Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1287 threat reports
Page 11 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 121–132 / 1287 reports
AI-Powered Espionage: How CL-UNK-1211 Used LLMs to Target Government Linux Servers
AI-Powered Espionage: How CL-UNK-1211 Used LLMs to Target Government Linux Servers
Government Administration2 weeks ago

AI-Powered Espionage: How CL-UNK-1211 Used LLMs to Target Government Linux Servers

Between October 2025 and April 2026, Unit 42 tracked a threat cluster designated CL-UNK-1211 conducting an AI-accelerated espionage campaign against government entities and state-affiliated Linux infrastructure. Attackers gained initial access through widespread web shell deployments, hijacked global PHP configurations for persistence, harvested credentials via .bashrc manipulation and PHP injection, deployed a custom Go-based cross-platform RAT named SysGoRAT over WebSocket C2, and exfiltrated government mailboxes and entire database contents. Defense evasion included log deletion, timestomping, endpoint-protection termination, and planting fake red-team markers. AI-generated payloads with conversational inline comments accelerated the operation's pace across PHP, Python, Bash, and JavaScript. This campaign marks a tangible inflection point in state-level or state-adjacent espionage: AI is no longer theoretical in offensive operations. Attackers used LLM-generated code to compress development timelines, seamlessly pivot across technology stacks, and scale payload generation—signaling that AI-assisted intrusions will become the baseline expectation for advanced threat actors targeting critical government infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Cellebrite's Wireless iPhone Zero-Day: What the Advanced Unlocks Leak Means for Enterprise Security
Cellebrite's Wireless iPhone Zero-Day: What the Advanced Unlocks Leak Means for Enterprise Security
Law Enforcement2 weeks ago

Cellebrite's Wireless iPhone Zero-Day: What the Advanced Unlocks Leak Means for Enterprise Security

In October 2026, a leaked confidential Cellebrite document revealed a new forensic extraction capability called Advanced Unlocks (AU), described as a next-generation After First Unlock (AFU) vector engineered to survive Apple OS hardening updates. Unlike prior Cellebrite tools, AU operates wirelessly via a dedicated appliance with an effective range of approximately eight meters, bypassing Stolen Device Protection and its associated USB restrictions without requiring physical cable connection. The capability represents a significant escalation in law enforcement and adversarial forensic tooling, enabling covert device compromise in proximity-based scenarios with no direct physical contact required. This disclosure arrives amid growing concern over the proliferation of commercial spyware and exploit tooling beyond controlled government use. The wireless, proximity-based nature of AU blurs the line between lawful forensic access and covert surveillance, intensifying regulatory scrutiny and prompting urgent reassessment of mobile device security posture across enterprise and government environments alike.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
PwnEscape (CVE-2026-99999): When a Guest VM Reads Your Host's Memory
PwnEscape (CVE-2026-99999): When a Guest VM Reads Your Host's Memory
Information Technology/IT2 weeks ago

PwnEscape (CVE-2026-99999): When a Guest VM Reads Your Host's Memory

In October 2026, security researcher Paulos Yibelo of pwn.ai disclosed CVE-2026-99999, dubbed PwnEscape, a critical Linux kernel networking vulnerability rated 9.3/10 CVSS. The flaw allows malicious code executing inside a guest virtual machine to read host memory, crash the host, and potentially achieve code execution on it. Demonstrated live against Vercel's production Firecracker microVM sandboxes during a $1 million bug-bounty challenge, each crafted packet exfiltrated approximately 32 bytes of host memory. Two packets sufficed to crash a host and terminate all co-resident sandboxes. Red Hat's Michael S. Tsirkin authored the upstream fix, now backported across all supported stable kernel branches. PwnEscape exposes a structural risk in multi-tenant cloud infrastructure: because nearly every major cloud provider isolates workloads at the Linux kernel networking layer, a single kernel flaw undermines the trust boundary between all co-resident tenants simultaneously. As AI-assisted exploit research matures—this flaw was found in three days for under $700 in API costs—the window between discovery and weaponization is collapsing, demanding accelerated patch cycles and defense-in-depth network controls.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
PEERSTITCH: How Attackers Weaponized FortiOS Internals to Build an Invisible VPN Backdoor
PEERSTITCH: How Attackers Weaponized FortiOS Internals to Build an Invisible VPN Backdoor
Telecommunications2 weeks ago

PEERSTITCH: How Attackers Weaponized FortiOS Internals to Build an Invisible VPN Backdoor

In September 2024, a suspected advanced persistent threat actor tracked as CL-STA-0954 (UNC5820) compromised a telecommunications managed service provider by chaining two Fortinet vulnerabilities. Initial access was gained via CVE-2024-47575 (FortiJump) targeting FortiManager, enabling exfiltration of configurations, private keys, and metadata for over 500 managed FortiGate firewalls. Attackers then exploited CVE-2025-61624, a FortiOS path traversal flaw, to deploy PEERSTITCH—a memory-resident ARM64 implant that injects hooks into legitimate daemons (miglogd and iked) to create a covert inter-process communication bridge, effectively bypassing VPN session security checks without leaving disk artifacts. This incident signals an accelerating trend of state-linked actors weaponizing centralized network management platforms to compromise downstream infrastructure at scale. The combined use of living-off-the-land injection techniques, WebAssembly payloads, and forensic artifact removal represents a maturation of edge-device malware tradecraft that outpaces conventional endpoint and network detection approaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Armory Castle's BeyondTrust Zero-Day: How a Remote Support Appliance Became a Nation-State Espionage Gateway
Armory Castle's BeyondTrust Zero-Day: How a Remote Support Appliance Became a Nation-State Espionage Gateway
Government Administration2 weeks ago

Armory Castle's BeyondTrust Zero-Day: How a Remote Support Appliance Became a Nation-State Espionage Gateway

In late August 2026, China-nexus threat actor Armory Castle (UNC5221/Warp Panda) exploited CVE-2026-102764, a critical zero-day in BeyondTrust Remote Support appliances, to seize full administrative control of targeted self-hosted systems. The group deployed a PHP web shell (SAWFLY) for persistent C2, used a custom SOCKS5 proxy tool (BARECLAW) for traffic tunneling, harvested stored credentials via proprietary CLI utilities, and pivoted laterally to downstream endpoints via the appliance's Jump Item list—exfiltrating sensitive documents while systematically erasing logs to hinder detection. CISA added the vulnerability to its KEV catalog on October 16, 2026, mandating federal remediation by October 19. Armory Castle's campaign exemplifies an accelerating pattern of state-sponsored actors pre-positioning zero-days against high-value remote-access and IT management infrastructure. As enterprises increasingly rely on privileged remote-support platforms spanning hybrid and multicloud environments, attackers who compromise these chokepoints gain instant, credential-rich access to the entire downstream estate—making network segmentation, east-west visibility, and egress control more critical than ever.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-106931: When Your WAF Becomes the Attack Surface
CVE-2026-106931: When Your WAF Becomes the Attack Surface
Computer/Network Security2 weeks ago

CVE-2026-106931: When Your WAF Becomes the Attack Surface

In October 2026, attackers began actively exploiting CVE-2026-106931, a critical OS command-injection vulnerability in the SiteGuard Server Edition web application firewall. The flaw resides in the product's statistics feature—enabled by default—and affects versions 2.20 through pre-8.00 Update 5 across Apache, Nginx, and IIS deployments on Linux and Windows. Successful exploitation allows unauthenticated or low-privileged attackers to execute arbitrary operating-system commands with root or SYSTEM privileges, effectively granting full host control. SiteGuard protects an estimated 1.5 million websites globally, including roughly 500,000 active WordPress installations, amplifying the potential blast radius of this campaign. This incident underscores a growing attacker pattern of targeting the security tools themselves—WAFs, VPNs, and gateways—as high-value pivot points. When the defensive perimeter becomes the attack surface, organizations that rely on perimeter-only controls without internal segmentation, anomaly detection, or east-west traffic inspection face compounding risk once the outer layer is bypassed.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical NGINX Flaws Put Cloud-Native Infrastructure at Risk: What Security Teams Must Do Now
Critical NGINX Flaws Put Cloud-Native Infrastructure at Risk: What Security Teams Must Do Now
Information Technology/IT2 weeks ago

Critical NGINX Flaws Put Cloud-Native Infrastructure at Risk: What Security Teams Must Do Now

In October 2026, F5 released out-of-band emergency patches addressing three critical vulnerabilities in NGINX—CVE-2026-15176 and CVE-2026-97205 in the ngx_http_v3_module, and CVE-2026-93479 in the NGINX map directive. These flaws expose NGINX Plus, NGINX Open Source, NGINX Ingress Controller, NGINX Gateway Fabric, and NGINX Instance Manager to remote code execution and denial-of-service attacks via heap-based buffer overflow and use-after-free conditions. Exploitation requires no credentials and can succeed on systems with ASLR disabled or bypassable, affecting enterprises across cloud-native and hybrid environments. F5 has not confirmed active in-the-wild exploitation, but interim mitigations are available for organizations unable to patch immediately. This disclosure follows a pattern of sustained targeting of F5 infrastructure by cybercriminal and nation-state actors, including a 2025 breach of F5's own systems in which source code and undisclosed BIG-IP vulnerability data were stolen. With NGINX powering a significant share of global web infrastructure and Kubernetes ingress layers, the blast radius of unpatched deployments is substantial, making rapid patch adoption a board-level concern.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Five Minutes Was All It Took: How UNC7017 Weaponized AOMEI Backupper's Update Channel to Backdoor Organizations in 11 Countries
Five Minutes Was All It Took: How UNC7017 Weaponized AOMEI Backupper's Update Channel to Backdoor Organizations in 11 Countries
Information Technology/IT2 weeks ago

Five Minutes Was All It Took: How UNC7017 Weaponized AOMEI Backupper's Update Channel to Backdoor Organizations in 11 Countries

Between May and July 2026, a threat actor tracked as UNC7017 conducted a precision supply-chain attack against AOMEI Backupper, a widely deployed Windows backup and disk-cloning tool. Attackers gained write access to AOMEI's update servers and swapped two unsigned configuration files—down_html.ini and Notifycfg.ini—during three windows lasting five to ten minutes each. Any copy of the software that polled for updates during those windows silently downloaded and executed a backdoor called SHINYROAD, delivered via a DLL-sideloading chain using a signed Radmin binary. Affected organizations span IT services, telecommunications, and higher education across 11 countries, and a secondary WebDAV trick enabled NetNTLMv2 credential theft with no code execution required. This incident crystallizes a maturing attacker playbook: compromise the trusted update mechanism of a legitimate vendor, operate in sub-ten-minute windows to defeat point-in-time scanning, and leave no exploited CVE to patch. As software supply-chain intrusions grow more ephemeral and harder to triage, organizations face mounting pressure from CISA, NIST CSF 2.0, and PCI DSS 4.0 to enforce cryptographic verification of software updates and apply zero-trust network controls around all outbound software delivery paths.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
MALFEX 2026: How a Nine-Line npm Package Smuggled a Shellcode Loader into Windows Developer Environments
MALFEX 2026: How a Nine-Line npm Package Smuggled a Shellcode Loader into Windows Developer Environments
Computer Software/Engineering2 weeks ago

MALFEX 2026: How a Nine-Line npm Package Smuggled a Shellcode Loader into Windows Developer Environments

In late September 2026, threat researchers uncovered a sustained software supply-chain campaign dubbed MALFEX, in which an unknown threat actor published a series of malicious npm packages—most recently 'imgdecode'—targeting Windows developers. The package conceals a compiled Windows DLL inside a Node.js native addon; when loaded, the DLL fetches encrypted shellcode from a GitHub repository, decrypts it, and injects it into a legitimate dllhost.exe process. The malware deploys both the Overlord RAT and a Go-based Node.js infostealer ('movinlike') capable of harvesting browser credentials, crypto wallets, Discord, Telegram, seed phrases, SSH keys, and gaming platform tokens, while establishing a persistent WebSocket C2 channel and evading sandbox detection. Active since August 2023, the campaign has cycled through at least eleven package identities in direct response to npm takedowns. This incident underscores an accelerating attacker pattern of weaponizing open-source package ecosystems to reach enterprise CI/CD pipelines and developer workstations. The adversary's rapid republishing cadence—replacing removed packages within hours—highlights the inadequacy of reactive registry enforcement and reinforces urgent demand for proactive supply-chain controls, network egress enforcement, and east-west segmentation in cloud-native environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
One Stolen Credential, 173 Breached Tenants: Inside the ConnectWise Cloud Backup OAuth Attack
One Stolen Credential, 173 Breached Tenants: Inside the ConnectWise M365 Supply Chain Attack
Information Technology/IT2 weeks ago

One Stolen Credential, 173 Breached Tenants: Inside the ConnectWise Cloud Backup OAuth Attack

On October 15, 2026, unknown threat actors exploited a compromised OAuth credential belonging to ConnectWise Cloud Backup (formerly SkyKick) to gain unauthorized access to 173 Microsoft 365 tenants. Operating from IP address 144.172.64.128 between 06:13 and 08:34 UTC, attackers scripted through tenants in sorted GUID order, harvesting Microsoft Graph tokens and inheriting the application's broad permissions—full mailbox access, OneDrive, SharePoint, Teams, and directory data. In at least one tenant, a ConnectWise app elevated itself to Global Administrator and injected credentials into trusted third-party applications, extending the blast radius across the MSP customer ecosystem. This incident underscores the accelerating abuse of trusted OAuth applications and MSP supply-chain vectors as force-multipliers for attackers. A single compromised vendor credential cascaded across 173 organizations simultaneously, illustrating how identity-centric supply-chain attacks are rapidly displacing traditional network-based intrusions as the dominant enterprise threat pattern in 2026.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
37 Years in the Kernel: How a Legacy BSD Integer Overflow Was Chained Into a Full OpenBSD Root Exploit
37 Years in the Kernel: How a Legacy BSD Integer Overflow Was Chained Into a Full OpenBSD Root Exploit
Information Technology/IT2 weeks ago

37 Years in the Kernel: How a Legacy BSD Integer Overflow Was Chained Into a Full OpenBSD Root Exploit

In October 2026, security firm Calif published a working local privilege escalation exploit against OpenBSD 7.9 that chains a 37-year-old signed 16-bit integer overflow in the shmat() shared-memory attachment counter with a separate kernel use-after-free, ultimately bypassing OpenBSD's KARL kernel-address randomization and hardware SMAP/SMEP protections to achieve root. The attack requires no information-disclosure vulnerability, exploiting deterministic kernel memory allocators to locate function pointers at predictable addresses. OpenBSD shipped patches in September 2026 via errata 018 and 026, available through syspatch across all architectures. No CVE was assigned and no in-the-wild exploitation has been observed. This disclosure highlights how legacy type definitions inherited across decades of BSD lineage can survive in security-hardened operating systems, and how layered exploit chains increasingly neutralize multiple independent mitigations simultaneously. The research underscores growing attacker sophistication in local privilege escalation techniques targeting hardened Unix-family kernels—a trend increasingly relevant to cloud workloads, container escape scenarios, and shared multi-tenant infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Plex2Shell: How a Four-CVE Chain Turned Media Servers Into Crypto Mines and Proxy Nodes
Plex2Shell: How a Four-CVE Chain Turned Media Servers Into Crypto Mines and Proxy Nodes
Information Technology/IT2 weeks ago

Plex2Shell: How a Four-CVE Chain Turned Media Servers Into Crypto Mines and Proxy Nodes

In October 2026, threat actors began actively exploiting a chained set of four vulnerabilities in Plex Media Server—collectively dubbed Plex2Shell—to achieve unauthenticated remote code execution. The attack chain, involving CVEs 2026-96652, 96654, 96655, and 96656, was weaponized within 24 hours of a public proof-of-concept release on October 16, 2026. Attackers deployed the XMRig-based cryptominer 'mylovelyminer' and a stealthy Linux reverse proxy backdoor named 'myawesomeproxy,' both linked to the AISURU proxyware botnet infrastructure. Plex had patched the flaws in version 1.43.3.10861 released August 3, 2026, but unpatched internet-exposed instances remained vulnerable. This incident underscores the persistent danger of n-day exploitation windows—where attackers race to compromise unpatched systems immediately after PoC publication. The connection to the AISURU botnet signals organized, infrastructure-backed campaigns targeting self-hosted media platforms to harvest compute resources and build covert proxy networks for downstream attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports