Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 60 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 709–720 / 1289 reports
Critical cPanel Vulnerability (CVE-2026-41940) Exploited in Government and MSP Networks
Government Administration6 months ago

Critical cPanel Vulnerability (CVE-2026-41940) Exploited in Government and MSP Networks

In late April 2026, a critical authentication bypass vulnerability (CVE-2026-41940) was discovered in cPanel and WebHost Manager (WHM), widely used web hosting control panels. This flaw allows unauthenticated remote attackers to gain administrative access to servers, potentially compromising all hosted websites and data. ([support.cpanel.net](https://support.cpanel.net/hc/en-us/articles/40073787579671-Security-CVE-2026-41940-cPanel-WHM-WP2-Security-Update-04-28-2026?utm_source=openai)) By early May, threat actors exploited this vulnerability to target government and military entities in Southeast Asia, as well as managed service providers (MSPs) and hosting providers in multiple countries, including the U.S. ([thehackernews.com](https://thehackernews.com/2026/05/critical-cpanel-vulnerability.html?utm_source=openai)) The attacks have led to server takeovers, website defacements, and data encryption using ransomware. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/04/multiple-threat-actors-actively-exploit-cpanel-vulnerability-cve-2026-41940/?utm_source=openai)) The rapid exploitation of CVE-2026-41940 underscores the critical need for organizations to promptly apply security patches and review their systems for potential breaches. The widespread use of cPanel and WHM amplifies the risk, making it imperative for all users to ensure their installations are updated to the latest secure versions. ([techcrunch.com](https://techcrunch.com/2026/04/30/hackers-are-actively-exploiting-a-bug-in-cpanel-used-by-millions-of-websites/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Wireshark 4.6.5 Release: Addressing 43 Vulnerabilities Amid AI-Assisted Reports
Computer/Network Security6 months ago

Wireshark 4.6.5 Release: Addressing 43 Vulnerabilities Amid AI-Assisted Reports

On May 3, 2026, Wireshark released version 4.6.5, addressing 43 vulnerabilities, including 38 CVEs. This significant update was driven by a surge in AI-assisted vulnerability reports, highlighting the evolving landscape of cybersecurity threats. The vulnerabilities, if exploited, could allow attackers to execute arbitrary code or cause denial-of-service conditions, emphasizing the critical need for timely software updates. The rapid identification and disclosure of these vulnerabilities underscore the dual role of AI in cybersecurity—both as a tool for defenders and a resource for attackers. Organizations must remain vigilant, ensuring that their security practices evolve alongside technological advancements to mitigate emerging threats effectively.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Defender's False Positive on DigiCert Certificates - 2026
Computer Software/Engineering6 months ago

Microsoft Defender's False Positive on DigiCert Certificates - 2026

In late April 2026, Microsoft Defender's signature update erroneously identified legitimate DigiCert root certificates as Trojan:Win32/Cerdigent.A!dha, leading to widespread false-positive alerts and the removal of these certificates from Windows trust stores. This misclassification disrupted SSL/TLS validation and code-signing operations across numerous systems. Microsoft addressed the issue by releasing Security Intelligence update version 1.449.430.0, which corrected the false positives and restored the removed certificates. This incident underscores the critical importance of accurate threat detection mechanisms and the potential operational disruptions caused by false positives. It also highlights the necessity for organizations to have robust incident response plans to swiftly address and mitigate such issues.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Trellix Confirms Source Code Breach in 2026
Computer/Network Security6 months ago

Trellix Confirms Source Code Breach in 2026

In May 2026, cybersecurity firm Trellix disclosed unauthorized access to a portion of its source code repository. Upon detection, Trellix collaborated with forensic experts and notified law enforcement. The company stated there is no evidence that the source code release or distribution process was affected or that the code was exploited. The exact data accessed and the duration of unauthorized access remain undisclosed. This incident underscores the persistent threat to software supply chains, highlighting the need for robust security measures to protect sensitive code repositories. Organizations are urged to enhance monitoring and access controls to mitigate similar risks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Insider Threats: Lessons from the BlackCat Ransomware Sentencing
Health Care / Life Sciences6 months ago

Insider Threats: Lessons from the BlackCat Ransomware Sentencing

In May 2026, two former cybersecurity professionals, Ryan Clifford Goldberg and Kevin Tyler Martin, were sentenced to four years in prison for their involvement in BlackCat (ALPHV) ransomware attacks targeting U.S. companies between May and November 2023. Utilizing their insider knowledge, they breached networks of multiple organizations, including a Maryland pharmaceutical company and a California engineering firm, demanding ransoms ranging from $300,000 to $10 million. One victim, a Tampa medical device manufacturer, paid $1.27 million after its servers were encrypted. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/us-ransomware-negotiators-get-4-years-in-prison-over-blackcat-attacks/?utm_source=openai)) This case underscores the evolving threat landscape where trusted insiders exploit their positions to facilitate cyberattacks. The incident highlights the critical need for organizations to implement robust insider threat detection mechanisms and reinforces the importance of comprehensive cybersecurity measures to protect against both external and internal threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
French Government Agency Breach: 15-Year-Old Detained
Government Administration6 months ago

French Government Agency Breach: 15-Year-Old Detained

In April 2026, the Agence Nationale des Titres Sécurisés (ANTS), responsible for issuing and managing France's official identity documents, detected unauthorized access to its systems. The breach, identified on April 15, led to the exposure of personal data—including full names, dates and places of birth, mailing and email addresses, and phone numbers—of approximately 11.7 million individuals. Shortly after, a hacker using the alias 'breach3d' advertised the sale of this data on a cybercriminal forum. French authorities have since detained a 15-year-old suspect believed to be behind the alias, facing charges related to unauthorized access and data exfiltration. This incident underscores the escalating threat posed by cybercriminals targeting government agencies to access vast amounts of sensitive personal information. The involvement of a minor highlights the accessibility of sophisticated hacking tools and the need for enhanced cybersecurity measures and public awareness to prevent such breaches and mitigate their potential impact on citizens.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Cybersecurity Experts Sentenced for BlackCat Ransomware Attacks
Computer/Network Security6 months ago

Cybersecurity Experts Sentenced for BlackCat Ransomware Attacks

In April 2026, the U.S. Department of Justice sentenced cybersecurity professionals Ryan Goldberg and Kevin Martin to four years in prison for orchestrating BlackCat ransomware attacks between April and December 2023. Collaborating with co-conspirator Angelo Martino, they deployed the ALPHV/BlackCat ransomware against multiple U.S. victims, extorting approximately $1.2 million in Bitcoin from at least one victim. The trio, leveraging their industry expertise, agreed to share 20% of the ransoms with the ransomware administrators in exchange for access to the malware and its extortion platform. ([justice.gov](https://www.justice.gov/usao-sdfl/pr/two-men-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentenced?utm_source=openai)) This case underscores a troubling trend of insiders exploiting their cybersecurity knowledge for malicious purposes. The involvement of industry professionals in cybercrime highlights the need for stringent internal controls and continuous monitoring to prevent such breaches. Organizations must remain vigilant against both external threats and potential internal vulnerabilities to safeguard their systems and data.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Insider Betrayal: Ransomware Negotiator Aids BlackCat Attacks
Computer/Network Security6 months ago

Insider Betrayal: Ransomware Negotiator Aids BlackCat Attacks

In April 2026, Angelo Martino, a former ransomware negotiator at DigitalMint, pleaded guilty to conspiring with the BlackCat/ALPHV ransomware group to extort U.S. companies. Martino exploited his trusted position by providing confidential client information, such as insurance policy limits and negotiation strategies, to the attackers. This insider collaboration enabled the ransomware group to maximize their ransom demands, resulting in over $75 million in payments from victims, including a nonprofit and a financial firm. Authorities have seized more than $10 million in assets from Martino, who faces up to 20 years in prison. This case underscores the critical importance of vetting and monitoring individuals in sensitive cybersecurity roles. The incident highlights the evolving tactics of ransomware groups, including the recruitment of insiders to enhance their extortion efforts. Organizations must remain vigilant against such threats and implement robust internal controls to safeguard against insider collusion.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Insider Threats: The 2023 ALPHV Ransomware Exploits by Cybersecurity Professionals
Health Care / Life Sciences6 months ago

Insider Threats: The 2023 ALPHV Ransomware Exploits by Cybersecurity Professionals

In 2023, former cybersecurity professionals Ryan Goldberg and Kevin Martin exploited their expertise to conduct ransomware attacks using the ALPHV/BlackCat variant. Over a six-month period, they targeted multiple U.S. organizations, including a Florida medical company, a Maryland pharmaceutical firm, a California doctor's office, a California engineering company, and a Virginia drone manufacturer. Their actions led to significant operational disruptions and financial losses, with at least one victim paying a $1.3 million ransom. ([justice.gov](https://www.justice.gov/opa/pr/two-americans-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentenced?utm_source=openai)) This case underscores the alarming trend of insiders leveraging privileged access and knowledge for malicious purposes. It highlights the critical need for robust internal controls, continuous monitoring, and stringent access management to mitigate insider threats within organizations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Huge Networks' Infrastructure Exploited in Massive DDoS Attacks on Brazilian ISPs
Telecommunications6 months ago

Huge Networks' Infrastructure Exploited in Massive DDoS Attacks on Brazilian ISPs

In April 2026, Huge Networks, a Brazilian firm specializing in DDoS mitigation, was implicated in orchestrating massive DDoS attacks against Brazilian ISPs. An exposed archive revealed that a threat actor had root access to Huge Networks' infrastructure, utilizing it to build a botnet by exploiting vulnerabilities in TP-Link Archer AX21 routers, specifically CVE-2023-1389. The botnet conducted DNS amplification attacks, significantly impacting targeted ISPs. Huge Networks' CEO attributed the malicious activity to a security breach, suggesting a competitor's involvement to tarnish the company's reputation. This incident underscores the persistent threat posed by botnets leveraging IoT vulnerabilities, even years after patches are released. It highlights the critical need for organizations to secure their infrastructure and monitor for unauthorized access to prevent exploitation in large-scale cyberattacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Critical Vulnerability in ABB Ability Edgenius: Immediate Action Required
Industrial Automation6 months ago

Critical Vulnerability in ABB Ability Edgenius: Immediate Action Required

In November 2025, a critical authentication bypass vulnerability (CVE-2025-10571) was identified in ABB Ability Edgenius versions 3.2.0.0 and 3.2.1.1. This flaw allows unauthenticated attackers on adjacent networks to send specially crafted messages to the system node, enabling them to install and run arbitrary code, uninstall applications, and modify configurations of installed applications. The vulnerability has a CVSS v3.1 base score of 9.6, indicating its critical severity. ABB has released version 3.2.2.0 to address this issue and recommends immediate upgrading. ([library.e.abb.com](https://library.e.abb.com/public/6fed91aad9034910b99298c58e407979/7PAA022088_B_en_Edgenius%20Management%20Portal%20Authentication%20Bypass.pdf?x-sign=4U%2FLxIrP3%2FTAiNhR45U6GCkLpQhWbUhpnelc58Oz1NsjOPYafSbXv48t5cNUuiBc&utm_source=openai)) The discovery of this vulnerability underscores the increasing risks associated with edge computing platforms in industrial environments. As these systems often bridge IT and operational technology (OT) networks, their compromise can lead to significant operational disruptions and safety hazards. Organizations must prioritize securing such platforms to prevent unauthorized access and potential exploitation.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Ransomware Rivalry: 0APT and KryBit Expose Each Other's Operations
Computer/Network Security6 months ago

Ransomware Rivalry: 0APT and KryBit Expose Each Other's Operations

In April 2026, a rare conflict erupted between two emerging ransomware-as-a-service (RaaS) groups, 0APT and KryBit. 0APT, initially known for fabricating victim claims, targeted rival ransomware operators, including KryBit, by leaking their operational data. This exposure revealed KryBit's infrastructure, personnel details, and victim negotiations. In retaliation, KryBit breached 0APT's systems, exposing fabricated victim lists and defacing 0APT's leak site. This mutual exposure has significantly disrupted both groups' operations, necessitating infrastructure rebuilding and rebranding efforts. This incident underscores the volatile nature of cybercriminal alliances and the potential for internal conflicts to disrupt malicious operations. For defenders, such feuds provide valuable insights into ransomware tactics, techniques, and procedures, enhancing preparedness against future attacks.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports