Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 57 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 673–684 / 1289 reports
CI/CD Pipeline Attacks in 2025: Lessons Learned and Future Strategies
Computer Software/Engineering5 months ago

CI/CD Pipeline Attacks in 2025: Lessons Learned and Future Strategies

In 2025, a series of sophisticated cyberattacks targeted Continuous Integration and Continuous Deployment (CI/CD) pipelines, exploiting vulnerabilities within these automated software delivery systems. Attackers gained unauthorized access to build servers and developer environments, injecting malicious code that was seamlessly integrated into legitimate software releases. This method allowed adversaries to distribute malware widely, compromising numerous organizations and leading to significant data breaches and operational disruptions. The incidents underscored the critical need for enhanced security measures within CI/CD processes to prevent such supply chain attacks. These attacks highlight a growing trend where cybercriminals focus on the software supply chain, recognizing the potential to infiltrate multiple organizations through a single compromised pipeline. The increasing reliance on automated development tools necessitates a reevaluation of security protocols to safeguard against such pervasive threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Mesa County Election Data Breach: Lessons in Insider Threats
Government Administration5 months ago

Mesa County Election Data Breach: Lessons in Insider Threats

In 2021, Tina Peters, then the Mesa County Clerk in Colorado, facilitated unauthorized access to the county's voting systems, allowing sensitive election data to be copied and disseminated online. This breach was part of an effort to substantiate unfounded claims of election fraud in the 2020 presidential election. Peters was convicted in 2024 on multiple felony and misdemeanor counts, including attempt to influence a public servant and official misconduct, leading to a nine-year prison sentence. ([apnews.com](https://apnews.com/article/b456ce4f80dc97f4b967eb6297311a51?utm_source=openai)) The incident underscores the critical importance of safeguarding election infrastructure against insider threats. It highlights the potential for significant operational and reputational damage when trusted officials exploit their positions, emphasizing the need for stringent access controls and continuous monitoring within electoral systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
OpenAI's Response to the TanStack npm Supply Chain Attack
Computer Software/Engineering5 months ago

OpenAI's Response to the TanStack npm Supply Chain Attack

In May 2026, OpenAI disclosed that two employee devices were compromised due to a supply chain attack involving the TanStack npm library, part of the broader 'Mini Shai-Hulud' campaign. The attackers published 84 malicious versions across 42 TanStack packages, leading to unauthorized access and credential-focused exfiltration activities. OpenAI's investigation confirmed that only limited credential material was exfiltrated, with no evidence of user data, production systems, or intellectual property being compromised. ([openai.com](https://openai.com/index/our-response-to-the-tanstack-npm-supply-chain-attack/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely used open-source libraries, emphasizing the need for robust security measures in software development and deployment processes. Organizations are urged to enhance their monitoring and validation of third-party components to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
OpenClaw 'Claw Chain' Vulnerabilities: A Wake-Up Call for AI Security
Computer Software/Engineering5 months ago

OpenClaw 'Claw Chain' Vulnerabilities: A Wake-Up Call for AI Security

In May 2026, cybersecurity researchers identified four critical vulnerabilities in OpenClaw, an AI agent framework, collectively termed 'Claw Chain.' These flaws—CVE-2026-44112, CVE-2026-44113, CVE-2026-44115, and CVE-2026-44118—enable attackers to bypass sandbox restrictions, escalate privileges, and establish persistent control over affected systems. Exploitation could lead to unauthorized data access, system configuration tampering, and the planting of backdoors, significantly compromising system integrity and security. The discovery of these vulnerabilities underscores the urgent need for robust security measures in AI agent frameworks. As AI systems become more integrated into critical operations, ensuring their security is paramount to prevent potential exploitation by malicious actors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Alleged Dream Market Administrator Indicted for Money Laundering
Financial Services5 months ago

Alleged Dream Market Administrator Indicted for Money Laundering

In May 2026, Owe Martin Andresen, the alleged main administrator of the defunct darknet marketplace Dream Market, was indicted in the United States on multiple counts of money laundering. Andresen, known by the alias "Speedstepper," is accused of accessing dormant cryptocurrency wallets containing millions of dollars in commission payments from Dream Market, which operated from 2013 until its shutdown in 2019. He allegedly transferred these funds into new cryptocurrency wallets and converted them into gold bars, directing shipments to his residence in Germany. German authorities arrested Andresen on May 7, 2026, under separate charges of concealment money laundering. ([justice.gov](https://www.justice.gov/usao-ndga/pr/german-citizen-charged-laundering-funds-linked-prominent-darknet-marketplace-dream?utm_source=openai)) This case underscores the persistent challenges law enforcement faces in tracking and prosecuting cybercriminals who exploit digital currencies and anonymized platforms to launder illicit proceeds. The indictment highlights the importance of international cooperation in addressing cybercrime and the evolving tactics used by threat actors to obfuscate their activities.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
TeamPCP Hackers Advertise Mistral AI Code Repositories for Sale
Computer Software/Engineering5 months ago

TeamPCP Hackers Advertise Mistral AI Code Repositories for Sale

In May 2026, the TeamPCP hacker group infiltrated Mistral AI's codebase management system, exfiltrating nearly 5 gigabytes of internal repositories and source code. This breach was part of the broader 'Mini Shai-Hulud' supply-chain attack, which compromised official packages from TanStack and Mistral AI through stolen CI/CD credentials and legitimate workflows. The attackers are now demanding $25,000 for the stolen data, threatening to leak it publicly if a buyer isn't found within a week. This incident underscores the escalating threat of supply-chain attacks targeting software development processes. Organizations must prioritize securing their CI/CD pipelines and implement robust monitoring to detect unauthorized access promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
May 2026 Cybersecurity Incidents: PAN-OS RCE Exploitation and AI's Role in Vulnerability Detection
Computer/Network Security5 months ago

May 2026 Cybersecurity Incidents: PAN-OS RCE Exploitation and AI's Role in Vulnerability Detection

In May 2026, multiple critical cybersecurity incidents emerged, notably the exploitation of a buffer overflow vulnerability (CVE-2026-0300) in Palo Alto Networks' PAN-OS User-ID Authentication Portal, allowing unauthenticated attackers to execute arbitrary code with root privileges. Additionally, Anthropic's AI model, Mythos, identified a low-severity vulnerability in the widely-used cURL tool, sparking debates about the efficacy of AI in vulnerability detection. These incidents underscore the persistent challenges in securing network infrastructure and the evolving role of AI in cybersecurity. The active exploitation of the PAN-OS vulnerability highlights the urgency for organizations to apply patches promptly and reassess their exposure to untrusted networks. Simultaneously, the discourse surrounding Mythos's findings emphasizes the need for a balanced approach to integrating AI tools in security workflows, ensuring they complement human expertise without overreliance.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FrostyNeighbor APT's Targeted Cyberespionage Campaign in Poland and Ukraine
Government Administration5 months ago

FrostyNeighbor APT's Targeted Cyberespionage Campaign in Poland and Ukraine

In March 2026, the Belarus-aligned advanced persistent threat (APT) group known as FrostyNeighbor launched a targeted cyberespionage campaign against government organizations in Poland and Ukraine. The attackers employed spear-phishing emails containing blurred PDF attachments that impersonated legitimate entities, such as Ukrainian telecom provider Ukrtelecom. These PDFs included malicious links leading to a multi-stage infection chain, culminating in the deployment of Cobalt Strike for post-compromise operations. Notably, the group implemented server-side victim validation, delivering payloads only to users from specific geographic locations, thereby enhancing the precision and effectiveness of their attacks. This incident underscores the evolving sophistication of nation-state cyber threats, particularly in Eastern Europe. The use of geofencing and advanced spear-phishing techniques highlights the need for organizations to bolster their cybersecurity defenses, especially against highly targeted and adaptive adversaries.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GemStuffer: A New Frontier in Supply Chain Attacks Exploiting RubyGems
Computer Software/Engineering5 months ago

GemStuffer: A New Frontier in Supply Chain Attacks Exploiting RubyGems

In May 2026, a campaign named 'GemStuffer' exploited over 150 RubyGems packages to exfiltrate data scraped from UK local government portals. Unlike typical supply chain attacks that aim to distribute malware to developers, this operation utilized the RubyGems registry as a storage and retrieval channel for the exfiltrated data. The attackers published numerous packages containing scripts that collected public data from government websites and then uploaded this data back to RubyGems, effectively using the platform as a 'dead drop' for data storage. This method allowed the threat actors to bypass traditional command-and-control infrastructures, making detection more challenging. ([thecodingzebra.com](https://www.thecodingzebra.com/cybersecurity/gemstuffer-abuses-150-rubygems/?utm_source=openai)) This incident underscores a novel abuse of software package registries, highlighting the need for enhanced monitoring and security measures within these ecosystems. The use of legitimate platforms for data exfiltration represents an evolution in threat actor tactics, emphasizing the importance of vigilance in software supply chain security. ([cyberleveling.com](https://cyberleveling.com/blog/rubygems-gemstuffer-supply-chain-2026?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(low)
Read report
Ghostwriter's Geofenced Phishing Attack on Ukrainian Government
Government Administration5 months ago

Ghostwriter's Geofenced Phishing Attack on Ukrainian Government

In March 2026, the Belarus-aligned threat group known as Ghostwriter initiated a sophisticated cyber attack targeting Ukrainian governmental organizations. The attackers employed spear-phishing emails containing malicious PDF attachments that impersonated the Ukrainian telecommunications company Ukrtelecom. These PDFs included links leading to RAR archives with JavaScript payloads designed to deploy PicassoLoader, which subsequently installed Cobalt Strike for command and control operations. Notably, the attack incorporated geofencing techniques to deliver malicious content exclusively to users with Ukrainian IP addresses, thereby evading detection and analysis by external entities. This campaign underscores Ghostwriter's persistent and adaptive tactics in cyber espionage, particularly against Eastern European targets. ([thehackernews.com](https://thehackernews.com/2026/05/ghostwriter-targets-ukrainian.html?utm_source=openai)) The incident highlights a concerning trend of state-sponsored cyber attacks leveraging advanced evasion techniques and targeting critical governmental infrastructure. Organizations must remain vigilant against such evolving threats, emphasizing the need for robust cybersecurity measures and continuous monitoring to detect and mitigate sophisticated phishing campaigns and malware deployments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Understanding Supply Chain Risks: Lessons from 'postmark-mcp' and ClawHub Incidents
Computer Software/Engineering5 months ago

Understanding Supply Chain Risks: Lessons from 'postmark-mcp' and ClawHub Incidents

In September 2025, a malicious update to the 'postmark-mcp' package on npm introduced a backdoor that blind carbon copied (BCC) all outgoing emails to an attacker-controlled address, compromising sensitive information. This incident underscores the inherent risks in software supply chains, particularly when malicious code is introduced into widely used packages. Similarly, the ClawHub marketplace faced significant security challenges when numerous malicious skills were uploaded, leading to credential harvesting and data exfiltration. These events highlight the critical need for rigorous vetting and monitoring of third-party components to prevent unauthorized data access and maintain system integrity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI-Assisted Zero-Day Exploit: A New Era in Cyber Threats
Banking/Mortgage5 months ago

AI-Assisted Zero-Day Exploit: A New Era in Cyber Threats

In May 2026, Google's Threat Intelligence Group identified the first documented instance of cybercriminals utilizing artificial intelligence to develop a zero-day exploit. The attackers employed AI to discover a flaw in a Python script, enabling them to bypass two-factor authentication on a widely-used open-source system. The exploit code exhibited characteristics indicative of AI assistance, such as explanatory comments and an invented severity rating. This incident underscores a significant shift in cyber threat dynamics, as AI begins to play an active role in enhancing the capabilities of cyberattacks. The discovery highlights the growing reliance of both state-sponsored and criminal cyber threat actors on AI across various stages of attack, from exploit development to social engineering. As AI models become increasingly adept at uncovering subtle software vulnerabilities, the cybersecurity landscape faces new challenges in defending against these sophisticated, AI-driven threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports