The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
MonsterCloud CEO Indicted: The Hidden Costs of Ransomware Recovery Fraud
Zohar Pinhasi, CEO of ransomware recovery firm MonsterCloud, was indicted in October 2026 for allegedly defrauding clients by secretly paying ransomware operators while claiming to use proprietary decryption technology. From June 2018 to June 2023, prosecutors allege Pinhasi facilitated over $8 million in ransom payments while charging victims more than $19 million for recovery services. In documented cases, MonsterCloud charged victims $150,000 after paying attackers $8,200, and $380,000 after paying $236,000 to cybercriminals. The scheme allegedly involved over 300 companies across the United States and Canada. This case highlights the growing sophistication of ransomware ecosystem fraud, where recovery firms exploit victim desperation during crisis situations. As ransomware attacks increase 41% year-over-year and average ransom demands exceed $2 million, the emergence of fraudulent recovery services represents a dangerous secondary victimization trend that organizations must vigilantly avoid.
13 hours ago
Kill Chain
Anthropic's AI Revolution in Cybersecurity: 129,000 Vulnerabilities Discovered Through Claude Models
Anthropic expanded its Cyber Verification Program in October 2026, providing vetted cybersecurity professionals with reduced-safeguard access to advanced AI models including Claude Opus 5.5 and Claude Sonnet 5.5. The company's Project Glasswing initiative discovered 129,000 verified software vulnerabilities between April and July 2026, with over 33,000 rated as critical or high-severity. The program offers three access tiers - Defense Access, Red Team Access, and Specialized Access - each with varying levels of safeguards removal for legitimate security testing and research purposes. This development highlights the growing intersection of AI capabilities and cybersecurity operations, as organizations increasingly leverage artificial intelligence for both defensive vulnerability discovery and offensive security testing. The dual-use nature of these AI tools underscores the need for careful access controls while democratizing advanced cybersecurity capabilities.
20 hours ago
Kill Chain
Sophisticated Linux Backdoors Target Email Security Infrastructure in Asia-Pacific Cyber Espionage Campaign
In October 2026, sophisticated Linux backdoors targeting telecom and network appliances in South Korea and Taiwan were discovered masquerading as legitimate email security products including SpamSniper and ShareTech. The campaign, linked to China-nexus threat groups including Red Menshen, deployed new variants of BPFDoor and a previously unreported implant called AVERAT. These backdoors used advanced evasion techniques including Berkeley Packet Filter abuse, SMTP-based command and control, and process spoofing to blend into enterprise environments while maintaining persistent access to critical network infrastructure. This incident highlights the evolving sophistication of nation-state actors who are adapting their malware to evade detection following public security disclosures. The targeting of email security gateways and telecom infrastructure demonstrates a strategic shift toward compromising trusted security tools themselves, making detection significantly more challenging for defenders.
1 day ago
Kill Chain
BigDiskBuster: The Stealth Attack That Silently Disarms Microsoft Defender
In October 2026, security researcher Abdelhamid Naceri (MSNightmare) released a proof-of-concept technique called 'BigDiskBuster' that prevents Microsoft Defender from receiving security updates without exploiting any vulnerabilities. The technique monitors Defender update activity and creates hidden files that consume all available disk space when updates begin, causing silent update failures while leaving the antivirus service running normally. LevelBlue researchers successfully reproduced the attack, demonstrating how it creates a 'silent detection gap' where Defender appears healthy but becomes increasingly vulnerable to new threats as its signature database becomes outdated. This incident highlights the growing sophistication of EDR evasion techniques and the critical need for organizations to monitor not just whether security tools are running, but whether they're receiving current threat intelligence updates.
1 day ago
Kill Chain
Google's PageBreak AI Discovers 500 Critical Web App Vulnerabilities
Google's internal AI security agent PageBreak discovered over 500 cross-site scripting (XSS) vulnerabilities in the company's own web applications throughout 2026. The AI-powered tool, developed by Google's Product Security team, uses autonomous vulnerability discovery combined with deterministic validation to minimize false positives. PageBreak identified critical flaws including cache poisoning in apis.google.com, XSS in admin.google.com, and insecure external handshakes in browser extensions, all of which have been remediated. This incident highlights the growing trend of organizations using AI for offensive security testing and the critical importance of continuous security validation in enterprise applications, especially as AI-driven development accelerates and attack surfaces expand.
1 day ago
Kill Chain
Apple iOS Automatic Reboot Security Bypass: GrayKey Preserve Vulnerability Analysis
In late 2024, Magnet Forensics disclosed a vulnerability in Apple's iOS automatic reboot security feature through their GrayKey Preserve device and Evidence Preservation Mode. This exploit bypasses the 72-hour inactivity reboot mechanism that transitions iPhones into a more secure state, allowing forensic tools to maintain persistent access to device data indefinitely. The vulnerability affects iPhone's critical security boundary between Before First Unlock (BFU) and After First Unlock (AFU) states, potentially exposing sensitive user data including cached locations, recently deleted photos, and iMessages that would normally be purged after specific timeframes. This incident highlights the growing sophistication of mobile device exploitation techniques and the ongoing cat-and-mouse game between security researchers, law enforcement forensic capabilities, and privacy protections built into consumer devices.
1 day ago
Kill Chain
AI Agents Target South Korean Banks: The ARTEX AI Breach That Changed Everything
In October 2026, South Korea's Financial Services Commission launched emergency investigations after AI-powered cyberattacks targeted multiple major financial institutions. Shinhan Bank suffered a breach affecting 25,000 customers, while Kookmin Bank lost credit card information for 119,000 clients, and Hana Bank experienced a limited compromise of its sales-support system. Evidence suggests attackers used ARTEX AI, an open-source penetration testing framework that automates vulnerability discovery and attack-path planning, marking one of the first confirmed uses of AI agents in large-scale financial sector breaches. This incident represents a critical inflection point as threat actors begin weaponizing AI automation tools for sophisticated attacks against high-value targets. The use of autonomous AI agents for reconnaissance and exploitation signals a new era of accelerated, intelligent cyber warfare that traditional security controls struggle to counter.
2 days ago
Kill Chain
Critical Rejetto HFS Vulnerability Under Active Exploitation by China-Based Threat Actors
In October 2026, threat actors began actively exploiting CVE-2026-61500, a critical vulnerability in Rejetto HTTP File Server (HFS) versions 3.0.0 through 3.2.0. The flaw stems from weak pseudo-random number generation using JavaScript's Math.random() for session cookie signing keys, enabling attackers to forge administrator sessions and achieve remote code execution. VulnCheck detected exploitation attempts by China-based threat actors targeting vulnerable U.S. systems just one day after proof-of-concept code was publicly released. Despite a patch being available since July 2026 in version 3.2.1, many organizations remain vulnerable due to delayed patching cycles. This incident highlights the growing sophistication of vulnerability research, as the flaw was originally discovered using Anthropic's Mythos AI model, demonstrating how artificial intelligence is accelerating both defensive research and offensive capabilities in cybersecurity.
2 days ago
Kill Chain
DShield Honeypot Intelligence Exposes Massive SSH Botnet Campaign
The SANS DShield honeypot network has captured extensive TTY logs revealing coordinated botnet activities targeting SSH services across the internet. Analysis of transaction ID f904275333aeac48d7df6cf53fe5fb9212c7d132a7d37253d2ab9321ba2690d8 shows over 3,130 unique IP addresses executing identical crontab commands over a 90-day period, indicating a widespread automated attack campaign. These attacks demonstrate sophisticated credential stuffing and brute force techniques against SSH services, with attackers immediately attempting to establish persistence through scheduled tasks and lateral movement capabilities once gaining access to compromised systems. This research highlights the critical importance of SSH security as threat actors increasingly automate their initial access operations and demonstrate consistent post-compromise behaviors across diverse infrastructure targets.
2 days ago
Kill Chain
Iranian Water System Attacks Expose Critical U.S. Infrastructure Vulnerabilities
In summer 2024, Iranian threat actors successfully compromised water infrastructure systems across 12 U.S. states, exploiting critical vulnerabilities in industrial control systems. The attackers primarily targeted exposed operational technology devices connected directly to the internet without proper network segmentation or access controls. This campaign demonstrated how 80% of U.S. water systems lack basic cyber hygiene, allowing adversaries to gain unauthorized access to critical infrastructure that serves millions of Americans. The incidents highlighted the fragmented nature of water sector cybersecurity, where approximately 49,000 systems operate with minimal federal oversight and insufficient technical defenses. This attack represents a escalating trend of nation-state actors specifically targeting U.S. critical infrastructure, following similar campaigns by China's Volt Typhoon group. The timing coincides with growing concerns about AI-enhanced cyber capabilities and the urgent need for comprehensive federal cybersecurity standards across water utilities.
2 days ago
Kill Chain
RemoteThreat Launches AI-Powered Red Team Platform to Counter Frontier AI Threats
RemoteThreat, a new offensive cybersecurity startup founded by Chris Thompson and Shawn Jones, emerged from stealth in 2025 with $7 million in pre-seed funding to revolutionize red team penetration testing. The platform leverages AI to help organizations test their defenses against increasingly sophisticated threats, moving beyond traditional three-week assessment models to provide scalable, real-time security validation. RemoteThreat builds custom tooling from scratch for each engagement, bypassing Tier 1 EDR solutions to simulate how nation-state actors and advanced ransomware groups operate in real environments. This development reflects the urgent evolution of offensive security testing as frontier AI models enable both defenders and attackers to operate at unprecedented speed and sophistication, fundamentally changing how organizations must approach cybersecurity validation.
4 days ago
Kill Chain
Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security
In October 2026, threat actors compromised Microsoft's official X account, which has over 13 million followers, to execute a cryptocurrency pump-and-dump scheme promoting a fraudulent $Clippy token. The attackers hijacked the account to follow and repost content from impersonation accounts claiming the token had liquidity paired with Microsoft stock. Microsoft confirmed the unauthorized access, removed the malicious posts, secured the account, and disavowed any connection to cryptocurrency projects while threatening legal action against the perpetrators. This incident highlights the escalating trend of social media account takeovers targeting high-profile organizations for cryptocurrency fraud, following similar attacks on Microsoft India's account and the SEC's official X account that manipulated Bitcoin prices.
5 days ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports