Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Hardware

Breach intelligence, attack campaigns, and threat reports targeting the Computer Hardware sector.

52 threat reports
Page 1 of 5
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Hardware Threat Reports

Showing 1–12 / 52 reports
Inside the CryptoBilis Hardware Implant: How Attackers Turned Trusted Crypto Wallets Into Cellular Spies
Inside the CryptoBilis Hardware Implant: How Attackers Turned Trusted Crypto Wallets Into Cellular Spies
Financial Services1 week ago

Inside the CryptoBilis Hardware Implant: How Attackers Turned Trusted Crypto Wallets Into Cellular Spies

In October 2026, Trezor issued an urgent warning after a customer in Indonesia reported discovering an unauthorized circuit board inside a Trezor Safe 5 hardware wallet purchased from authorized Southeast Asian reseller CryptoBilis via the Tokopedia marketplace. The implanted board, positioned between the device's main board and screen, contained a cellular module and antenna capable of reading and transmitting the wallet's recovery phrase over a mobile network whenever the device was powered. Trezor revoked CryptoBilis's reseller status on October 9 and advised all buyers since March 2026 to immediately transfer funds to a newly seeded wallet, as restoring the old seed phrase on a clean device provides no protection if the phrase was already exfiltrated. This incident follows a parallel hardware-implant discovery in Ledger wallets sourced from the same reseller, prompting a Singapore Police advisory and active criminal investigations. This supply-chain hardware implant attack represents a critical escalation in cryptocurrency theft tactics, moving beyond software exploits and phishing to physical interdiction of trusted devices before they reach end users. With multiple wallet brands and retail channels implicated across Southeast Asia, the campaign signals a sophisticated, organized threat actor willing to invest in hardware-level compromise—a trend that raises the security bar for any organization relying on hardware roots of trust.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Keystone's Verification Key Stolen: Why 18,835 Hardware Wallets Must Be Destroyed
Keystone's Verification Key Stolen: Why 18,835 Hardware Wallets Must Be Destroyed
Financial Services1 week ago

Keystone's Verification Key Stolen: Why 18,835 Hardware Wallets Must Be Destroyed

In October 2026, Keystone disclosed that an attacker compromised the company's website infrastructure and stole the cryptographic device-verification key used to authenticate the genuineness of its hardware wallets. With that key, adversaries could manufacture counterfeit Keystone devices that pass the official online authenticity check, exposing buyers to complete loss of cryptocurrency holdings. Keystone responded by announcing the planned destruction of all 18,835 affected units and initiating a key-rotation and re-issuance program. No on-device seed phrases or private keys were directly exfiltrated in the incident, limiting immediate financial harm to future purchasers rather than existing owners. This incident illustrates the expanding attack surface of hardware supply chains in the cryptocurrency sector. As nation-state and financially motivated actors increasingly target code-signing infrastructure, firmware-signing keys, and device-attestation mechanisms, organizations across fintech and critical hardware verticals face mounting pressure to adopt hardware-rooted trust models, air-gapped key management, and continuous supply-chain integrity monitoring.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps
Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps
Financial Services3 weeks ago

Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps

In October 2026, Ledger discovered a sophisticated supply-chain attack targeting its cryptocurrency hardware wallets sold through Southeast Asian reseller CryptoBilis. Attackers implanted microcontrollers into devices that intercepted 24-word recovery phrases and transmitted them via LTE using provisioned eSIMs, leading to cryptocurrency theft from multiple users. The implants operated independently without modifying Ledger's Secure Element or OS, making them undetectable by standard integrity checks. Ledger responded by halting sales across Southeast Asia and Hong Kong while investigating the breach's full scope. This incident highlights the growing sophistication of supply-chain attacks targeting cryptocurrency infrastructure, occurring amid increased regulatory scrutiny and the rising adoption of hardware wallets by institutional investors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Sophisticated Spy Chip Implants Compromise Ledger Hardware Wallets in Supply Chain Attack
Sophisticated Spy Chip Implants Compromise Ledger Hardware Wallets in Supply Chain Attack
Financial Services3 weeks ago

Sophisticated Spy Chip Implants Compromise Ledger Hardware Wallets in Supply Chain Attack

In October 2026, Ledger confirmed that hardware wallets distributed through Southeast Asian reseller CryptoBilis contained malicious spy chip implants designed to steal cryptocurrency. The sophisticated supply chain attack involved physically modifying Ledger Nano X devices with custom PCB implants that captured seed phrases through display output and button press monitoring, then transmitted the data via embedded eSIM and LTE connectivity. Researchers identified two variants of the implant, with the more advanced version fitting into the original form factor without obvious external indicators. The compromised devices were sold at discounted prices across Malaysia and other Southeast Asian markets, resulting in confirmed fund drains from affected users' wallets. This incident highlights the growing sophistication of hardware supply chain attacks targeting cryptocurrency infrastructure, demonstrating how threat actors are evolving from basic firmware modifications to engineered PCB implants that can bypass traditional security validations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ledger Supply Chain Attack: How $86M Was Stolen Through Hardware Implants
Ledger Supply Chain Attack: How $86M Was Stolen Through Hardware Implants
Financial Services3 weeks ago

Ledger Supply Chain Attack: How $86M Was Stolen Through Hardware Implants

In October 2026, cryptocurrency hardware wallet manufacturer Ledger discovered unauthorized hardware implants in devices sold through Southeast Asian reseller CryptoBilis, resulting in over $86 million in stolen funds from affected users. The supply chain attack involved tampering with legitimate Ledger devices before they reached customers, with malicious hardware modifications enabling attackers to compromise cryptocurrency wallets during setup. Ledger immediately suspended sales through CryptoBilis and advised users who purchased devices in the prior 90 days to migrate assets to new hardware with fresh seed phrases. The incident highlights the critical vulnerability of hardware supply chains in the cryptocurrency ecosystem, where a single compromised reseller can facilitate massive theft through pre-compromised devices that appear legitimate but contain hidden malicious components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Advantest Ransomware Attack Exposes Critical Gaps in Semiconductor Supply Chain Security
Advantest Ransomware Attack Exposes Critical Gaps in Semiconductor Supply Chain Security
Semiconductors1 month ago

Advantest Ransomware Attack Exposes Critical Gaps in Semiconductor Supply Chain Security

In February 2026, Advantest Corporation, a leading Japanese semiconductor test equipment manufacturer, suffered a ransomware attack that compromised sensitive personal information of individuals. Threat actors gained unauthorized access to company systems, deployed ransomware, and exfiltrated data containing contact information, Social Security numbers, driver's licenses, passport numbers, medical information, and financial data. The company took eight months to confirm the data breach, notifying affected individuals in October 2026 and offering 18-month identity monitoring services through Kroll. This incident highlights the continuing evolution of ransomware groups targeting critical semiconductor supply chain companies, exploiting the industry's increasing digitization and interconnected manufacturing processes that are vital to global technology infrastructure.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Trezor Supply Chain Attack: When Legitimate Email Infrastructure Becomes a Weapon
Trezor Supply Chain Attack: When Legitimate Email Infrastructure Becomes a Weapon
Financial Services1 month ago

Trezor Supply Chain Attack: When Legitimate Email Infrastructure Becomes a Weapon

In September 2026, cryptocurrency hardware wallet maker Trezor warned customers that threat actors had breached its third-party email provider and were conducting sophisticated phishing attacks. The attackers sent fake "critical security alert" emails from help@trezor.io, claiming a hardware microcontroller vulnerability in STM32 chips could expose wallet seeds to brute-force attacks. This incident followed a previous breach of Trezor's shipping provider ShipMonk in August 2026, which compromised data from 81,000 customers across multiple countries. The ShipMonk breach exploited a critical SQL injection zero-day vulnerability in the Metabase analytics platform, with the ShinyHunters extortion gang subsequently targeting the company. This incident highlights the growing trend of supply chain attacks targeting cryptocurrency platforms and the increasing sophistication of phishing campaigns that leverage compromised legitimate infrastructure to bypass security controls and user awareness training.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ShineyHunters Exploit Zero-Day to Breach Trezor's Shipping Partner
ShineyHunters Exploit Zero-Day to Breach Trezor's Shipping Partner
Computer Hardware2 months ago

ShineyHunters Exploit Zero-Day to Breach Trezor's Shipping Partner

In August 2026, hardware wallet manufacturer Trezor disclosed that 67,000 U.S. customers had their personal data exposed through a breach at shipping provider ShipMonk. The ShineyHunters extortion gang exploited CVE-2026-72898, a critical SQL injection vulnerability in Metabase with a CVSS score of 10.0, to gain unauthorized access to ShipMonk's systems. The exposed data included customer names, email addresses, phone numbers, shipping addresses, and order numbers from November 2019 to August 2021, despite Trezor's repeated requests for data deletion per their 90-day retention policy. This supply chain attack highlights how third-party vulnerabilities can impact customer data even when primary security measures are robust. This incident demonstrates the growing threat of supply chain compromises targeting logistics and fulfillment providers, with attackers increasingly exploiting zero-day vulnerabilities in business intelligence platforms to access customer databases across multiple organizations simultaneously.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
GPUThor Rowhammer Attack Bypasses NVIDIA GPU Security in 2026 Breakthrough
Computer Hardware2 months ago

GPUThor Rowhammer Attack Bypasses NVIDIA GPU Security in 2026 Breakthrough

In August 2026, University of Toronto researchers disclosed GPUThor, a sophisticated Rowhammer attack targeting NVIDIA workstation GPUs with GDDR6 memory that defeats error correction codes (ECC). The attack impacts RTX A6000, A5000, A4500, and A4000 models, enabling attackers to achieve denial-of-service conditions and privilege escalation to root access on host systems. GPUThor uses non-uniform hammering techniques to generate up to 377,000 bit flips per gigabyte, vastly exceeding previous GPU Rowhammer attacks and successfully bypassing NVIDIA's recommended ECC mitigation through multi-bit corruption exploitation. This hardware vulnerability represents a significant evolution in GPU-based attacks as organizations increasingly rely on shared GPU infrastructure for AI workloads and cloud computing. The attack highlights critical security gaps in hardware-level protections and the growing attack surface presented by specialized computing hardware in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
GPUThor Rowhammer Attack Defeats NVIDIA ECC Protection in AI Infrastructure
Card image — GPUThor Rowhammer Attack Defeats NVIDIA ECC Protection in AI Infrastructure
Computer Hardware2 months ago

GPUThor Rowhammer Attack Defeats NVIDIA ECC Protection in AI Infrastructure

University of Toronto researchers disclosed GPUThor, a sophisticated Rowhammer attack that bypasses NVIDIA's Error-Correcting Code (ECC) protections on Ampere-class workstation GPUs including RTX A4000, A4500, A5000, and A6000 models. The attack exploits undocumented GPU behaviors to avoid Target Row Refresh mitigations, achieving bit-flip rates up to 377,000 flips per GB and enabling denial-of-service conditions and root-level privilege escalation within 1.1 minutes. GPUThor demonstrates 4,548 to 23,597 times higher effectiveness than previous GPU Rowhammer attacks, posing significant risks to AI infrastructure and cloud environments relying on these widely deployed GPU models for machine learning workloads. This vulnerability highlights the growing sophistication of hardware-level attacks targeting AI infrastructure as organizations increasingly depend on GPU-accelerated computing for critical business operations and model training.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Unisoc Modem Vulnerability: Millions of Android Devices at Risk
Telecommunications2 months ago

Unisoc Modem Vulnerability: Millions of Android Devices at Risk

In August 2026, researchers at SSD Secure Disclosure identified a critical security vulnerability in Unisoc's T612 modem firmware. By chaining a previously disclosed remote code execution (RCE) flaw with a newly discovered memory isolation weakness, attackers can gain privileged access to the Android kernel on affected devices. The exploit involves delivering a malicious payload to the modem and then initiating a video call, which the victim must answer to trigger the attack. This vulnerability impacts devices from manufacturers such as Realme, Xiaomi, and Motorola, leaving millions of users at risk. The significance of this discovery lies in the increasing prevalence of sophisticated attack chains targeting mobile devices. As threat actors continue to exploit firmware-level vulnerabilities, it underscores the necessity for robust security measures and timely firmware updates to protect user data and device integrity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Trezor Data Breach 2026: Lessons in Supply Chain Security
Computer Hardware2 months ago

Trezor Data Breach 2026: Lessons in Supply Chain Security

In August 2026, Trezor, a leading cryptocurrency hardware wallet manufacturer, disclosed a data breach affecting nearly 14,000 customers. The breach occurred through their shipping and logistics provider, ShipMonk, whose systems were compromised via a vulnerability in the third-party analytics platform Metabase. This incident exposed customers' full names, shipping addresses, email addresses, and phone numbers. Trezor's internal systems and devices remained secure, but the exposed personal information heightened the risk of targeted phishing attacks against affected individuals. This breach underscores the critical importance of securing third-party service providers, as vulnerabilities in external platforms can directly impact primary organizations and their customers. The incident also highlights the evolving tactics of cybercriminals, who exploit supply chain weaknesses to access sensitive data, emphasizing the need for comprehensive security measures across all operational facets.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports