✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Critical Unpatched Flaw in Shark Vacuums Highlights IoT Security Risks
In July 2026, a critical security vulnerability was discovered in Shark RV2320EDUS robot vacuums, allowing attackers to remotely execute commands on other Shark vacuums within the same AWS region. By extracting the device certificate from the vacuum's flash storage, an attacker could gain root access to other devices, enabling actions such as controlling the vacuum's movements, accessing onboard cameras, retrieving home maps, and obtaining Wi-Fi credentials in plaintext. The flaw was reported to SharkNinja in March 2026 but remained unpatched as of the disclosure. This incident underscores the escalating risks associated with IoT devices, particularly those with inadequate security configurations. The ability to exploit a single device to compromise an entire network of similar devices highlights the urgent need for robust security measures in IoT device design and deployment.
1 week ago
Kill Chain
Daxin and Stupig Malware Resurface in Taiwan Manufacturing Firm
In May 2026, Symantec's Threat Hunter Team identified the re-emergence of Backdoor.Daxin, a sophisticated kernel-mode rootkit previously linked to China-based threat actors, on a compromised host within a Taiwan-based subsidiary of a multinational high-tech manufacturer. Alongside Daxin, researchers discovered a novel backdoor named Stupig, which exploits a trojanized keyboard-layout DLL to execute commands with SYSTEM privileges directly from the Windows logon screen, bypassing standard authentication mechanisms. Both malware samples carry compile timestamps from early 2013, suggesting a prolonged undetected presence of up to 13 years within the victim's network. This incident underscores the persistent and evolving nature of cyber threats targeting critical infrastructure and high-tech industries. The discovery of Stupig's unique pre-authentication execution method highlights the need for continuous vigilance and advanced detection capabilities to identify and mitigate such stealthy intrusions.
1 week ago
Kill Chain
PhantomEnigma: Cyberattack Compromises Brazilian Government Websites
In July 2026, cybersecurity analysts uncovered a campaign named PhantomEnigma, which exploited over 20 Brazilian government websites to distribute malware targeting banking and public-sector organizations. Attackers compromised legitimate .gov.br domains and email accounts, enabling them to bypass security protocols and deliver malicious payloads through trusted channels. This operation utilized modular malware and frequently rotated infrastructure, complicating detection and mitigation efforts. The campaign's sophistication underscores the critical need for robust cybersecurity measures to protect sensitive government and financial data. The PhantomEnigma incident highlights a growing trend of cybercriminals leveraging trusted government infrastructure to conduct attacks, increasing the difficulty of detection and response. This case serves as a stark reminder for organizations to enhance their security postures, particularly in monitoring and securing official digital platforms against such sophisticated threats.
1 week ago
Kill Chain
Cato Networks' 2026 Research Highlights the Importance of AI Harnesses in Cybersecurity
In July 2026, Cato Networks conducted research demonstrating the significant impact of integrating Large Language Models (LLMs) with bespoke cybersecurity harnesses. By pairing OpenAI's ChatGPT 5.5 and GPT 5.5-Cyber models with their proprietary tool, Cato Networks achieved complete end-to-end attack chains, including domain administrator privileges and Active Directory access, in as little as 40 minutes. This research underscores the critical role of technical harnesses in guiding LLMs to perform complex cybersecurity tasks autonomously. The findings highlight the necessity for organizations to develop and implement tailored AI harnesses to effectively manage and direct LLMs in cybersecurity operations. As AI-enabled hacking becomes more prevalent, the ability to control and optimize these models through specialized harnesses is essential for maintaining robust security postures.
1 week ago
Kill Chain
AI Tools in Cyberattacks: The Misuse of Google's Gemini CLI
In mid-2026, a Russian-speaking threat actor known as "bandcampro" exploited Google's open-source Gemini CLI AI tool to orchestrate a small-scale botnet targeting a dental clinic's systems. Over approximately two months, the attacker utilized the AI agent to deploy and manage infrastructure controlling eight systems, gaining unauthorized access to the OpenDental database. The AI facilitated tasks such as troubleshooting, operational improvements, and command-and-control (C2) migration, demonstrating advanced capabilities in automating cyberattack processes. This incident underscores the evolving landscape of cyber threats, where adversaries increasingly leverage AI tools to enhance the efficiency and sophistication of their operations. The misuse of AI in cyberattacks highlights the urgent need for robust security measures and vigilant monitoring to detect and mitigate such advanced threats.
1 week ago
Kill Chain
TuxBot v3 Evolution: Unveiling the AI-Assisted IoT Botnet Threat
In early 2026, cybersecurity researchers uncovered TuxBot v3 Evolution, a sophisticated modular IoT botnet framework. This malware targets a wide range of IoT devices by exploiting known vulnerabilities and employing extensive Telnet brute-force attacks. Notably, the development of TuxBot v3 Evolution involved assistance from a large language model (LLM), resulting in both functional components and critical errors due to unreviewed AI-generated code. The botnet's capabilities include multi-architecture support, encrypted command-and-control communications, and a variety of fallback mechanisms, posing a significant threat to IoT security. The discovery of TuxBot v3 Evolution underscores the evolving landscape of cyber threats, where adversaries leverage AI technologies to enhance malware development. This trend highlights the urgent need for robust security measures and continuous monitoring to protect IoT ecosystems from increasingly sophisticated attacks.
1 week ago
Kill Chain
OkoBot Malware Exploits Ledger and Trezor Apps to Steal Seed Phrases
In April 2025, the OkoBot malware framework emerged, targeting Windows users by infiltrating legitimate cryptocurrency hardware wallet applications such as Trezor Suite and Ledger Live. The malware's 'SeedHunter' module monitors for the launch of these applications, injecting malicious code that prompts users to enter their recovery seed phrases. This deceptive tactic enables attackers to gain unauthorized access to victims' cryptocurrency assets. Kaspersky's GReAT team reported that OkoBot has affected hundreds of users across more than 25 countries, with significant concentrations in Brazil, Vietnam, Canada, Mexico, and Turkey. The malware remains active as of July 2026, continually evolving its methods to exploit hardware wallet users. The persistence and adaptability of OkoBot underscore a broader trend of increasingly sophisticated attacks targeting cryptocurrency holders. This incident highlights the critical need for users to remain vigilant against phishing attempts and to adhere strictly to security protocols, such as never entering recovery phrases into software interfaces. The ongoing evolution of such malware emphasizes the importance of continuous security education and the implementation of robust protective measures within the cryptocurrency community.
1 week ago
Kill Chain
ADPathFinder: Comprehensive Attack Path Mapping for Enhanced Security Assessments
ADPathFinder is a cybersecurity tool designed to enhance internal assessments by mapping privilege escalation paths across Active Directory (AD), Active Directory Certificate Services (ADCS), Microsoft SQL Server (MSSQL), and System Center Configuration Manager (SCCM) environments. By integrating data from SharpHound with OpenGraph collectors like MSSQLHound and ConfigManBearPig, ADPathFinder provides a unified view of attack paths, enabling security professionals to identify and address vulnerabilities more efficiently. Additionally, it offers password auditing capabilities, tying cracked NTDS/hashcat results back to group memberships and account risks, thereby providing a comprehensive security analysis. As organizations increasingly rely on complex and interconnected systems, tools like ADPathFinder become essential in proactively identifying and mitigating potential security threats. Its ability to consolidate data from multiple sources and present a cohesive analysis allows for more effective prioritization of remediation efforts, ensuring that critical vulnerabilities are addressed promptly.
1 week ago
Kill Chain
Unveiling TuxBot v3 Evolution: The AI-Assisted IoT Botnet Threat
In early 2026, security researchers identified TuxBot v3 Evolution, a sophisticated modular IoT botnet framework. This malware targets a wide range of IoT devices by exploiting known vulnerabilities and employing extensive Telnet brute-force attacks. Notably, the developers utilized large language models (LLMs) to assist in code development, resulting in a mix of functional and flawed components. The botnet's capabilities include cross-compilation for multiple architectures, encrypted command-and-control (C2) communications, and a DDoS-for-hire panel. Despite some non-functional features due to development oversights, the framework's modularity and adaptability pose a significant threat to IoT security. The emergence of TuxBot v3 Evolution underscores a concerning trend: the integration of AI tools in malware development, which can accelerate the creation of complex and adaptable threats. This incident highlights the urgent need for enhanced security measures in IoT devices and the importance of monitoring AI-assisted developments in the cyber threat landscape.
1 week ago
Kill Chain
U.S. Treasury Sanctions 1VPNS for Facilitating Ransomware Attacks
In July 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS) and its administrator, Ukrainian national Dmytro Rashevskyi, for providing services to ransomware operators. 1VPNS, operational since 2014, advertised its refusal to cooperate with law enforcement and offered anonymity services that were exploited by cybercriminals to conceal attack origins, deploy malware, and manage exfiltrated data. Victims included U.S. businesses, financial services companies, hospitals, and municipal governments. Additionally, Belarusian national Yegeniy Vladimirovich Silayev was sanctioned for selling 'cryptors'—tools designed to disguise ransomware and other malware as harmless files—to ransomware operators. These actions underscore the critical role that infrastructure providers play in facilitating cybercriminal activities and the necessity of targeting such enablers to disrupt the ransomware ecosystem. The sanctions highlight the ongoing efforts by international law enforcement to dismantle networks that support ransomware operations, emphasizing the importance of vigilance and proactive measures in cybersecurity.
1 week ago
Kill Chain
US Sanctions 1VPNS and Affiliates for Enabling Ransomware Attacks
In July 2026, the U.S. Treasury Department's Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS), its administrator Dmytro Rashevskyi, and Belarusian national Yegeniy Vladimirovich Silayev for facilitating ransomware attacks against U.S. organizations. 1VPNS provided anonymizing services to cybercriminals, while Silayev sold cryptors that helped malware evade detection. These services enabled ransomware groups to conduct attacks resulting in billions of dollars in losses to U.S. businesses and critical infrastructure. The sanctions followed a May 2026 law enforcement operation that dismantled 1VPNS's infrastructure and arrested Rashevskyi. This incident underscores the critical role that service providers play in the cybercriminal ecosystem. By targeting these enablers, authorities aim to disrupt the infrastructure supporting ransomware operations. Organizations should be aware of the evolving threat landscape and the importance of securing their networks against such indirect threats.
1 week ago
Kill Chain
Uncovering the BoryptGrab Infostealer: Nearly 300 Fake GitHub Repositories Distribute Malware
In July 2026, a sophisticated cyber campaign was uncovered involving nearly 300 fraudulent GitHub repositories that impersonated legitimate software projects to distribute the BoryptGrab infostealer malware. These repositories targeted users searching for security tools, cryptocurrency services, financial applications, developer utilities, secure email providers, macOS utilities, and gaming software. The malware was capable of harvesting data from over 19 web browsers, extracting information from 32 cryptocurrency wallets, and exfiltrating sensitive details from messaging and social media applications. The campaign utilized deceptive landing pages with trust-inducing elements to lure victims into downloading malicious ZIP archives containing trojanized DLL files and legitimate executables, which, when executed, loaded the infostealer into memory. This incident underscores a growing trend where threat actors exploit trusted platforms like GitHub to disseminate malware, leveraging search engine optimization (SEO) techniques to enhance the visibility of malicious repositories. The use of legitimate-looking repositories and sophisticated social engineering tactics highlights the evolving nature of cyber threats and the need for heightened vigilance when downloading software from online sources.
1 week ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports