✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Kaspersky Uncovers 26 Fake Crypto Wallet Apps on Apple App Store
In April 2026, Kaspersky identified 26 fraudulent applications on the Apple App Store that impersonated popular cryptocurrency wallets such as MetaMask, Ledger, and Coinbase. These apps redirected users to phishing pages mimicking the App Store, leading to the installation of trojanized wallet applications designed to steal recovery phrases and private keys, thereby draining users' cryptocurrency holdings. The campaign, active since at least fall 2025, is attributed with moderate confidence to the threat actors behind SparkKitty. ([kaspersky.co.uk](https://www.kaspersky.co.uk/about/press-releases/kaspersky-finds-26-fake-crypto-wallet-apps-on-apples-app-store-that-can-drain-digital-assets?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats targeting cryptocurrency users, highlighting the need for heightened vigilance and robust security measures. The exploitation of trusted platforms like the Apple App Store for distributing malicious apps signifies a concerning trend in cybercriminal tactics.
3 months ago
Kill Chain
FIRESTARTER Backdoor: A Persistent Threat to Cisco Firepower Devices
In September 2025, a U.S. federal civilian agency's Cisco Firepower device running Adaptive Security Appliance (ASA) software was compromised by the FIRESTARTER backdoor. This malware exploited vulnerabilities CVE-2025-20333 and CVE-2025-20362 to gain initial access, allowing threat actors to maintain persistent control over the device. Notably, FIRESTARTER's persistence mechanism enabled it to survive firmware updates and device reboots, rendering standard patching ineffective. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/firestarter-malware-survives-cisco-firewall-updates-security-patches/?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats targeting critical infrastructure. The ability of malware like FIRESTARTER to persist post-patching highlights the necessity for organizations to implement comprehensive security measures beyond regular updates, including continuous monitoring and advanced threat detection capabilities.
3 months ago
Kill Chain
Defending Against China-Nexus Covert Networks of Compromised Devices
In April 2026, a joint advisory from the National Cyber Security Centre (NCSC) and 15 international partners highlighted a significant shift in tactics by China-nexus cyber actors. These actors have transitioned from using individually procured infrastructure to operating large-scale 'covert networks'—botnets composed of compromised routers and other edge devices. These networks are utilized across all phases of the cyber kill chain, including reconnaissance, malware delivery, command and control, and data exfiltration, posing a substantial threat to organizations worldwide. The advisory underscores the dynamic and low-cost nature of these covert networks, which can be rapidly reshaped, rendering traditional static IP block lists ineffective. Organizations are urged to adopt adaptive, intelligence-driven measures to mitigate the risks associated with these evolving threats.
3 months ago
Kill Chain
CISA Adds CVE-2026-33825 to Known Exploited Vulnerabilities Catalog
In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33825 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting active exploitation of a privilege escalation flaw in Microsoft Defender. This vulnerability, known as 'BlueHammer,' allows attackers with limited local access to escalate privileges to SYSTEM level due to insufficient access control granularity. The flaw was publicly disclosed by a researcher named 'Chaotic Eclipse' after dissatisfaction with Microsoft's vulnerability disclosure process, leading to the release of exploit details online. ([techradar.com](https://www.techradar.com/pro/security/cisa-puts-us-government-agencies-on-two-week-deadline-to-patch-microsoft-defender-bluehammer-zero-day-exploit?utm_source=openai)) The inclusion of CVE-2026-33825 in the KEV catalog underscores the critical nature of this vulnerability and the urgency for organizations to apply patches. CISA has mandated that Federal Civilian Executive Branch agencies remediate this vulnerability by May 6, 2026, to mitigate the risk of active exploitation. ([techradar.com](https://www.techradar.com/pro/security/cisa-puts-us-government-agencies-on-two-week-deadline-to-patch-microsoft-defender-bluehammer-zero-day-exploit?utm_source=openai))
3 months ago
Kill Chain
Itron Reports Cybersecurity Breach in Internal Systems
In April 2026, Itron, Inc., a leading utility technology company, disclosed a cybersecurity incident where an unauthorized third party accessed certain internal systems. Upon detection on April 13, 2026, Itron activated its cybersecurity response plan, engaged external advisors, and notified law enforcement. The company successfully contained the unauthorized activity, with no observed follow-up incidents. Importantly, customer-hosted systems remained unaffected, and business operations continued without material disruption. Itron anticipates that a significant portion of the incident-related costs will be reimbursed by insurance. ([sec.gov](https://www.sec.gov/Archives/edgar/data/780571/000119312526175249/d125229d8k.htm?utm_source=openai)) This incident underscores the persistent threat of cyberattacks targeting critical infrastructure sectors. As utility companies increasingly digitize operations, they become more attractive targets for cyber adversaries. The swift response and containment by Itron highlight the importance of robust cybersecurity measures and incident response plans in mitigating potential impacts on essential services.
3 months ago
Kill Chain
Checkmarx GitHub Repository Data Breach: A Wake-Up Call for CI/CD Security
In March 2026, Checkmarx experienced a significant supply chain attack when threat actors compromised its GitHub repositories, injecting credential-stealing malware into GitHub Actions workflows and Docker images. This breach enabled attackers to harvest sensitive developer credentials and infrastructure secrets. Subsequent investigations revealed that data from Checkmarx's GitHub repository was published on the dark web, though the company maintains that customer data is not stored in these repositories. The incident underscores the critical importance of securing software supply chains against sophisticated attacks targeting development infrastructure. This breach highlights a growing trend of supply chain attacks targeting development tools and repositories, emphasizing the need for organizations to implement robust security measures within their CI/CD pipelines. The incident serves as a stark reminder of the potential cascading effects such compromises can have on downstream users and the broader software ecosystem.
3 months ago
Kill Chain
Claude Mythos: Redefining Vulnerability Discovery in the AI Era
In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying and exploiting thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability has raised significant concerns about the rapid acceleration of vulnerability discovery and the challenges organizations face in timely remediation. The model's restricted release under Project Glasswing aims to mitigate potential misuse, yet unauthorized access incidents have already been reported, highlighting the pressing need for robust security measures. The emergence of AI-driven vulnerability discovery tools like Mythos signifies a paradigm shift in cybersecurity, compressing exploit timelines and necessitating a reevaluation of existing defense strategies. Organizations must adapt to this new landscape by enhancing their vulnerability management processes and investing in proactive security measures to keep pace with the evolving threat environment.
3 months ago
Kill Chain
GlassWorm Malware Resurfaces: 73 OpenVSX Sleeper Extensions Compromise Developer Security
In April 2026, the GlassWorm malware campaign resurfaced, targeting the OpenVSX ecosystem with 73 'sleeper' extensions. Initially benign, these extensions were later updated to deliver malicious payloads, compromising developer environments. Six of these extensions have been activated, while the remaining are considered suspicious. This tactic involves cloning legitimate extensions to deceive developers, leading to the theft of sensitive data such as cryptocurrency wallets and credentials. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, highlighting the need for vigilant monitoring of software dependencies. The use of 'sleeper' extensions that activate malicious behavior post-installation represents a sophisticated method to evade initial detection, posing significant risks to software development environments.
3 months ago
Kill Chain
Sentencing in $230M Cryptocurrency Heist Highlights Social Engineering Threats
In April 2026, Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison for laundering at least $3.5 million in stolen cryptocurrency. This was part of a larger criminal enterprise that, between October 2023 and May 2025, stole over $263 million through social engineering tactics, including impersonating customer support to gain access to victims' cryptocurrency wallets. The stolen funds financed extravagant lifestyles, with expenditures on luxury cars, high-end real estate, and lavish parties. ([justice.gov](https://www.justice.gov/usao-dc/pr/california-money-launderer-sentenced-dc-70-months-role-scheme-stole-263-million?utm_source=openai)) This case underscores the growing sophistication of cybercriminals in exploiting social engineering techniques to execute large-scale financial thefts. It highlights the urgent need for enhanced security measures and user education to prevent such attacks, especially as the cryptocurrency market continues to expand and attract both legitimate investors and malicious actors.
3 months ago
Kill Chain
After Mythos: New Playbooks For a Zero-Window Era
In April 2026, Anthropic's AI model, Claude Mythos, autonomously identified thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability led to the formation of Project Glasswing, a collaborative initiative involving tech giants like Apple, Google, and JPMorgan Chase, aiming to patch vulnerabilities faster than AI can discover them. However, unauthorized access to Mythos raised significant security concerns, highlighting the potential risks of such powerful AI tools. ([anthropic.com](https://www.anthropic.com/glasswing?utm_source=openai)) The incident underscores the urgent need for robust security protocols in AI development and deployment. As AI models become more sophisticated, ensuring their secure use is paramount to prevent potential misuse and safeguard critical infrastructure.
3 months ago
Kill Chain
Checkmarx 2026 LAPSUS$ Supply Chain Attack: A Detailed Analysis
In March 2026, application security firm Checkmarx experienced a significant security breach when the LAPSUS$ threat group exploited credentials obtained from the Trivy supply chain attack, attributed to TeamPCP. This access allowed the attackers to infiltrate Checkmarx's GitHub repositories, leading to the publication of malicious code and the subsequent leak of sensitive data. The compromised data, totaling 96GB, was later made available on both dark web and clearnet platforms. Checkmarx has confirmed that the leaked data originated from their GitHub repository and is actively investigating the incident to assess the full scope of the breach. This incident underscores the escalating threat posed by supply chain attacks, where compromising a single component can have cascading effects across multiple organizations. The Checkmarx breach highlights the critical need for robust security measures within development pipelines and the importance of securing third-party tools to prevent unauthorized access and data exfiltration.
3 months ago
Kill Chain
CISA Mandates Immediate Patching of 'BlueHammer' Vulnerability in Microsoft Defender
In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) mandated that U.S. federal agencies patch a critical vulnerability in Microsoft Defender, known as 'BlueHammer' and tracked as CVE-2026-33825. This flaw allows low-privileged local attackers to escalate their privileges to SYSTEM level by exploiting insufficient access control mechanisms. The vulnerability was publicly disclosed by a researcher named 'Chaotic Eclipse' after expressing dissatisfaction with Microsoft's vulnerability disclosure process. Microsoft addressed the issue in their April 14, 2026, Patch Tuesday release. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-microsoft-defender-flaw-exploited-in-zero-day-attacks/?utm_source=openai)) The urgency of this directive underscores the increasing trend of zero-day vulnerabilities being exploited in the wild, highlighting the necessity for organizations to promptly apply security patches. The incident also brings attention to the challenges in vulnerability disclosure processes and the potential risks associated with public disclosures of unpatched vulnerabilities.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports