Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Business Supplies/Equipment

Breach intelligence, attack campaigns, and threat reports targeting the Business Supplies/Equipment sector.

6 threat reports
Page 1 of 1
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Business Supplies/Equipment Threat Reports

Showing 1–6 / 6 reports
Wesco International's 2026 Data Breach: A Case Study in Cloud Security
Business Supplies/Equipment2 months ago

Wesco International's 2026 Data Breach: A Case Study in Cloud Security

In July 2026, Wesco International, a global supply chain and distribution company, experienced a cybersecurity incident involving unauthorized access to its cloud-based Customer Relationship Management (CRM) system. The data extortion group ExfilSquad claimed responsibility, alleging the theft of 2.6 million records containing customer and employee personally identifiable information (PII), account data, CRM user profiles, and authentication metadata. Wesco promptly investigated the incident, collaborating with its cloud CRM vendor, and reported no evidence of ransomware or other malicious software on its IT systems. The company stated that sensitive data, including payment card and financial account information, was not at risk, and business operations remained unaffected. This incident underscores the growing threat posed by data extortion groups like ExfilSquad, which have been linked to multiple high-profile breaches in 2026, including those targeting Analog Devices and the U.K.'s Police National Legal Database. Organizations are increasingly vulnerable to attacks exploiting misconfigured cloud services and inadequate access controls, highlighting the urgent need for robust cybersecurity measures and vigilant monitoring of cloud environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Zapier Exploit Chain Reveals Critical Cloud Security Vulnerabilities
Computer Software/Engineering5 months ago

Zapier Exploit Chain Reveals Critical Cloud Security Vulnerabilities

In May 2026, researchers from Token Security identified a critical vulnerability in Zapier's platform, demonstrating how a series of misconfigurations and over-permissioned roles could lead to a full platform takeover. The exploit chain began with the ability to execute code within Zapier's 'Code by Zapier' feature, allowing attackers to perform sandbox reconnaissance and extract credentials from memory. This access enabled lateral movement to Zapier's private repositories, where a high-privilege NPM token was discovered, potentially allowing the publication of malicious code to all authenticated users. Zapier promptly addressed the issue by revoking the leaked token and tightening IAM roles, with full remediation confirmed by March 2026. This incident underscores the critical importance of securing cloud integrations and managing permissions effectively. As cloud services become increasingly complex, even minor misconfigurations can be exploited to orchestrate significant breaches, highlighting the need for continuous security assessments and robust access controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Zendesk 2026 Spam Campaign: A Wake-Up Call for Securing Support Systems
Computer Software/Engineering9 months ago

Zendesk 2026 Spam Campaign: A Wake-Up Call for Securing Support Systems

In January 2026, a massive global spam campaign exploited unsecured Zendesk support systems, allowing attackers to flood users' inboxes with automated 'ticket received' emails. By abusing Zendesk instances that permitted unverified users to submit support tickets, attackers generated numerous fake tickets using large email lists. This resulted in victims receiving confirmation emails from legitimate Zendesk domains, enabling the messages to bypass spam filters and inundate users' inboxes. Affected organizations included major companies such as Discord, Tinder, Riot Games, Dropbox, CD Projekt, NordVPN, and various Tennessee state departments. Notably, the spam emails did not contain malware or phishing links but featured bizarre and seemingly pointless messages, such as fake law enforcement takedown requests and promotional offers. Zendesk acknowledged the issue and responded by implementing new safety measures, including enhanced monitoring and stricter activity limits to detect and halt spam efforts more effectively. The campaign began on January 18, 2026, but its current status remains unclear. ([techradar.com](https://www.techradar.com/pro/security/zendesk-tickets-hijacked-in-massive-spam-campaign?utm_source=openai)) This incident underscores the critical importance of securing customer support platforms against abuse. The exploitation of Zendesk's ticketing system highlights a broader trend where attackers leverage legitimate services to conduct spam campaigns, thereby evading traditional security measures. Organizations must proactively assess and fortify their support systems to prevent similar abuses, ensuring that such platforms do not become vectors for large-scale spam or other malicious activities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Jabber Zeus Coder 'MrICQ' Arrested: Lessons from a Banking Trojan Empire
Banking/Mortgage10 months ago

Jabber Zeus Coder 'MrICQ' Arrested: Lessons from a Banking Trojan Empire

In October 2025, U.S. authorities took into custody Yuriy Igorevich Rybtsov, known online as "MrICQ," a key developer for the infamous Jabber Zeus cybercrime group. The group, active between 2009 and 2013, leveraged a custom version of the ZeuS banking trojan to compromise small and mid-sized business accounts, bypass multi-factor authentication, and orchestrate elaborate money-laundering schemes across multiple countries. MrICQ's primary role involved monitoring real-time breaches, facilitating payroll fraud via money mules, and supporting the laundering of illicit gains through electronic exchanges. This arrest follows years of cross-border law enforcement collaboration, building upon indictments and intelligence from forensic chat intercepts and international extraditions. This case highlights the evolving tactics of financially motivated threat actors, especially their capacity to defeat strong authentication and automate large-scale financial theft. The longevity and operational sophistication demonstrated by groups like Jabber Zeus underscore persistent vulnerabilities in online banking and underscore the need for adaptive security controls across sectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Russian APT Attackers Compromise Ukrainian Networks Using Living-Off-the-Land (LOTL) Tactics
Government Administration10 months ago

Russian APT Attackers Compromise Ukrainian Networks Using Living-Off-the-Land (LOTL) Tactics

In mid-2025, Russian advanced persistent threat (APT) actors launched highly targeted campaigns against Ukrainian organizations, focusing on business services firms and local government entities. Over the course of several weeks, attackers gained initial access through stealthy living-off-the-land (LOTL) techniques, leveraging legitimate administrative tools and native Windows utilities to evade detection and persist on networks. Their primary objectives were the exfiltration of sensitive data and establishing long-term, covert access, which allowed the attackers to move laterally with minimal noise and avoid triggering common security alerts. The operational impact included compromise of confidential internal documents and increased risk to ongoing operations. This incident underscores a growing reliance on LOTL tactics by sophisticated nation-state actors, complicating traditional detection and response methods. With geopolitical tensions in Eastern Europe remaining high, organizations and government agencies must anticipate and defend against stealthy, low-profile intrusions that exploit trusted system tools to bypass conventional defenses.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
How Brickstorm Malware Evaded Detection in US Legal & Tech Sectors: A 2025 APT Case Study
Information Technology/IT10 months ago

How Brickstorm Malware Evaded Detection in US Legal & Tech Sectors: A 2025 APT Case Study

In 2025, Google’s Threat Intelligence Group uncovered that the UNC5221 threat actor, suspected to have ties to China, used the Brickstorm malware to conduct stealthy, long-term espionage campaigns against U.S. legal and technology organizations, SaaS providers, and BPOs. The attackers exploited zero-day vulnerabilities in enterprise edge devices lacking EDR protection, establishing persistent access for an average dwell time of over a year. Brickstorm enabled credential theft, lateral movement, and data exfiltration, often targeting email and sensitive code repositories, all while obfuscating forensic traces and regularly changing infrastructure. This incident highlights a growing trend of persistent, supply-chain-oriented APT attacks targeting critical sectors via unmonitored infrastructure. It underscores the importance of timely patching, segmentation, and improved visibility for hybrid and edge environments facing increasing risks from nation-state adversaries.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports