Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Phishing Campaigns Overwhelm SOC Analysts in 2026
In early 2026, cybersecurity firms observed a surge in sophisticated phishing campaigns designed not only to deceive employees but also to inundate Security Operations Centers (SOCs) with an overwhelming volume of alerts. Attackers utilized automated tools to dispatch thousands of phishing emails, many of which were low-sophistication lures intended to flood SOCs with reports. Amidst this deluge, highly targeted spear-phishing emails were sent to individuals with critical system access, effectively camouflaging these high-risk threats within the noise. This tactic led to significant delays in threat detection and response, increasing the likelihood of successful breaches. This trend underscores a critical shift in cyberattack strategies, where adversaries exploit the operational limitations of SOCs, particularly their capacity to process high volumes of alerts. The effectiveness of these campaigns highlights the urgent need for organizations to enhance their SOC capabilities, incorporating advanced automation and AI-driven tools to manage alert triage efficiently and mitigate the risk of alert fatigue among analysts.
6 months ago
Kill Chain
Xygeni GitHub Action Compromised via Tag Poisoning in 2026
In early March 2026, Xygeni's GitHub Action, xygeni-action, was compromised through a tag poisoning attack. An attacker with access to compromised credentials created pull requests injecting obfuscated shell code into action.yml. Although these pull requests were blocked by branch protection rules and not merged into the main branch, the attacker exploited the compromised GitHub App credentials to move the mutable v5 tag to point at a malicious commit. This allowed any workflow referencing xygeni/xygeni-action@v5 to fetch and execute the compromised code, resulting in a supply chain compromise via tag poisoning. Workflows using xygeni/xygeni-action@v5 during the affected window (approximately March 3–10, 2026) executed a command-and-control (C2) implant that granted the attacker arbitrary command execution on the CI runner for up to 180 seconds per workflow run. This incident underscores the critical need for robust security measures in CI/CD pipelines to prevent similar supply chain attacks.
6 months ago
Kill Chain
Mirai Botnet 2016: A Wake-Up Call for IoT Security
In October 2016, the Mirai botnet exploited default credentials on IoT devices to orchestrate one of the largest Distributed Denial-of-Service (DDoS) attacks in history. By scanning the internet for devices with open Telnet ports and using a list of common default usernames and passwords, Mirai infected hundreds of thousands of devices, including routers and IP cameras. These compromised devices were then used to launch massive DDoS attacks, notably targeting DNS provider Dyn, which resulted in widespread internet outages affecting major websites like Twitter, Netflix, and Amazon. The incident underscored the critical security risk posed by default credentials in IoT devices and highlighted the need for manufacturers and users to implement stronger security practices. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Mirai_%28malware%29?utm_source=openai)) The Mirai attack remains relevant today as IoT device proliferation continues, with many devices still shipping with default credentials. Recent studies indicate that a significant percentage of IoT devices retain factory-default passwords, making them susceptible to similar exploitation. This ongoing vulnerability emphasizes the importance of changing default credentials and implementing robust security measures to protect against potential large-scale cyberattacks. ([vulnsy.com](https://www.vulnsy.com/vulnerabilities/default-and-weak-iot-credentials?utm_source=openai))
6 months ago
Kill Chain
Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets
In early March 2026, cybersecurity researchers identified a coordinated supply chain attack involving five malicious Rust crates—'chrono_anchor', 'dnp3times', 'time_calibrator', 'time_calibrators', and 'time-sync'—that masqueraded as time-related utilities. These crates exfiltrated sensitive '.env' files containing developer secrets to attacker-controlled infrastructure. Concurrently, an AI-powered bot named 'hackerbot-claw' exploited misconfigured GitHub Actions workflows in major open-source repositories, achieving remote code execution and stealing access tokens. This bot targeted repositories from organizations such as Microsoft, Datadog, and Aqua Security, leading to unauthorized code execution and potential repository takeovers. These incidents underscore the escalating threats to software supply chains, particularly through the exploitation of CI/CD pipeline vulnerabilities and the use of AI-driven automation in cyber attacks. Organizations must prioritize securing their development environments by auditing dependencies, implementing strict access controls, and continuously monitoring for anomalous activities to mitigate such risks.
6 months ago
Kill Chain
UNC6426's Rapid Exploitation of nx npm Supply Chain: A 72-Hour Breach to AWS Admin Access
In August 2025, the threat actor UNC6426 exploited a supply chain vulnerability in the nx npm package to infiltrate a victim's cloud environment. The attackers published malicious versions of the nx package, which, when installed, exfiltrated developer credentials, including GitHub tokens. Utilizing these stolen tokens, UNC6426 gained unauthorized access to the victim's GitHub account, abused the GitHub-to-AWS OpenID Connect (OIDC) trust relationship to create a new AWS administrator role, and within 72 hours, exfiltrated data from Amazon S3 buckets and destroyed production environments. This incident underscores the escalating sophistication of supply chain attacks, where attackers leverage trusted relationships between development tools and cloud services to escalate privileges rapidly. The breach highlights the critical need for organizations to implement stringent security measures, such as enforcing the principle of least privilege, regularly rotating credentials, and monitoring for anomalous activities within their CI/CD pipelines and cloud environments.
6 months ago
Kill Chain
APT28's 2026 Espionage Campaign: Exploiting Office Vulnerabilities with Advanced Malware
In early 2026, the Russian state-sponsored threat actor APT28, also known as Fancy Bear, launched a sophisticated cyber-espionage campaign targeting Ukrainian military personnel. The attackers utilized spear-phishing emails containing malicious Microsoft Office documents to exploit the CVE-2026-21509 vulnerability, allowing them to execute code via OLE objects without macros or warnings. This method facilitated the deployment of two advanced malware implants: BeardShell, a custom C++ backdoor leveraging the Icedrive cloud service for command-and-control communications, and Covenant, a heavily modified open-source .NET post-exploitation framework. These tools enabled APT28 to conduct long-term surveillance, data exfiltration, and maintain persistent access to compromised systems. ([cyberpress.org](https://cyberpress.org/apt28-exploits-office-vulnerability/?utm_source=openai)) This incident underscores a significant evolution in APT28's tactics, techniques, and procedures (TTPs), highlighting their ability to rapidly weaponize newly disclosed vulnerabilities and integrate legitimate cloud services into their command-and-control infrastructure. The campaign's success emphasizes the urgent need for organizations to promptly apply security patches, enhance phishing defenses, and monitor for abuse of legitimate services in cyber operations. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/03/10/sednit-espionage-toolkit-stealing-data/?utm_source=openai))
6 months ago
Kill Chain
APT28's Exploitation of Microsoft Office Vulnerability: A Deep Dive
In early 2026, the Russian state-sponsored hacking group APT28, also known as Fancy Bear, exploited a newly disclosed Microsoft Office vulnerability (CVE-2026-21509) to target Ukrainian government agencies. The attackers distributed malicious documents via phishing emails, leading to the deployment of the COVENANT malware framework and the BEARDSHELL backdoor, facilitating long-term surveillance and data exfiltration. This campaign underscores the rapid weaponization of zero-day vulnerabilities by nation-state actors and highlights the persistent cyber threats facing governmental institutions. Organizations are urged to promptly apply security patches and enhance their cybersecurity measures to mitigate such sophisticated attacks.
6 months ago
Kill Chain
Unveiling 'Zombie ZIP': A New Frontier in Malware Evasion
In March 2026, security researcher Chris Aziz unveiled a novel malware evasion technique termed 'Zombie ZIP.' This method involves manipulating ZIP file headers to mislead antivirus and endpoint detection systems into treating compressed malicious payloads as uncompressed data. Consequently, security tools scan the files without detecting the embedded threats. The technique proved effective against 50 out of 51 antivirus engines tested on VirusTotal. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-zombie-zip-technique-lets-malware-slip-past-security-tools/?utm_source=openai)) The emergence of 'Zombie ZIP' underscores the evolving sophistication of malware delivery methods, highlighting the need for enhanced detection mechanisms capable of identifying such deceptive techniques. Organizations must stay vigilant and update their security protocols to counteract these advanced evasion strategies.
6 months ago
Kill Chain
BlackSanta EDR Killer: A New Threat to HR Departments in 2026
In March 2026, a sophisticated cyberattack campaign was uncovered targeting human resources (HR) departments. Russian-speaking threat actors distributed malware via spear-phishing emails containing ISO image files disguised as resumes. Upon execution, these files initiated a multi-stage infection chain, culminating in the deployment of 'BlackSanta,' an Endpoint Detection and Response (EDR) killer. BlackSanta disabled security solutions by terminating antivirus processes, shutting down EDR agents, and suppressing system logging, allowing attackers to exfiltrate sensitive data undetected. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blacksanta-edr-killer-spotted-targeting-hr-departments/?utm_source=openai)) This incident underscores a growing trend of cybercriminals exploiting HR workflows to infiltrate organizations. The use of advanced evasion techniques, such as steganography and DLL sideloading, highlights the increasing sophistication of these attacks. Organizations must enhance security measures within HR processes to mitigate such threats. ([darkreading.com](https://www.darkreading.com/threat-intelligence/blacksanta-edr-killer-hr-workflows?utm_source=openai))
6 months ago
Kill Chain
APT28's Stealthy Cyber-Espionage Tactics Target Ukrainian Military in 2026
In April 2024, the Russian state-sponsored hacking group APT28 initiated a cyber-espionage campaign targeting Ukrainian military personnel. Utilizing spear-phishing messages sent via the Signal messaging app, attackers distributed malicious Microsoft Word documents embedded with macros. Once enabled, these macros triggered a multi-stage infection chain, deploying the COVENANT framework and the BEARDSHELL backdoor. The malware leveraged legitimate cloud services like Icedrive and Koofr for command-and-control communications, facilitating long-term surveillance and data exfiltration. ([thehackernews.com](https://thehackernews.com/2026/03/apt28-uses-beardshell-and-covenant.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored actors, who increasingly exploit trusted platforms and sophisticated obfuscation techniques to evade detection. The use of legitimate cloud services for command-and-control highlights the challenges in distinguishing malicious activity from normal network traffic, emphasizing the need for advanced threat detection mechanisms. ([scworld.com](https://www.scworld.com/news/fancy-bear-attacks-abuse-office-macros-legitimate-cloud-services?utm_source=openai))
6 months ago
Kill Chain
FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials
In early 2026, threat actors exploited vulnerabilities and weak credentials in FortiGate Next-Generation Firewall (NGFW) appliances to breach networks across healthcare, government, and managed service providers. By accessing these devices, attackers extracted configuration files containing service account credentials and network topology information, enabling unauthorized access to Active Directory environments and the enrollment of rogue workstations. The breaches were detected during lateral movement phases, preventing further escalation. ([sentinelone.com](https://www.sentinelone.com/blog/fortigate-edge-intrusions/?utm_source=openai)) This incident underscores the critical importance of securing network infrastructure devices, as their compromise can lead to significant data breaches and operational disruptions. The exploitation of such devices highlights the evolving tactics of threat actors targeting essential security appliances to gain deeper access into organizational networks. ([sentinelone.com](https://www.sentinelone.com/blog/fortigate-edge-intrusions/?utm_source=openai))
6 months ago
Kill Chain
BlackSanta Malware: A New Era of Targeted Cyber Threats in HR Workflows
In early 2026, Russian-speaking threat actors initiated the 'BlackSanta' campaign, targeting human resources (HR) workflows to deploy sophisticated malware capable of disabling endpoint detection and response (EDR) systems. The attack begins with resume-themed ISO files delivered through recruitment channels, which, when opened, execute malicious shortcuts that trigger a multi-stage infection chain. This chain includes obfuscated PowerShell commands extracting payloads from steganographic images and sideloading malicious DLLs via legitimate applications. Once executed, the malware performs extensive validation to evade analysis environments before deploying the 'BlackSanta' EDR killer. This component loads legitimate but exploitable kernel drivers to gain low-level system access, subsequently disabling security protections, including antivirus processes, EDR agents, and system logging. This enables attackers to exfiltrate sensitive data over encrypted HTTPS channels with minimal detection risk. The campaign underscores the increasing sophistication of cyber threats targeting operational business workflows, particularly in HR environments. Organizations are advised to apply rigorous security measures to HR systems, including enhanced endpoint protections, monitoring for unusual activity, and increasing security awareness among recruiting teams to mitigate such attacks.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports