Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Trellix Source Code Breach: A Wake-Up Call for Cybersecurity Firms
In April 2026, cybersecurity firm Trellix experienced unauthorized access to a portion of its source code repository. The breach was publicly disclosed on May 1, 2026, with Trellix stating that forensic experts and law enforcement were engaged immediately. The company reported no evidence that its source code release or distribution processes were affected or that the source code had been exploited. Subsequently, the RansomHouse threat group claimed responsibility for the intrusion, alleging that the attack occurred on April 17 and resulted in data encryption. They published screenshots suggesting access to Trellix's appliance management system, though the authenticity of these claims remains unverified. This incident underscores the escalating trend of cybercriminals targeting cybersecurity vendors to exploit their products and services. The breach highlights the critical need for robust internal security measures within security firms, as unauthorized access to source code can potentially lead to the discovery of vulnerabilities, enabling attackers to develop sophisticated exploits or conduct supply chain attacks.
4 months ago
Kill Chain
TCLBANKER: A New Threat to Financial Platforms via WhatsApp and Outlook
In May 2026, Elastic Security Labs identified a new Brazilian banking trojan named TCLBANKER, which targets 59 banking, fintech, and cryptocurrency platforms. The malware is distributed through a trojanized Logitech installer and employs advanced anti-analysis techniques. Once installed, TCLBANKER monitors browser activity and overlays fraudulent interfaces to steal user credentials. Additionally, it propagates via WhatsApp and Outlook by sending malicious links to the victim's contacts, facilitating further infections. This incident underscores the evolving sophistication of banking trojans, particularly in their use of legitimate applications for distribution and self-propagation through popular communication platforms. Organizations must enhance their security measures to detect such advanced threats and educate users on recognizing and avoiding malicious links.
4 months ago
Kill Chain
Karakurt Ransomware Negotiator Sentenced to 102 Months in Prison
In May 2026, Latvian national Deniss Zolotarjovs was sentenced to 102 months in U.S. federal prison for his role as a negotiator in the Karakurt ransomware group. Operating between June 2021 and August 2023, Zolotarjovs was instrumental in extorting over 54 companies, leading to more than $56 million in losses. He employed aggressive tactics, including leveraging sensitive data such as children's health records, to pressure victims into paying ransoms. This sentencing marks a significant milestone in the fight against international cybercrime, highlighting the global reach of law enforcement agencies in apprehending and prosecuting cybercriminals. The case underscores the persistent threat posed by ransomware groups and the importance of robust cybersecurity measures to protect sensitive information.
4 months ago
Kill Chain
Fake Claude AI Website Distributes Beagle Windows Malware
In May 2026, a fraudulent website mimicking the legitimate Claude AI platform offered a malicious download named 'Claude-Pro Relay,' which installed a previously undocumented Windows backdoor called 'Beagle.' The attackers advertised this software as a high-performance relay service for Claude-Code developers. Upon execution, the installer added files to the Startup folder, enabling persistent remote access through the Beagle backdoor, which supports commands like executing system commands, file manipulation, and directory operations. The campaign utilized DLL sideloading techniques involving a signed G Data updater to deploy the malware, with command-and-control communications secured via AES encryption over TCP and UDP protocols. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/amp/?utm_source=openai)) This incident underscores the growing trend of cybercriminals exploiting the popularity of AI platforms to distribute malware. The use of sophisticated techniques such as DLL sideloading and encrypted communications highlights the evolving nature of threats targeting both individual users and organizations. Vigilance in verifying software sources and monitoring for unusual system behavior remains crucial in mitigating such risks.
4 months ago
Kill Chain
Crypto Gang Member Sentenced for $250M Heist Involving Physical Burglaries
Between late 2023 and early 2025, a criminal network orchestrated a sophisticated scheme combining social engineering, hacking, and physical burglaries to steal over $250 million in cryptocurrency from victims across the United States. When digital methods failed, the group relied on Marlon Ferro, known online as 'GothFerrari,' to physically break into victims' homes and steal hardware wallets containing substantial digital assets. Ferro's actions included a February 2024 burglary in Texas, where he stole a wallet with approximately 100 Bitcoins, then valued at over $5 million. In May 2026, Ferro was sentenced to 78 months in federal prison, ordered to pay $2.5 million in restitution, and serve three years of supervised release. This case underscores the evolving tactics of cybercriminals who blend online fraud with traditional burglary to exploit vulnerabilities in digital asset security. It highlights the critical need for robust security measures, including physical safeguards for hardware wallets, to protect against such multifaceted threats.
4 months ago
Kill Chain
PCPJack Worm: A New Threat to Cloud Infrastructures
In May 2026, a new malware framework named PCPJack was discovered targeting exposed cloud infrastructures, including services like Docker, Kubernetes, Redis, MongoDB, and RayML. The malware infiltrates Linux-based cloud systems via a shell script, establishes persistence, and orchestrates credential theft at scale. Notably, PCPJack actively removes existing infections from the TeamPCP group, a known threat actor responsible for previous high-profile supply-chain breaches. This suggests that PCPJack may have been developed by a former TeamPCP affiliate or member who started their own operation. The emergence of PCPJack highlights the evolving landscape of cyber threats, where malware not only seeks to exploit systems but also competes with other malicious actors for control. This trend underscores the need for organizations to implement robust security measures, including multi-factor authentication, proper service authentication, and adherence to the principle of least privilege, to protect against such sophisticated attacks.
4 months ago
Kill Chain
Critical PAN-OS Vulnerability (CVE-2026-0300) Under Active Exploitation
In early May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in its PAN-OS software's User-ID Authentication Portal service. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Active exploitation of this vulnerability has been observed, with threat actors gaining unauthorized access to affected devices. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The exploitation of CVE-2026-0300 underscores a growing trend of attackers targeting edge-network devices, such as firewalls and routers, which often lack robust logging and security agents. Organizations must prioritize securing these assets to prevent unauthorized access and potential data breaches. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))
4 months ago
Kill Chain
OceanLotus's 2025 PyPI Supply Chain Attack: Unveiling the ZiChatBot Malware
In July 2025, the OceanLotus APT group initiated a supply chain attack by uploading malicious Python wheel packages to the Python Package Index (PyPI). These packages, named 'uuid32-utils', 'colorinal', and 'termncolor', acted as droppers for a previously unknown malware family called ZiChatBot, targeting both Windows and Linux platforms. The infection chain involved extracting a DLL or .SO dropper from the wheel package, establishing persistence via registry (Windows) or crontab (Linux), and deploying ZiChatBot. Notably, ZiChatBot utilized Zulip's public REST APIs as its command and control infrastructure, deviating from traditional dedicated servers and complicating detection efforts. The malicious packages were swiftly removed from PyPI, and the associated Zulip organization was deactivated. To date, no confirmed infections have been reported. This campaign underscores OceanLotus's expanding strategy of leveraging supply chain attacks to target a global audience, following a similar GitHub-based phishing campaign earlier in 2025.
4 months ago
Kill Chain
Critical Spring Security Vulnerability CVE-2026-22732: What You Need to Know
In March 2026, a critical vulnerability identified as CVE-2026-22732 was discovered in Spring Security versions 5.7.0 through 7.0.3. This flaw causes HTTP response headers specified for servlet applications to be omitted, potentially exposing applications to attacks such as Cross-Site Scripting (XSS) and clickjacking. The vulnerability affects applications using the default lazy writing of HTTP headers, leading to the absence of essential security headers in responses. ([spring.io](https://spring.io/security/cve-2026-22732?utm_source=openai)) The omission of these headers undermines client-side protections, increasing the risk of sensitive data exposure and other security breaches. Organizations utilizing affected versions of Spring Security are urged to upgrade to the latest patched versions or apply recommended workarounds to mitigate this risk. ([spring.io](https://spring.io/security/cve-2026-22732?utm_source=openai))
4 months ago
Kill Chain
Quasar Linux Malware: A New Threat to Software Developers in 2026
In May 2026, cybersecurity researchers identified Quasar Linux (QLNX), a sophisticated malware targeting software developers' systems. QLNX combines rootkit, backdoor, and credential-stealing functionalities, deploying across development environments like npm, PyPI, GitHub, AWS, Docker, and Kubernetes. It achieves stealth and persistence through in-memory execution, log wiping, process name spoofing, and multiple persistence mechanisms, including LD_PRELOAD and systemd. The malware's capabilities include interactive shell access, file and process management, credential harvesting (SSH keys, browser data, cloud configurations), keylogging, and lateral movement via SSH-based techniques. By compromising developer workstations, QLNX poses a significant supply chain risk, potentially enabling attackers to publish malicious packages to public repositories. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-stealthy-quasar-linux-malware-targets-software-developers/amp/?utm_source=openai)) The emergence of QLNX underscores a growing trend of sophisticated malware targeting development environments to facilitate supply chain attacks. This incident highlights the critical need for enhanced security measures within software development pipelines to prevent unauthorized access and mitigate potential threats to software supply chains.
4 months ago
Kill Chain
ScarCruft's Supply Chain Attack: Deploying BirdCall Malware via Gaming Platform
In late 2024, the North Korea-aligned advanced persistent threat group ScarCruft executed a supply chain attack on the gaming platform sqgame[.]net, which serves ethnic Koreans in China's Yanbian region. The attackers compromised the platform's Windows client through a malicious update, introducing the RokRAT backdoor that subsequently deployed the more sophisticated BirdCall malware. Additionally, Android games available on the platform were trojanized to include an Android variant of BirdCall. This malware enabled extensive surveillance capabilities, including the collection of personal data, documents, screenshots, and voice recordings. The campaign's primary objective appears to be espionage, likely targeting individuals of interest to the North Korean regime, such as refugees or defectors. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/05/05/3288022/0/en/north-korea-aligned-apt-group-scarcruft-compromises-gaming-platform-in-supply-chain-espionage-attack-eset-research-finds.html?utm_source=openai)) This incident underscores the evolving threat landscape, where state-sponsored actors are increasingly leveraging supply chain attacks to infiltrate trusted platforms and distribute malware across multiple operating systems. The use of both Windows and Android variants of BirdCall highlights the adaptability of threat actors in targeting a broad range of devices to achieve their espionage goals. ([thehackernews.com](https://thehackernews.com/2026/05/scarcruft-hacks-gaming-platform-to.html?utm_source=openai))
4 months ago
Kill Chain
Critical cPanel Vulnerability (CVE-2026-41940) Exploited in Government and MSP Networks
In late April 2026, a critical authentication bypass vulnerability (CVE-2026-41940) was discovered in cPanel and WebHost Manager (WHM), widely used web hosting control panels. This flaw allows unauthenticated remote attackers to gain administrative access to servers, potentially compromising all hosted websites and data. ([support.cpanel.net](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026?utm_source=openai)) By early May, threat actors exploited this vulnerability to target government and military entities in Southeast Asia, as well as managed service providers (MSPs) and hosting providers in multiple countries, including the U.S. ([thehackernews.com](https://thehackernews.com/2026/05/critical-cpanel-vulnerability.html?utm_source=openai)) The attacks have led to server takeovers, website defacements, and data encryption using ransomware. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/04/multiple-threat-actors-actively-exploit-cpanel-vulnerability-cve-2026-41940/?utm_source=openai)) The rapid exploitation of CVE-2026-41940 underscores the critical need for organizations to promptly apply security patches and review their systems for potential breaches. The widespread use of cPanel and WHM amplifies the risk, making it imperative for all users to ensure their installations are updated to the latest secure versions. ([techcrunch.com](https://techcrunch.com/2026/04/30/hackers-are-actively-exploiting-a-bug-in-cpanel-used-by-millions-of-websites/?utm_source=openai))
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports