Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Microsoft Addresses Risks of Uncoordinated Zero-Day Disclosures
In May 2026, security researcher Chaotic Eclipse publicly disclosed multiple zero-day vulnerabilities affecting Windows components such as Defender and BitLocker. These disclosures were made without prior notification to Microsoft, leading to active exploitation of vulnerabilities like BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), and UnDefend (CVE-2026-45498). Microsoft criticized this uncoordinated approach, emphasizing the risks posed to customers and advocating for Coordinated Vulnerability Disclosure (CVD) to allow vendors time to address issues before public release. This incident underscores the ongoing tension between independent security researchers and software vendors regarding disclosure practices. The rapid exploitation of these vulnerabilities highlights the critical need for timely and coordinated communication to mitigate risks and protect end-users effectively.
3 months ago
Kill Chain
FBI Issues Warning on Silent Ransom Group's In-Person Data Theft Tactics
In May 2026, the FBI issued a warning about the Silent Ransom Group (SRG), a Russia-linked data extortion gang targeting U.S. law firms. SRG employs a combination of social engineering tactics, including phone calls and phishing emails, to impersonate IT support staff. If these remote attempts fail, the group escalates to in-person visits, where operatives physically access computers to steal sensitive data using external storage devices. This method has led to the compromise of over 100 law firms, with data from more than 38 firms publicly leaked. The group's focus on law firms is strategic, exploiting the highly sensitive nature of legal data to exert pressure for ransom payments. SRG's unique approach, combining remote social engineering with physical intrusion, underscores the evolving threat landscape and the need for robust security measures in the legal sector.
3 months ago
Kill Chain
FBI Issues Warning on Silent Ransom Group's In-Person Data Theft Tactics
In May 2026, the FBI issued a warning about the Silent Ransom Group (SRG), an extortion gang targeting U.S. law firms through sophisticated social engineering tactics. SRG actors impersonate IT support personnel via phone calls and phishing emails to gain remote access to victim computers. If these attempts fail, they escalate their efforts by sending individuals in person to the victim's location to physically access computers and exfiltrate sensitive data using external storage devices. The stolen data is then used to extort victims, with threats to sell or publicly disclose the information if ransom demands are not met. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-warns-of-silent-ransom-group-in-person-data-theft-attacks/?utm_source=openai)) This incident underscores a concerning evolution in cybercriminal tactics, blending traditional phishing with physical infiltration to bypass digital defenses. The legal sector, known for handling highly sensitive information, is particularly vulnerable to such targeted attacks. Organizations must enhance their security protocols, including employee training on social engineering, strict access controls, and monitoring for unauthorized physical access, to mitigate the risks posed by such multifaceted threats.
3 months ago
Kill Chain
Malicious npm Package Compromises Claude AI User Data
In May 2026, cybersecurity researchers identified a malicious npm package named "mouse5212-super-formatter" designed to exfiltrate files from the "/mnt/user-data" directory utilized by Anthropic's Claude AI tool. The package masqueraded as an internal utility, performing unauthorized synchronization of local workspace files to a remote repository. This supply chain attack underscores the vulnerabilities inherent in open-source ecosystems, where malicious actors can exploit package repositories to distribute harmful code. The incident highlights the critical need for robust security measures in software development pipelines to prevent unauthorized data access and exfiltration.
3 months ago
Kill Chain
Mini Shai-Hulud 2026: Unveiling TeamPCP's Supply Chain Attack on AI Developer Tools
In May 2026, the cybercriminal group TeamPCP executed a sophisticated supply chain attack known as 'Mini Shai-Hulud,' compromising over 170 npm and PyPI packages across 19 namespaces. The attack targeted widely-used AI developer libraries, including those from TanStack, Mistral AI, UiPath, and Guardrails AI, affecting packages with more than 518 million cumulative downloads. Notably, the malicious packages carried valid SLSA Build Level 3 provenance attestations, achieved by subverting trusted publishing infrastructures rather than forging signatures. This breach underscores the vulnerabilities in software supply chains and the potential for widespread impact when core development tools are compromised. ([labs.cloudsecurityalliance.org](https://labs.cloudsecurityalliance.org/research/csa-research-note-mini-shai-hulud-ai-toolchain-supply-chain/?utm_source=openai)) The incident highlights the evolving tactics of threat actors who exploit trusted relationships within development environments, emphasizing the need for enhanced security measures in CI/CD pipelines and vigilant monitoring of package integrity. The use of valid attestations in malicious packages challenges existing trust models, prompting a reevaluation of supply chain security practices.
3 months ago
Kill Chain
AI-Driven Exploit Development: A New Era of Cyber Threats
In May 2026, cybersecurity researchers reported a significant acceleration in exploit development timelines due to the integration of artificial intelligence (AI). Attackers have reduced the time to develop exploits for known vulnerabilities from 125 days to just 0.5 days by leveraging AI-assisted development tools. This rapid development has outpaced the ability of traditional vulnerability scanners to detect and mitigate threats, creating substantial visibility gaps for security teams. The use of large language models (LLMs) enables threat actors to analyze code changes and generate proof-of-concept exploits swiftly, increasing the risk of unpatched vulnerabilities being exploited soon after disclosure. This development underscores the urgent need for organizations to adopt proactive security measures that can keep pace with AI-driven threats. Traditional detection methods are becoming less effective, necessitating the implementation of continuous software inventory analysis, real-time threat intelligence integration, and automated patch management to mitigate the risks associated with rapid exploit development.
3 months ago
Kill Chain
GlassWorm Malware Takedown: Securing the Developer Supply Chain
In May 2026, CrowdStrike, in collaboration with Google and the Shadowserver Foundation, executed a coordinated takedown of the GlassWorm botnet, a sophisticated malware campaign targeting software developers through compromised open-source packages and malicious Visual Studio Code extensions. This operation simultaneously disrupted all command-and-control channels associated with GlassWorm, effectively severing the operators' access to infected systems and halting the distribution of new malicious payloads. The GlassWorm campaign, active since early 2025, had systematically infiltrated developer tools and repositories, embedding malware in over 400 projects across platforms like GitHub, npm, and the Open VSX Registry. By compromising these widely used resources, the attackers aimed to steal credentials, access tokens, and sensitive data, thereby facilitating broader supply chain attacks that could impact numerous downstream organizations and users. The successful dismantling of GlassWorm underscores the critical importance of securing the software development supply chain. As developers increasingly become prime targets for cyber adversaries, this incident highlights the necessity for enhanced vigilance, robust security practices, and collaborative efforts to protect the integrity of open-source ecosystems and prevent similar future threats.
3 months ago
Kill Chain
Anthropic's AI Model Uncovers Thousands of Software Vulnerabilities
In April 2026, Anthropic launched Project Glasswing, utilizing its advanced AI model, Claude Mythos Preview, to identify vulnerabilities in critical software systems. Within the first month, the initiative uncovered over 10,000 high- or critical-severity vulnerabilities across various platforms, including major operating systems and web browsers. Notably, partners like Cloudflare reported discovering 2,000 bugs, with 400 classified as high or critical severity. This rapid identification underscores the model's capability to detect longstanding vulnerabilities that have eluded traditional methods. The surge in discovered vulnerabilities has shifted the cybersecurity focus from detection to remediation. The bottleneck now lies in the human capacity to triage, report, and deploy patches for these issues. As AI models like Mythos become more prevalent, organizations must adapt their security strategies to address the increasing volume of vulnerabilities and the urgency of timely patching.
3 months ago
Kill Chain
Anthropic's Claude Mythos: Revolutionizing Cybersecurity with AI
In April 2026, Anthropic introduced 'Claude Mythos,' an advanced AI model with exceptional capabilities in identifying and exploiting software vulnerabilities. The model demonstrated the ability to autonomously develop sophisticated cyberattacks, raising significant concerns about its potential misuse. To mitigate these risks, Anthropic restricted public access to Mythos, collaborating with select partners through Project Glasswing to enhance cybersecurity defenses. ([euronews.com](https://www.euronews.com/next/2026/04/08/why-anthropics-most-powerful-ai-model-mythos-preview-is-too-dangerous-for-public-release?utm_source=openai)) The emergence of AI models like Claude Mythos signifies a paradigm shift in cybersecurity, where AI can both uncover and exploit vulnerabilities at unprecedented speeds. This development underscores the urgent need for robust security measures and proactive strategies to address the dual-use nature of such technologies. ([cfr.org](https://www.cfr.org/articles/six-reasons-claude-mythos-is-an-inflection-point-for-ai-and-global-security?utm_source=openai))
3 months ago
Kill Chain
Lazarus Group's RemotePE: A New Memory-Only Threat to Financial Institutions
In May 2026, cybersecurity researchers uncovered a sophisticated attack campaign by the North Korean state-sponsored Lazarus Group targeting financial and cryptocurrency organizations. The group deployed a cross-platform, memory-only Remote Access Trojan (RAT) named RemotePE, which operates entirely in memory, leaving no artifacts on the filesystem. The attack chain involves two loaders: DPAPILoader, which decrypts and loads RemotePELoader using the Windows Data Protection API, and RemotePELoader, which contacts a command-and-control server to fetch and execute RemotePE in memory. This multi-stage approach allows the malware to evade traditional detection mechanisms and maintain persistent access to compromised systems. ([thehackernews.com](https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html?utm_source=openai)) The discovery of RemotePE highlights the Lazarus Group's continued evolution in cyber-attack methodologies, emphasizing the need for organizations to adopt advanced threat detection and response strategies. The use of memory-only malware underscores the importance of monitoring in-memory activities and implementing robust endpoint detection and response (EDR) solutions to detect and mitigate such sophisticated threats.
3 months ago
Kill Chain
AI Model Identifies Over 10,000 Critical Software Vulnerabilities in One Month
In April 2026, Anthropic launched Project Glasswing, utilizing its advanced AI model, Claude Mythos Preview, to autonomously identify vulnerabilities in critical software. Within a month, the initiative uncovered over 10,000 high- or critical-severity flaws across major operating systems and web browsers. Notably, the AI detected a 27-year-old bug in OpenBSD and a 16-year-old issue in FFmpeg, highlighting its unprecedented detection capabilities. This rapid discovery rate has effectively ended the traditional "patch window," as over 99% of the identified vulnerabilities remain unpatched, posing significant risks to global economies, public safety, and national security. The emergence of AI-driven vulnerability discovery tools like Claude Mythos Preview signifies a paradigm shift in cybersecurity. While these tools enhance defensive capabilities, they also compress the timeline between vulnerability discovery and potential exploitation. Organizations must adapt by implementing resilience-based security models, hardening binaries, and adopting runtime protections to mitigate the risks associated with this accelerated threat landscape.
4 months ago
Kill Chain
Understanding Stack String Obfuscation: A New Challenge in Malware Detection
In May 2026, cybersecurity researchers highlighted the 'stack string' obfuscation technique, where malware dynamically constructs strings on the stack at runtime, evading detection by static analysis tools. This method involves assembling strings character-by-character directly onto the stack, making them invisible to traditional string extraction utilities. The technique poses significant challenges for malware analysts and underscores the need for advanced detection methods. The resurgence of stack string obfuscation reflects a broader trend of malware authors adopting sophisticated evasion tactics. As traditional detection tools become less effective against such techniques, there is an urgent need for enhanced analysis tools and methodologies to identify and mitigate these evolving threats.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports