking, and collaborative risk governance to address the threats posed by generative AI deepfakes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Nikkei Data Breach: Slack Compromise Exposes Employee and Partner Information in 2024
Newspapers/Journalism10 months ago

Nikkei Data Breach: Slack Compromise Exposes Employee and Partner Information in 2024

In early June 2024, Japanese media conglomerate Nikkei disclosed a cybersecurity breach involving the unauthorized compromise of its Slack workspace. Attackers gained access to Slack accounts and chat histories, potentially exposing sensitive information belonging to thousands of employees and business partners. The incident is believed to have occurred via stolen Slack credentials, granting threat actors access to business communications and personal data. Nikkei swiftly launched an investigation, engaged incident response expertise, and notified affected individuals while reporting the matter to regulatory authorities. This attack highlights the continuing risk of platform-based credential compromises affecting collaboration tools. The frequency of SaaS-targeted breaches is growing, underlining the urgent need for robust identity, access management, and segmentation controls on corporate communication channels.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Nikkei’s 2024 Slack Breach: How 17,000 Identities Were Compromised
Broadcast Media10 months ago

Nikkei’s 2024 Slack Breach: How 17,000 Identities Were Compromised

In early June 2024, Japanese media giant Nikkei disclosed a significant data breach after its Slack messaging platform was compromised, exposing the personal information of more than 17,000 employees and business partners. Attackers gained unauthorized access to sensitive data such as names, email addresses, and potentially other details linked through Slack integration, by exploiting the company’s internal communications environment. The breach’s impact is broad, affecting both staff and partners, with Nikkei reporting the incident promptly to authorities and commencing investigation and notification processes. This incident highlights the growing risks posed by attacks on SaaS collaboration platforms like Slack, as organizations increasingly rely on these tools for internal and external communication. Threat actors are exploiting identity-based and third-party platform vulnerabilities, underlining the critical need for robust access controls and proactive monitoring of cloud communication systems.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How Memento Labs' ForumTroll Campaign Exploited Chrome Zero-Day with Dante Spyware
Government Administration10 months ago

How Memento Labs' ForumTroll Campaign Exploited Chrome Zero-Day with Dante Spyware

In early 2024, cybersecurity researchers at Kaspersky uncovered an advanced malware campaign, codenamed 'Operation ForumTroll,' targeting Russian government entities, media outlets, financial institutions, and research organizations. The campaign was linked to Memento Labs, the successor to the notorious Italian surveillance company Hacking Team. Leveraging a zero-day vulnerability in Google Chrome, attackers distributed personalized phishing emails which, when clicked, led victims to malicious websites; no further interaction was required to infect devices. The campaign enabled espionage, data exfiltration, and surveillance with high sophistication, including the deployment of a new commercial spyware tool known as 'Dante.' This incident highlights the increasing commercialization and sophistication of spyware operations, the targeting of Russian organizations by state-aligned APTs, and the ongoing exploitation of zero-day vulnerabilities in popular software. It underscores the urgency for organizations to proactively monitor threat activity and patch systems swiftly.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports