Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
GlassWorm Malware Resurfaces: 73 OpenVSX Sleeper Extensions Compromise Developer Security
In April 2026, the GlassWorm malware campaign resurfaced, targeting the OpenVSX ecosystem with 73 'sleeper' extensions. Initially benign, these extensions were later updated to deliver malicious payloads, compromising developer environments. Six of these extensions have been activated, while the remaining are considered suspicious. This tactic involves cloning legitimate extensions to deceive developers, leading to the theft of sensitive data such as cryptocurrency wallets and credentials. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, highlighting the need for vigilant monitoring of software dependencies. The use of 'sleeper' extensions that activate malicious behavior post-installation represents a sophisticated method to evade initial detection, posing significant risks to software development environments.
4 months ago
Kill Chain
Sentencing in $230M Cryptocurrency Heist Highlights Social Engineering Threats
In April 2026, Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison for laundering at least $3.5 million in stolen cryptocurrency. This was part of a larger criminal enterprise that, between October 2023 and May 2025, stole over $263 million through social engineering tactics, including impersonating customer support to gain access to victims' cryptocurrency wallets. The stolen funds financed extravagant lifestyles, with expenditures on luxury cars, high-end real estate, and lavish parties. ([justice.gov](https://www.justice.gov/usao-dc/pr/california-money-launderer-sentenced-dc-70-months-role-scheme-stole-263-million?utm_source=openai)) This case underscores the growing sophistication of cybercriminals in exploiting social engineering techniques to execute large-scale financial thefts. It highlights the urgent need for enhanced security measures and user education to prevent such attacks, especially as the cryptocurrency market continues to expand and attract both legitimate investors and malicious actors.
4 months ago
Kill Chain
After Mythos: New Playbooks For a Zero-Window Era
In April 2026, Anthropic's AI model, Claude Mythos, autonomously identified thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability led to the formation of Project Glasswing, a collaborative initiative involving tech giants like Apple, Google, and JPMorgan Chase, aiming to patch vulnerabilities faster than AI can discover them. However, unauthorized access to Mythos raised significant security concerns, highlighting the potential risks of such powerful AI tools. ([anthropic.com](https://www.anthropic.com/glasswing?utm_source=openai)) The incident underscores the urgent need for robust security protocols in AI development and deployment. As AI models become more sophisticated, ensuring their secure use is paramount to prevent potential misuse and safeguard critical infrastructure.
4 months ago
Kill Chain
Checkmarx 2026 LAPSUS$ Supply Chain Attack: A Detailed Analysis
In March 2026, application security firm Checkmarx experienced a significant security breach when the LAPSUS$ threat group exploited credentials obtained from the Trivy supply chain attack, attributed to TeamPCP. This access allowed the attackers to infiltrate Checkmarx's GitHub repositories, leading to the publication of malicious code and the subsequent leak of sensitive data. The compromised data, totaling 96GB, was later made available on both dark web and clearnet platforms. Checkmarx has confirmed that the leaked data originated from their GitHub repository and is actively investigating the incident to assess the full scope of the breach. This incident underscores the escalating threat posed by supply chain attacks, where compromising a single component can have cascading effects across multiple organizations. The Checkmarx breach highlights the critical need for robust security measures within development pipelines and the importance of securing third-party tools to prevent unauthorized access and data exfiltration.
4 months ago
Kill Chain
CISA Mandates Immediate Patching of 'BlueHammer' Vulnerability in Microsoft Defender
In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) mandated that U.S. federal agencies patch a critical vulnerability in Microsoft Defender, known as 'BlueHammer' and tracked as CVE-2026-33825. This flaw allows low-privileged local attackers to escalate their privileges to SYSTEM level by exploiting insufficient access control mechanisms. The vulnerability was publicly disclosed by a researcher named 'Chaotic Eclipse' after expressing dissatisfaction with Microsoft's vulnerability disclosure process. Microsoft addressed the issue in their April 14, 2026, Patch Tuesday release. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-microsoft-defender-flaw-exploited-in-zero-day-attacks/?utm_source=openai)) The urgency of this directive underscores the increasing trend of zero-day vulnerabilities being exploited in the wild, highlighting the necessity for organizations to promptly apply security patches. The incident also brings attention to the challenges in vulnerability disclosure processes and the potential risks associated with public disclosures of unpatched vulnerabilities.
5 months ago
Kill Chain
Checkmarx KICS Supply Chain Breach: A 2026 Case Study
In April 2026, Checkmarx's KICS analysis tool suffered a significant supply chain attack. Threat actors compromised Docker images and VS Code extensions associated with KICS, embedding malware designed to harvest sensitive data from developer environments. The malware targeted credentials such as GitHub tokens, cloud service keys, and SSH keys, exfiltrating them to domains mimicking legitimate Checkmarx infrastructure. The breach was active between April 22, 2026, 14:17:59 UTC and April 22, 2026, 15:41:31 UTC, during which malicious artifacts were distributed through official channels. This incident underscores the escalating trend of supply chain attacks targeting development tools, emphasizing the need for enhanced security measures in software distribution pipelines. Organizations must remain vigilant, as such attacks can lead to widespread credential theft and unauthorized access to critical systems.
5 months ago
Kill Chain
Bitwarden CLI npm Package Compromised in Supply Chain Attack
In April 2026, attackers compromised Bitwarden's CLI by uploading a malicious version (2026.4.0) to npm, available between 5:57 PM and 7:30 PM ET on April 22. The malicious package contained credential-stealing malware that harvested developer secrets, including npm tokens, GitHub authentication tokens, SSH keys, and cloud credentials. The malware exfiltrated this data by creating public GitHub repositories under the victim's account. Bitwarden confirmed the incident, stating that the breach was limited to the npm distribution channel for the CLI and did not affect end-user vault data or production systems. The company revoked compromised access, deprecated the malicious release, and initiated remediation steps immediately. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/bitwarden-cli-npm-package-compromised-to-steal-developer-credentials/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting developer tools and CI/CD pipelines. Organizations must enhance their security measures to protect against such vulnerabilities, as similar attacks have been linked to the threat actor known as TeamPCP, who previously targeted developer packages in other supply chain attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/bitwarden-cli-npm-package-compromised-to-steal-developer-credentials/?utm_source=openai))
5 months ago
Kill Chain
Project Glasswing: AI's Role in Cybersecurity Vulnerability Detection
In April 2026, Anthropic unveiled Project Glasswing, a collaborative initiative with major technology companies such as Amazon, Apple, Microsoft, and Cisco, aimed at enhancing cybersecurity defenses through advanced AI. Central to this project is Claude Mythos Preview, an unreleased AI model that autonomously identified thousands of previously undetected vulnerabilities across critical software systems, including a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg. To mitigate potential misuse, Anthropic has restricted access to this powerful model to select partners and committed significant resources to support open-source security organizations. This initiative underscores the growing importance of AI in cybersecurity, highlighting both its potential to fortify defenses and the risks associated with its misuse. As AI capabilities advance, the industry faces the dual challenge of leveraging these tools for protection while preventing their exploitation by malicious actors.
5 months ago
Kill Chain
GopherWhisper APT Exploits Go-Based Backdoors to Target Mongolian Government
In January 2025, ESET researchers identified a previously undocumented China-aligned advanced persistent threat (APT) group named GopherWhisper targeting Mongolian governmental institutions. The group employs a suite of tools primarily written in Go, including injectors and loaders, to deploy various backdoors such as LaxGopher, RatGopher, and BoxOfFriends. GopherWhisper leverages legitimate services like Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control (C&C) communications and data exfiltration. The group's activities have been ongoing since at least November 2023, compromising at least 12 systems within a Mongolian government entity. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/04/23/3279634/0/en/ESET-Research-discovers-new-China-aligned-group-GopherWhisper-It-abuses-messaging-services-Discord-Slack-and-Outlook-to-spy.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who exploit widely used communication platforms to evade detection. The use of Go-based malware highlights a trend towards more versatile and cross-platform attack tools, posing significant challenges for traditional security measures. Organizations must adapt their defenses to address these sophisticated techniques.
5 months ago
Kill Chain
Chinese APT GopherWhisper Exploits Cloud Services in Mongolian Cyber Espionage
In April 2026, ESET researchers uncovered a Chinese advanced persistent threat (APT) group named GopherWhisper targeting Mongolian government institutions. Active since at least November 2023, GopherWhisper deployed multiple custom backdoors—LaxGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor—each utilizing different cloud services like Slack, Discord, Microsoft Outlook, and file.io for command-and-control communications and data exfiltration. This campaign compromised at least 12 systems within a Mongolian governmental institution, with indications of broader impact across the region. This incident underscores a growing trend of APT groups leveraging legitimate cloud services to evade detection and maintain persistent access. Organizations must enhance their monitoring of cloud-based communications and implement robust security measures to detect and mitigate such sophisticated threats.
5 months ago
Kill Chain
Checkmarx Supply Chain Breach: Malicious KICS Docker Images and VS Code Extensions Detected
In April 2026, Checkmarx's supply chain was compromised when attackers uploaded malicious images to the official 'checkmarx/kics' Docker Hub repository. These images, including versions v2.1.20 and a fraudulent v2.1.21, contained modified KICS binaries with unauthorized data collection and exfiltration capabilities. Additionally, certain Visual Studio Code extensions were altered to execute remote code without user consent. Organizations using these compromised tools to scan infrastructure-as-code files risked exposing sensitive credentials and configurations. ([thehackernews.com](https://thehackernews.com/2026/04/malicious-kics-docker-images-and-vs.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools. It highlights the necessity for organizations to implement stringent security measures, such as verifying the integrity of third-party software and continuously monitoring for unauthorized modifications, to safeguard against similar vulnerabilities.
5 months ago
Kill Chain
Insider Threat: Ransomware Negotiator's Guilty Plea in BlackCat Scheme
In April 2026, Angelo Martino, a former ransomware negotiator at DigitalMint, pleaded guilty to conspiring with the BlackCat/ALPHV ransomware group to extort U.S. companies in 2023. Martino exploited his position by providing BlackCat with confidential information about his clients' insurance policy limits and negotiation strategies, enabling the attackers to maximize ransom demands. Alongside co-conspirators Ryan Goldberg and Kevin Martin, Martino participated in deploying ransomware attacks, resulting in at least $1.2 million in Bitcoin payments from a single victim. Law enforcement has seized approximately $10 million in assets from Martino, including digital currency and luxury items. This case underscores the critical risk posed by insider threats within cybersecurity roles. The incident highlights the evolving tactics of ransomware groups and the importance of stringent internal controls to prevent insider collusion. Organizations must reassess their security protocols and ensure clear separation of duties to mitigate such risks.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports