The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Computer Hardware
Breach intelligence, attack campaigns, and threat reports targeting the Computer Hardware sector.
Explore Other Sectors
Computer Hardware Threat Reports
CPUID's 2026 Supply Chain Breach: A Wake-Up Call for Software Security
In April 2026, CPUID's website was compromised through a secondary API, leading to the distribution of trojanized versions of CPU-Z and HWMonitor. For approximately six hours between April 9 and April 10, attackers altered download links to serve malicious executables, exposing millions of users to potential malware infections. The malicious files, notably named HWiNFO_Monitor_Setup.exe, utilized advanced evasion techniques, including multi-stage, in-memory execution and NTDLL proxying from a .NET assembly, to bypass detection by endpoint detection and response (EDR) systems and antivirus software. CPUID has since identified and rectified the breach, confirming that their original signed binaries remained uncompromised. This incident underscores the escalating threat of supply chain attacks targeting widely used utilities. The attackers' sophisticated methods highlight the need for enhanced vigilance and robust security measures in software distribution channels. Organizations must prioritize the integrity of their software supply chains to prevent similar breaches and protect end-users from malicious software distribution.
5 months ago
Kill Chain
GPUBreach 2026: Unveiling the Latest NVIDIA GPU Rowhammer Attack
In April 2026, researchers from the University of Toronto unveiled 'GPUBreach,' a sophisticated attack leveraging Rowhammer techniques on NVIDIA GPUs equipped with GDDR6 memory. This method enables unprivileged CUDA kernels to induce bit-flips in GPU page tables, granting arbitrary GPU memory access. Exploiting vulnerabilities in NVIDIA drivers, attackers can escalate privileges to achieve full system compromise, even with Input-Output Memory Management Unit (IOMMU) protections active. The attack was demonstrated on NVIDIA RTX A6000 GPUs, commonly used in AI development and training workloads. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-gpubreach-attack-enables-system-takeover-via-gpu-rowhammer/?utm_source=openai)) The emergence of GPUBreach underscores a significant evolution in hardware-based attacks, highlighting the necessity for robust hardware security measures. As adversaries increasingly exploit hardware vulnerabilities, organizations must prioritize comprehensive security strategies that encompass both software and hardware components to mitigate such advanced threats.
5 months ago
Kill Chain
Authorities Dismantle SocksEscort Botnet Exploiting 369,000 IPs
In March 2026, an international law enforcement operation dismantled the SocksEscort botnet, which had infected approximately 369,000 residential routers across 163 countries since 2020. The botnet, powered by the AVrecon malware, allowed cybercriminals to route malicious internet traffic through compromised devices, facilitating large-scale fraud and other illicit activities. The operation, codenamed Operation Lightning, resulted in the seizure of 34 domains, 23 servers, and the freezing of $3.5 million in cryptocurrency assets. This takedown underscores the persistent threat posed by botnets leveraging residential devices and highlights the importance of securing home and small business routers against exploitation. The incident serves as a critical reminder for organizations and individuals to regularly update and monitor their network devices to prevent similar compromises.
6 months ago
Kill Chain
CISA Adds Five Known Exploited Vulnerabilities to Catalog
On March 5, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. The vulnerabilities include: CVE-2017-7921 (Hikvision Multiple Products Improper Authentication), CVE-2021-22681 (Rockwell Multiple Products Insufficient Protected Credentials), CVE-2021-30952 (Apple Multiple Products Integer Overflow or Wraparound), CVE-2023-41974 (Apple iOS and iPadOS Use-After-Free), and CVE-2023-43000 (Apple Multiple Products Use-After-Free). These vulnerabilities are commonly targeted by malicious actors and pose significant risks to federal enterprises. The inclusion of these vulnerabilities underscores the persistent threat landscape and the importance of timely remediation. Organizations are urged to prioritize addressing these vulnerabilities to mitigate potential cyberattacks and protect their networks against active threats.
6 months ago
Kill Chain
Critical Command Injection Vulnerability in VMware Aria Operations
In February 2026, a critical command injection vulnerability (CVE-2026-22719) was identified in VMware Aria Operations, allowing unauthenticated attackers to execute arbitrary commands during support-assisted product migrations. This flaw, with a CVSS score of 8.1, could lead to remote code execution and full system compromise. Broadcom released patches and workarounds to address the issue. ([support.broadcom.com](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on March 3, 2026, indicating active exploitation in the wild. Federal agencies are mandated to apply the fixes by March 24, 2026. ([thehackernews.com](https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html?utm_source=openai))
6 months ago
Kill Chain
Android 2026 Security Update Addresses Exploited Qualcomm Zero-Day
In March 2026, Google released a security update addressing 129 vulnerabilities in Android devices, notably including CVE-2026-21385—a high-severity zero-day flaw in Qualcomm's display component. This integer overflow vulnerability allows local attackers to cause memory corruption, potentially leading to unauthorized control over affected devices. The flaw impacts 234 Qualcomm chipsets, and there are indications of its limited, targeted exploitation in the wild. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai)) The active exploitation of CVE-2026-21385 underscores the persistent threat posed by zero-day vulnerabilities in widely used hardware components. Organizations must prioritize timely patch management and maintain robust security protocols to mitigate risks associated with such vulnerabilities.
6 months ago
Kill Chain
Advantest 2026 Ransomware Attack: A Wake-Up Call for Semiconductor Cybersecurity
In February 2026, Advantest Corporation, a leading Japanese semiconductor test equipment manufacturer, detected unauthorized access within its IT environment, indicating a ransomware attack. The company promptly activated incident response protocols, isolated affected systems, and engaged third-party cybersecurity experts to investigate and contain the incident. Preliminary findings suggest that an unauthorized third party may have gained access to portions of the company's network and deployed ransomware. The full extent of the impact, including potential compromise of customer or employee data, is under active investigation. ([advantest.com](https://www.advantest.com/en/news/2026/20260219.html?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting critical infrastructure within the semiconductor industry. As adversaries increasingly focus on high-value targets, organizations must enhance their cybersecurity measures to protect sensitive data and maintain operational continuity.
7 months ago
Kill Chain
Chinese APT Exploits Dell RecoverPoint Zero-Day Since 2024
In mid-2024, a Chinese state-sponsored threat group, identified as UNC6201, began exploiting a critical zero-day vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines. This flaw, stemming from hardcoded credentials, allowed unauthenticated remote attackers to gain root-level access to affected systems. The attackers utilized this access to deploy backdoors such as BRICKSTORM and later GRIMBOLT, facilitating persistent access and lateral movement within compromised networks. Dell released a patch for this vulnerability in February 2026, urging immediate remediation to prevent further exploitation. ([securityweek.com](https://www.securityweek.com/dell-recoverpoint-zero-day-exploited-by-chinese-cyberespionage-group/?utm_source=openai)) This incident underscores the persistent threat posed by nation-state actors targeting critical infrastructure through zero-day vulnerabilities. The prolonged undetected exploitation highlights the necessity for robust monitoring and rapid response mechanisms to mitigate such sophisticated cyber threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-dell-zero-day-flaw-since-mid-2024/?utm_source=openai))
7 months ago
Kill Chain
Chinese Hackers Exploit Dell Zero-Day Vulnerability in 2024
In mid-2024, the Chinese state-sponsored hacking group UNC6201 began exploiting a critical vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines, a solution integral to VMware virtual machine backup and recovery. This hardcoded credential flaw allowed unauthenticated remote attackers to gain unauthorized access to the underlying operating system, achieving root-level persistence. Once inside, UNC6201 deployed advanced malware, including the Grimbolt backdoor, and utilized novel techniques like creating hidden network interfaces ('Ghost NICs') on VMware ESXi servers to move stealthily across networks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinese-hackers-exploiting-dell-zero-day-flaw-since-mid-2024/?utm_source=openai))This incident underscores the persistent threat posed by state-sponsored actors targeting critical infrastructure through zero-day vulnerabilities. The exploitation of such flaws highlights the necessity for organizations to maintain rigorous patch management and continuous monitoring to detect and mitigate sophisticated cyber threats.
7 months ago
Kill Chain
ASUS Live Update Supply Chain Breach: Lessons from a Sophisticated APT Attack
In 2018, ASUS suffered a major supply chain compromise in which attackers, believed to be a state-linked APT group, infiltrated the ASUS Live Update utility and distributed a malicious software update to potentially hundreds of thousands of users. The attackers inserted a sophisticated backdoor into the official ASUS update, enabling targeted compromise of devices based on specific MAC addresses. Although the vulnerability (CVE-2025-59374) has only been formally cataloged recently, the incident itself occurred years ago, impacting trust in widely used supply chain components. This breach remains relevant due to the ongoing risk of similar supply chain tactics by advanced threat actors and the late inclusion of legacy vulnerabilities in compliance and threat feeds. Security leaders must recognize that historic supply chain compromises may resurface in compliance audits or be exploited in future campaigns through neglected, end-of-life software.
8 months ago
Kill Chain
Critical 2025 UEFI Flaw Enables Pre-Boot DMA Attacks on Leading Motherboards
In December 2025, researchers from Riot Games identified a critical UEFI firmware vulnerability impacting motherboards from ASUS, Gigabyte, MSI, and ASRock. The flaw, tracked as CVE-2025-11901, CVE-2025‑14302, CVE-2025-14303, and CVE-2025-14304, allows Direct Memory Access (DMA) attacks during the pre-boot phase by bypassing IOMMU protections. Threat actors with physical access can attach malicious PCIe devices to read or alter system memory before the operating system loads, making traditional endpoint protections ineffective. The vulnerability was confirmed by multiple security advisories and coordinated with hardware vendors for urgent firmware updates. This incident highlights the increasing sophistication of firmware-level attacks that can evade operating system and security tool visibility. As hardware supply chains diversify and attackers target pre-boot processes, organizations face heightened risks in both enterprise and consumer hardware ecosystems.
8 months ago
Kill Chain
UEFI Firmware Vulnerability Leaves Major Motherboards Open to Early-Boot DMA Attacks
In December 2025, researchers disclosed a critical hardware/firmware vulnerability impacting various ASRock, ASUS, GIGABYTE, and MSI motherboards. The flaw allows threat actors to launch direct memory access (DMA) attacks during the early boot process, bypassing typical Unified Extensible Firmware Interface (UEFI) and Input–Output Memory Management Unit (IOMMU) protections. Attackers can exploit this window to inject code or access sensitive memory before system defenses activate. The incident exposes endpoints to risk of credential theft, persistent malware implants, and lateral movement, with potential compromise of high-value IT and OT assets. This incident is highly relevant as firmware attacks and supply chain risks escalate, especially with the push towards Zero Trust security architectures. Hardware-level exposures pose challenges that traditional endpoint or network controls may not immediately mitigate, requiring urgent attention to firmware security and early-boot exploit detection.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports