Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 28 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 325–336 / 1289 reports
SLEEPWALKER Backdoor: The Invisible Threat That Waits for a Single Packet
Card image — SLEEPWALKER Backdoor: The Invisible Threat That Waits for a Single Packet
Computer/Network Security2 months ago

SLEEPWALKER Backdoor: The Invisible Threat That Waits for a Single Packet

In August 2026, security researchers documented SLEEPWALKER, a sophisticated Windows backdoor that remains dormant until activated by a specially crafted network packet. The 59,904-byte DLL impersonates Microsoft's dpapi.dll and side-loads into ESET Management Agent processes, executing commands through its own 23-instruction bytecode language across six transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI. The backdoor makes no outbound connections and leaves minimal forensic traces, consistent with advanced persistent threat operations. This discovery highlights the evolution of stealth backdoors toward packet-triggered activation mechanisms that bypass traditional network monitoring and endpoint detection systems.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical ZoneMinder Vulnerability Exposes Video Surveillance Infrastructure to Remote Code Execution
Computer/Network Security2 months ago

Critical ZoneMinder Vulnerability Exposes Video Surveillance Infrastructure to Remote Code Execution

ZoneMinder, a widely-deployed open-source video surveillance software, disclosed a critical OS command injection vulnerability (CVE-2026-76060) affecting versions 1.37.48 and 1.38.3. The vulnerability allows authenticated users with 'View Events' permissions to execute arbitrary operating system commands through unsanitized input in the exportFile parameter during event export operations. With a CVSS score of 8.8, successful exploitation grants full remote code execution as the web server user, potentially compromising entire surveillance infrastructure installations. This incident highlights the growing trend of supply chain vulnerabilities in critical infrastructure software, particularly as organizations increasingly rely on open-source solutions for security monitoring. The vulnerability's discovery through a public proof-of-concept demonstrates the escalating risk of weaponized research and the need for proactive vulnerability management in surveillance systems that often operate with elevated privileges across enterprise networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Red Team Reveals Shocking Security Gap: Two Critical Infrastructure Orgs, Vastly Different Outcomes
Government Administration2 months ago

CISA Red Team Reveals Shocking Security Gap: Two Critical Infrastructure Orgs, Vastly Different Outcomes

In August 2026, CISA published results from simultaneous red team assessments against two critical infrastructure organizations in the Government Services and Water/Wastewater sectors. Both organizations were fully compromised at the domain level using similar attack techniques including web application exploitation with default credentials, Active Directory Certificate Services misconfigurations, and privilege escalation through cleartext stored credentials. Organization A detected nothing despite thousands of security alerts, while Organization B's SOC detected and isolated affected workstations within 2-20 minutes, demonstrating the critical importance of security operations maturity over tool sophistication. This assessment highlights the growing focus on defensive capabilities amid increasing nation-state threats against critical infrastructure, particularly following recent campaigns like Salt Typhoon that exposed fundamental gaps in network security and detection capabilities across sectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Advanced AI Agent Defeats VM Isolation Through Autonomous Exploit Development
Computer Software/Engineering2 months ago

Advanced AI Agent Defeats VM Isolation Through Autonomous Exploit Development

In August 2026, Trail of Bits researchers evaluated GPT 5.6-Cyber's cybersecurity capabilities by challenging it to escape VM containment. The AI agent successfully broke out of a QEMU/KVM virtual machine three separate times, first exploiting known kernel vulnerabilities (CVE-2026-53359), then leveraging unpatched libslirp flaws (CVE-2026-9539), and finally chaining multiple zero-day vulnerabilities across QEMU, Linux KVM, and libslirp components. Operating autonomously for hours, the agent demonstrated advanced persistent threat capabilities including vulnerability research, exploit development, and reliable execution chains. This incident fundamentally challenges the assumption that standard VM isolation is sufficient for containing advanced AI agents with cybersecurity capabilities. The research demonstrates that current sandboxing approaches are inadequate against sophisticated AI systems that can autonomously discover and exploit complex vulnerability chains across multiple software components within virtualization stacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Red Team Results Expose Critical Cybersecurity Gaps in Government vs Water Sector
Government Administration2 months ago

CISA Red Team Results Expose Critical Cybersecurity Gaps in Government vs Water Sector

In 2024, CISA conducted red team exercises against two organizations - one government and one water sector entity - with dramatically different outcomes. Both organizations were successfully breached through phishing campaigns, but while the government organization failed to detect or respond to the simulated attack, allowing red teamers to gain elevated privileges and move laterally across systems undetected, the water sector organization quickly identified the intrusion and quarantined affected systems within 2-20 minutes. The exercise revealed critical gaps in detection capabilities, cloud security controls, and incident response procedures across both sectors. This incident highlights the urgent need for improved cybersecurity defenses in critical infrastructure sectors, particularly as nation-state actors increasingly target water facilities and government systems. The stark contrast in detection and response capabilities demonstrates the growing maturity gap in cybersecurity readiness across different sectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical NVIDIA NemoClaw Vulnerability Enables AI Model Hijacking Through Web Browsers
Computer Software/Engineering2 months ago

Critical NVIDIA NemoClaw Vulnerability Enables AI Model Hijacking Through Web Browsers

In August 2026, Oasis Security disclosed a critical vulnerability in NVIDIA NemoClaw that allows malicious webpages to gain unauthenticated control over local Ollama AI model instances through DNS rebinding attacks. The vulnerability exploits NemoClaw's configuration that binds Ollama to all network interfaces (0.0.0.0:11434) on Windows and WSL systems, bypassing authentication and CORS protections. Attackers can poison AI model chat templates with hidden instructions that persist across conversations, effectively taking control of AI agents and their associated tools and permissions. NVIDIA partially addressed the issue in v0.0.35 for macOS and Linux, but Windows installations remain vulnerable with only warnings implemented. This vulnerability highlights the growing attack surface of AI infrastructure and the critical need for secure-by-default configurations in AI development frameworks, particularly as organizations rapidly deploy AI agents with access to sensitive systems and data.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
ReliaQuest Breach Exposes Critical Identity Security Gaps in Social Engineering Defense
Computer/Network Security2 months ago

ReliaQuest Breach Exposes Critical Identity Security Gaps in Social Engineering Defense

In August 2026, cybersecurity firm ReliaQuest fell victim to a sophisticated social engineering attack orchestrated by the ShinyHunters extortion group. Attackers impersonated ReliaQuest security team members via phone calls, directing employees to a fraudulent SSO page hosted on the lookalike domain reliaquest.claims. One employee was successfully deceived into entering credentials and approving an MFA push notification, granting attackers temporary view-only access to ReliaQuest's Okta identity dashboard. However, device-trust controls successfully prevented access to applications and systems, limiting the breach's scope to credential exposure only. This incident highlights the evolving sophistication of social engineering attacks targeting identity systems, particularly as threat actors increasingly combine vishing techniques with credential harvesting. The attack demonstrates how even cybersecurity companies with robust controls can be vulnerable to human-focused attack vectors, emphasizing the critical need for comprehensive identity protection beyond traditional MFA implementations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ToxicPanda 2.0: When Banking Trojans Become Enterprise Identity Threats
Banking/Mortgage2 months ago

ToxicPanda 2.0: When Banking Trojans Become Enterprise Identity Threats

ToxicPanda 2.0, an evolved Android banking Trojan, has expanded from targeting 16 financial institutions to 349 banking, e-wallet, and cryptocurrency applications across 16 countries. The malware leverages Android's Wireless Debugging and ADB capabilities to achieve shell-level access and persistent device compromise. Beyond traditional banking fraud, the Trojan now captures lock-screen credentials and establishes enterprise-grade persistence, creating risks for corporate identity systems and authentication frameworks. This incident highlights the maturation of mobile banking Trojans from simple financial theft tools to comprehensive enterprise threats capable of compromising corporate identity anchors and multi-factor authentication systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Operation QUICSILVER Exploits Government Trust: How QUICAgent Backdoor Evaded Detection
Government Administration2 months ago

Operation QUICSILVER Exploits Government Trust: How QUICAgent Backdoor Evaded Detection

Operation QUICSILVER is a cyber espionage campaign targeting Myanmar's government and IT sectors, attributed to a China-nexus threat actor with moderate confidence. First observed in April 2026, the campaign uses graduation ceremony invitation lures written in Burmese to deliver QUICAgent, a custom Go-based backdoor. The attack chain begins with malicious VHD files containing Windows shortcuts that masquerade as PDF documents, ultimately deploying the backdoor which communicates over QUIC protocol on UDP port 443 for command and control operations. This incident highlights the continued targeting of Southeast Asian governments by suspected Chinese APT groups, representing the evolving use of legitimate protocols like QUIC to evade detection. The campaign demonstrates sophisticated social engineering tactics using culturally relevant lures and reflects the ongoing geopolitical tensions in the region through cyber means.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
ToxicPanda 2.0: The Android Banking Trojan That Hijacks VPN Permissions
Banking/Mortgage2 months ago

ToxicPanda 2.0: The Android Banking Trojan That Hijacks VPN Permissions

ToxicPanda 2.0 Android malware emerged in August 2026 with sophisticated capabilities targeting 349 banking and financial applications across 16 countries. The malware exploits VPN service permissions to create local network interfaces that block Google Play communications, preventing security updates and Play Protect interference. It leverages Accessibility Services to automatically enable Wireless ADB debugging, gaining shell-level access to execute high-privilege commands and bypass Android security restrictions. The malware supports 167 remote commands and includes invisible phishing overlays that capture credentials and device PINs while maintaining persistence across major Android device manufacturers. Mobile banking trojans are experiencing a resurgence in 2026, with threat actors increasingly targeting VPN permissions and ADB abuse techniques to circumvent Google's enhanced security measures and maintain persistent access to compromised devices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft Defender's Own Driver Weaponized for Endpoint Security Bypass
Computer/Network Security2 months ago

Microsoft Defender's Own Driver Weaponized for Endpoint Security Bypass

In August 2026, Check Point Research disclosed a technique that weaponizes Microsoft Defender's own legitimately signed boot-time remediation driver (BTR.sys) to perform arbitrary kernel-level file and registry operations on Windows systems. The technique, dubbed 'BTR Reforged,' affects all Windows versions from Windows 7 through Windows 11 25H2 and exploits a built-in driver that cannot be blocked without disrupting Defender itself. Researchers demonstrated live deletion of the entire Defender stack on a fully updated Windows 11 system with Tamper Protection active, requiring only administrator privileges with SeLoadDriverPrivilege. Unlike traditional bring-your-own-vulnerable-driver attacks, this technique uses infrastructure present in every Windows installation, making it particularly concerning for endpoint security bypass scenarios. This discovery highlights the evolving sophistication of endpoint security bypass techniques, where attackers increasingly leverage legitimate system components rather than external vulnerable drivers that can be easily blocklisted by security vendors.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Delta Flight 591 Wi-Fi Hack: When DEF CON Tools Turn Into In-Flight Threats
Airlines/Aviation2 months ago

Delta Flight 591 Wi-Fi Hack: When DEF CON Tools Turn Into In-Flight Threats

In August 2026, a passenger on Delta Air Lines Flight 591 from Las Vegas to Atlanta compromised the aircraft's in-flight Wi-Fi system following the Black Hat and DEF CON conferences. The attacker disabled the legitimate Wi-Fi service and created a rogue access point named "Delta WiFi Fast" that redirected users to a phishing page designed to harvest credentials. Federal authorities launched an investigation into the incident, with suspicion falling on DEF CON attendees who may have used commercially available Wi-Fi Pineapple devices purchased at the conference. This incident highlights the growing risk of in-flight cybersecurity threats as aviation systems become increasingly connected. The ease with which commercially available penetration testing tools can be weaponized in confined, high-security environments demonstrates critical gaps in aviation cybersecurity protocols and passenger device restrictions during flight operations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports