Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 43 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 505–516 / 1289 reports
OpenClaw AI Assistant Vulnerabilities: A Wake-Up Call for AI Security
Computer Software/Engineering4 months ago

OpenClaw AI Assistant Vulnerabilities: A Wake-Up Call for AI Security

In early 2026, multiple critical vulnerabilities were discovered in OpenClaw, a popular open-source AI assistant. These flaws, including CVE-2026-25253, CVE-2026-24763, and CVE-2026-25157, allowed attackers to execute arbitrary code, escalate privileges, and exfiltrate sensitive data. Exploitation of these vulnerabilities led to unauthorized access to over 28,000 systems worldwide, with attackers gaining full control over affected hosts. The widespread deployment of OpenClaw in enterprise environments amplified the impact, exposing numerous organizations to significant security risks. The rapid adoption of AI agents like OpenClaw underscores the urgent need for robust security measures in AI deployments. This incident highlights the importance of comprehensive vulnerability assessments, timely patch management, and stringent access controls to mitigate the risks associated with integrating AI assistants into critical systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Patches Critical RoguePlanet Vulnerability in Defender
Computer/Network Security4 months ago

Microsoft Patches Critical RoguePlanet Vulnerability in Defender

In June 2026, security researcher Chaotic Eclipse disclosed a critical zero-day vulnerability in Microsoft Defender, known as 'RoguePlanet' and tracked as CVE-2026-50656. This flaw, a race condition in the Microsoft Malware Protection Engine, allowed attackers to escalate privileges to SYSTEM level on fully patched Windows 10 and 11 systems. Microsoft acknowledged the vulnerability and released a security update in July 2026 to address the issue. The RoguePlanet exploit underscores the persistent challenges in securing endpoint protection software and highlights the importance of timely vulnerability disclosures and patches. Organizations are reminded to maintain up-to-date security measures and monitor for emerging threats to safeguard their systems.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI's Breakthrough in Firmware Decryption: A Case Study
Computer/Network Security4 months ago

AI's Breakthrough in Firmware Decryption: A Case Study

In 2026, Bishop Fox researchers utilized Anthropic's Claude, an advanced AI model, to autonomously reverse-engineer and decrypt SonicWall's proprietary firmware encryption. Without prior knowledge of the encryption format, Claude successfully traced the decryption logic, reconstructed the master key from embedded Shamir secret shares, and decrypted the firmware image. This achievement highlights the potential of AI in performing complex cybersecurity tasks traditionally requiring senior-level expertise. The experiment underscores the evolving role of AI in cybersecurity, demonstrating that AI models can independently execute sophisticated tasks such as firmware decryption. This advancement prompts a reevaluation of security strategies, emphasizing the need for continuous adaptation to AI capabilities in both offensive and defensive contexts.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
SCMBANKER Malware Targets Mexican Banks Using ClickFix Lures
Banking/Mortgage4 months ago

SCMBANKER Malware Targets Mexican Banks Using ClickFix Lures

In July 2026, a sophisticated cybercriminal operation targeted customers of Mexican financial institutions, including banks, fintech companies, payment processors, and cryptocurrency exchanges. The attackers employed a social engineering technique known as ClickFix, presenting victims with fake CAPTCHA verification pages that instructed them to execute a malicious command. This command installed a PowerShell-based toolkit named SCMBANKER, enabling the threat actors to monitor banking sessions, capture screenshots, manipulate clipboards, and deploy remote access tools for full system control. The campaign, identified by Elastic Security Labs as REF6045, demonstrated a high level of automation and adaptability, with evidence suggesting the use of large language models to develop the malware components. ([thehackernews.com](https://thehackernews.com/2026/07/scmbanker-malware-uses-clickfix-lures.html?utm_source=openai)) This incident underscores the evolving nature of cyber threats targeting the financial sector, particularly in Mexico. The use of AI-assisted malware development and advanced social engineering tactics like ClickFix highlights the need for continuous vigilance and adaptive security measures to protect sensitive financial data and maintain customer trust.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerability in Hitachi Energy e-mesh EMS: CVE-2026-42945
Oil/Energy/Solar/Greentech4 months ago

Critical Vulnerability in Hitachi Energy e-mesh EMS: CVE-2026-42945

In July 2026, Hitachi Energy disclosed a critical vulnerability (CVE-2026-42945) in its e-mesh EMS versions 4.1.6, 4.4.2, and 4.7.0. This heap-based buffer overflow in the NGINX component's ngx_http_rewrite_module allows unauthenticated attackers to send crafted HTTP requests, potentially leading to application crashes and arbitrary code execution. The vulnerability arises when specific rewrite directives are used with unnamed PCRE captures and replacement strings containing a question mark. ([windowsforum.com](https://windowsforum.com/threads/cve-2026-42945-nginx-heap-overflow-hits-hitachi-energy-e-mesh-ems.435597/?utm_source=openai)) This incident underscores the risks of integrating widely-used web components like NGINX into critical infrastructure systems. Organizations must prioritize patching affected systems and reviewing configurations to mitigate potential exploitation, especially in environments where operational technology intersects with standard web technologies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Spain Arrests Alleged Member of Pro-Russian Hacktivist Group in 2026
Utilities4 months ago

Spain Arrests Alleged Member of Pro-Russian Hacktivist Group in 2026

In March 2026, Spanish authorities arrested an alleged member of the pro-Russian hacktivist group Cyber Army of Russia Reborn (CARR) in Palencia, Spain. The arrest followed an investigation initiated by an FBI tip in August 2025. The individual is accused of providing logistical support to a Ukrainian hacker associated with CARR, facilitating their escape to Russia, and participating in cyber activities attributed to the pro-Russian hacktivist group NoName057(16). Authorities seized computers and cryptocurrency storage devices from the suspect's residence and froze a cryptocurrency wallet allegedly used for illicit payments. The suspect faces accusations of collaborating with a terrorist organization, glorifying terrorism, and damaging computers. ([cyberscoop.com](https://cyberscoop.com/spain-arrests-alleged-cyber-army-of-russia-reborn-member/?utm_source=openai)) This arrest underscores the ongoing international efforts to combat cyber threats posed by state-sponsored hacktivist groups targeting critical infrastructure. The collaboration between Spanish authorities and the FBI highlights the importance of cross-border cooperation in addressing cybercrime. Organizations are advised to remain vigilant against such threats and implement robust cybersecurity measures to protect their systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Authentication Bypass Vulnerabilities in BeyondTrust Remote Support
Computer/Network Security4 months ago

Critical Authentication Bypass Vulnerabilities in BeyondTrust Remote Support

In July 2026, BeyondTrust disclosed critical vulnerabilities in its Remote Support (RS) and Privileged Remote Access (PRA) software, notably CVE-2026-40138 and CVE-2026-40139. These flaws, stemming from improper authentication handling, could allow unauthenticated attackers to bypass access controls and gain elevated privileges. Exploitation requires specific authentication configurations to be enabled. BeyondTrust has released patches to address these issues. The disclosure underscores the persistent risks associated with remote access solutions, especially as organizations increasingly rely on them for remote work. Ensuring timely application of security patches and reviewing authentication configurations are crucial to mitigate potential exploitation.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the Cordyceps Vulnerability in GitHub Actions
Computer Software/Engineering4 months ago

Understanding the Cordyceps Vulnerability in GitHub Actions

In June 2026, Novee Security identified a critical vulnerability class in GitHub Actions workflows, termed 'Cordyceps.' This flaw allows unauthenticated attackers to exploit CI/CD pipelines by manipulating untrusted pull requests, leading to unauthorized code execution and potential supply chain compromises. Over 300 repositories, including those of Microsoft, Google, and Apache, were confirmed vulnerable, exposing them to credential theft and malicious code injection. The Cordyceps vulnerability underscores the escalating risks in software supply chains, especially as AI-generated code becomes more prevalent. Traditional security scanners often miss such complex, composition-based flaws, highlighting the need for enhanced security measures in CI/CD workflows to prevent potential large-scale attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Spain Arrests Suspected Member of Pro-Russian Hacktivist Groups
Utilities4 months ago

Spain Arrests Suspected Member of Pro-Russian Hacktivist Groups

In March 2026, Spain's National Police, in collaboration with the FBI, arrested a 34-year-old Italian man in Palencia for his alleged involvement with pro-Russian hacktivist groups, including CyberArmy of Russia Reborn (CARR) and Z-Pentest. The suspect is accused of providing logistical support to a Ukrainian hacker affiliated with CARR, facilitating their escape to Russia via Poland and Belarus. Authorities seized computers and cryptocurrency storage devices during the operation. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spain-arrests-suspected-member-of-pro-russian-hacktivist-groups/?utm_source=openai)) This arrest underscores the ongoing threat posed by pro-Russian hacktivist groups targeting critical infrastructure in the U.S. and Europe. The collaboration between international law enforcement agencies highlights the importance of coordinated efforts to combat cyber threats that exploit geopolitical tensions. ([nsa.gov](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4355881/nsa-fbi-and-others-call-out-pro-russia-hacktivist-groups-targeting-critical-inf/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Armored Likho's 2026 Cyber-Espionage Campaign: BusySnake Infostealer Targets Critical Infrastructure
Utilities4 months ago

Armored Likho's 2026 Cyber-Espionage Campaign: BusySnake Infostealer Targets Critical Infrastructure

In July 2026, the previously unknown APT group 'Armored Likho' launched sophisticated cyber-espionage campaigns targeting government agencies and electric power entities in Russia, Brazil, and Kazakhstan. Utilizing spear-phishing emails disguised as official communications, they deployed the Python-based 'BusySnake' infostealer to exfiltrate sensitive data, including credentials and cryptographic keys. The malware's advanced obfuscation techniques and modular architecture enabled persistent access and evasion of detection mechanisms. This incident underscores the escalating threat posed by APT groups leveraging AI-generated malware to target critical infrastructure. Organizations must enhance their cybersecurity posture to defend against such evolving tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
FreeBSD Kernel Vulnerability CVE-2026-3038: A Critical Security Flaw
Computer/Network Security4 months ago

FreeBSD Kernel Vulnerability CVE-2026-3038: A Critical Security Flaw

In March 2026, a critical vulnerability identified as CVE-2026-3038 was discovered in the FreeBSD kernel's rtsock_msg_buffer() function. This flaw allows unprivileged users to trigger a 127-byte stack buffer overflow, leading to immediate kernel panics by overwriting stack canaries. The vulnerability arises from improper validation of the sockaddr length field, enabling attackers to craft malicious requests that exploit this weakness. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-3038/?utm_source=openai)) The discovery of CVE-2026-3038 underscores the persistent challenges in kernel security, particularly concerning input validation and memory management. This incident highlights the necessity for continuous vigilance and prompt patching to mitigate potential exploits that could lead to system crashes or privilege escalation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Iranian Hackers Deploy Cavern C2 Framework Against Israeli Sectors
Information Technology/IT4 months ago

Iranian Hackers Deploy Cavern C2 Framework Against Israeli Sectors

In early 2026, an Iranian state-sponsored hacking group known as Cavern Manticore targeted Israeli government and IT sectors using a sophisticated modular command-and-control (C2) framework called Cavern. This framework, built on a .NET foundation with multiple compilation formats, enabled the attackers to execute DLL side-loading through SysAid's software update feature, leading to the deployment of various modules for reconnaissance, data theft, and lateral movement. The attack chain involved the execution of a trojanized DLL ('uxtheme.dll') containing the Cavern Agent, which then loaded additional modules to contact the C2 server and fetch further post-exploitation tools. ([research.checkpoint.com](https://research.checkpoint.com/2026/cavern-manticore-exposing-iran-linked-modular-c2-framework/?utm_source=openai)) The incident underscores the evolving tactics of Iranian threat actors, who are increasingly leveraging modular and adaptable toolsets to enhance their cyber espionage capabilities. The use of such frameworks allows for tailored deployments based on victim profiles, reducing forensic visibility and ensuring persistent access. Organizations must remain vigilant and implement robust security measures to defend against these sophisticated threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports