Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 62 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 733–744 / 1289 reports
Claude Mythos: Redefining Vulnerability Discovery in the AI Era
Computer Software/Engineering6 months ago

Claude Mythos: Redefining Vulnerability Discovery in the AI Era

In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying and exploiting thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability has raised significant concerns about the rapid acceleration of vulnerability discovery and the challenges organizations face in timely remediation. The model's restricted release under Project Glasswing aims to mitigate potential misuse, yet unauthorized access incidents have already been reported, highlighting the pressing need for robust security measures. The emergence of AI-driven vulnerability discovery tools like Mythos signifies a paradigm shift in cybersecurity, compressing exploit timelines and necessitating a reevaluation of existing defense strategies. Organizations must adapt to this new landscape by enhancing their vulnerability management processes and investing in proactive security measures to keep pace with the evolving threat environment.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GlassWorm Malware Resurfaces: 73 OpenVSX Sleeper Extensions Compromise Developer Security
Computer Software/Engineering6 months ago

GlassWorm Malware Resurfaces: 73 OpenVSX Sleeper Extensions Compromise Developer Security

In April 2026, the GlassWorm malware campaign resurfaced, targeting the OpenVSX ecosystem with 73 'sleeper' extensions. Initially benign, these extensions were later updated to deliver malicious payloads, compromising developer environments. Six of these extensions have been activated, while the remaining are considered suspicious. This tactic involves cloning legitimate extensions to deceive developers, leading to the theft of sensitive data such as cryptocurrency wallets and credentials. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, highlighting the need for vigilant monitoring of software dependencies. The use of 'sleeper' extensions that activate malicious behavior post-installation represents a sophisticated method to evade initial detection, posing significant risks to software development environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Sentencing in $230M Cryptocurrency Heist Highlights Social Engineering Threats
Financial Services6 months ago

Sentencing in $230M Cryptocurrency Heist Highlights Social Engineering Threats

In April 2026, Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison for laundering at least $3.5 million in stolen cryptocurrency. This was part of a larger criminal enterprise that, between October 2023 and May 2025, stole over $263 million through social engineering tactics, including impersonating customer support to gain access to victims' cryptocurrency wallets. The stolen funds financed extravagant lifestyles, with expenditures on luxury cars, high-end real estate, and lavish parties. ([justice.gov](https://www.justice.gov/usao-dc/pr/california-money-launderer-sentenced-dc-70-months-role-scheme-stole-263-million?utm_source=openai)) This case underscores the growing sophistication of cybercriminals in exploiting social engineering techniques to execute large-scale financial thefts. It highlights the urgent need for enhanced security measures and user education to prevent such attacks, especially as the cryptocurrency market continues to expand and attract both legitimate investors and malicious actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
After Mythos: New Playbooks For a Zero-Window Era
Computer Software/Engineering6 months ago

After Mythos: New Playbooks For a Zero-Window Era

In April 2026, Anthropic's AI model, Claude Mythos, autonomously identified thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability led to the formation of Project Glasswing, a collaborative initiative involving tech giants like Apple, Google, and JPMorgan Chase, aiming to patch vulnerabilities faster than AI can discover them. However, unauthorized access to Mythos raised significant security concerns, highlighting the potential risks of such powerful AI tools. ([anthropic.com](https://www.anthropic.com/glasswing?utm_source=openai)) The incident underscores the urgent need for robust security protocols in AI development and deployment. As AI models become more sophisticated, ensuring their secure use is paramount to prevent potential misuse and safeguard critical infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Checkmarx 2026 LAPSUS$ Supply Chain Attack: A Detailed Analysis
Computer Software/Engineering6 months ago

Checkmarx 2026 LAPSUS$ Supply Chain Attack: A Detailed Analysis

In March 2026, application security firm Checkmarx experienced a significant security breach when the LAPSUS$ threat group exploited credentials obtained from the Trivy supply chain attack, attributed to TeamPCP. This access allowed the attackers to infiltrate Checkmarx's GitHub repositories, leading to the publication of malicious code and the subsequent leak of sensitive data. The compromised data, totaling 96GB, was later made available on both dark web and clearnet platforms. Checkmarx has confirmed that the leaked data originated from their GitHub repository and is actively investigating the incident to assess the full scope of the breach. This incident underscores the escalating threat posed by supply chain attacks, where compromising a single component can have cascading effects across multiple organizations. The Checkmarx breach highlights the critical need for robust security measures within development pipelines and the importance of securing third-party tools to prevent unauthorized access and data exfiltration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Mandates Immediate Patching of 'BlueHammer' Vulnerability in Microsoft Defender
Government Administration6 months ago

CISA Mandates Immediate Patching of 'BlueHammer' Vulnerability in Microsoft Defender

In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) mandated that U.S. federal agencies patch a critical vulnerability in Microsoft Defender, known as 'BlueHammer' and tracked as CVE-2026-33825. This flaw allows low-privileged local attackers to escalate their privileges to SYSTEM level by exploiting insufficient access control mechanisms. The vulnerability was publicly disclosed by a researcher named 'Chaotic Eclipse' after expressing dissatisfaction with Microsoft's vulnerability disclosure process. Microsoft addressed the issue in their April 14, 2026, Patch Tuesday release. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-microsoft-defender-flaw-exploited-in-zero-day-attacks/?utm_source=openai)) The urgency of this directive underscores the increasing trend of zero-day vulnerabilities being exploited in the wild, highlighting the necessity for organizations to promptly apply security patches. The incident also brings attention to the challenges in vulnerability disclosure processes and the potential risks associated with public disclosures of unpatched vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Checkmarx KICS Supply Chain Breach: A 2026 Case Study
Computer Software/Engineering6 months ago

Checkmarx KICS Supply Chain Breach: A 2026 Case Study

In April 2026, Checkmarx's KICS analysis tool suffered a significant supply chain attack. Threat actors compromised Docker images and VS Code extensions associated with KICS, embedding malware designed to harvest sensitive data from developer environments. The malware targeted credentials such as GitHub tokens, cloud service keys, and SSH keys, exfiltrating them to domains mimicking legitimate Checkmarx infrastructure. The breach was active between April 22, 2026, 14:17:59 UTC and April 22, 2026, 15:41:31 UTC, during which malicious artifacts were distributed through official channels. This incident underscores the escalating trend of supply chain attacks targeting development tools, emphasizing the need for enhanced security measures in software distribution pipelines. Organizations must remain vigilant, as such attacks can lead to widespread credential theft and unauthorized access to critical systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Bitwarden CLI npm Package Compromised in Supply Chain Attack
Computer Software/Engineering6 months ago

Bitwarden CLI npm Package Compromised in Supply Chain Attack

In April 2026, attackers compromised Bitwarden's CLI by uploading a malicious version (2026.4.0) to npm, available between 5:57 PM and 7:30 PM ET on April 22. The malicious package contained credential-stealing malware that harvested developer secrets, including npm tokens, GitHub authentication tokens, SSH keys, and cloud credentials. The malware exfiltrated this data by creating public GitHub repositories under the victim's account. Bitwarden confirmed the incident, stating that the breach was limited to the npm distribution channel for the CLI and did not affect end-user vault data or production systems. The company revoked compromised access, deprecated the malicious release, and initiated remediation steps immediately. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/bitwarden-cli-npm-package-compromised-to-steal-developer-credentials/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting developer tools and CI/CD pipelines. Organizations must enhance their security measures to protect against such vulnerabilities, as similar attacks have been linked to the threat actor known as TeamPCP, who previously targeted developer packages in other supply chain attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/bitwarden-cli-npm-package-compromised-to-steal-developer-credentials/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Project Glasswing: AI's Role in Cybersecurity Vulnerability Detection
Computer Software/Engineering6 months ago

Project Glasswing: AI's Role in Cybersecurity Vulnerability Detection

In April 2026, Anthropic unveiled Project Glasswing, a collaborative initiative with major technology companies such as Amazon, Apple, Microsoft, and Cisco, aimed at enhancing cybersecurity defenses through advanced AI. Central to this project is Claude Mythos Preview, an unreleased AI model that autonomously identified thousands of previously undetected vulnerabilities across critical software systems, including a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg. To mitigate potential misuse, Anthropic has restricted access to this powerful model to select partners and committed significant resources to support open-source security organizations. This initiative underscores the growing importance of AI in cybersecurity, highlighting both its potential to fortify defenses and the risks associated with its misuse. As AI capabilities advance, the industry faces the dual challenge of leveraging these tools for protection while preventing their exploitation by malicious actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
GopherWhisper APT Exploits Go-Based Backdoors to Target Mongolian Government
Government Administration6 months ago

GopherWhisper APT Exploits Go-Based Backdoors to Target Mongolian Government

In January 2025, ESET researchers identified a previously undocumented China-aligned advanced persistent threat (APT) group named GopherWhisper targeting Mongolian governmental institutions. The group employs a suite of tools primarily written in Go, including injectors and loaders, to deploy various backdoors such as LaxGopher, RatGopher, and BoxOfFriends. GopherWhisper leverages legitimate services like Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control (C&C) communications and data exfiltration. The group's activities have been ongoing since at least November 2023, compromising at least 12 systems within a Mongolian government entity. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/04/23/3279634/0/en/ESET-Research-discovers-new-China-aligned-group-GopherWhisper-It-abuses-messaging-services-Discord-Slack-and-Outlook-to-spy.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who exploit widely used communication platforms to evade detection. The use of Go-based malware highlights a trend towards more versatile and cross-platform attack tools, posing significant challenges for traditional security measures. Organizations must adapt their defenses to address these sophisticated techniques.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Chinese APT GopherWhisper Exploits Cloud Services in Mongolian Cyber Espionage
Government Administration6 months ago

Chinese APT GopherWhisper Exploits Cloud Services in Mongolian Cyber Espionage

In April 2026, ESET researchers uncovered a Chinese advanced persistent threat (APT) group named GopherWhisper targeting Mongolian government institutions. Active since at least November 2023, GopherWhisper deployed multiple custom backdoors—LaxGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor—each utilizing different cloud services like Slack, Discord, Microsoft Outlook, and file.io for command-and-control communications and data exfiltration. This campaign compromised at least 12 systems within a Mongolian governmental institution, with indications of broader impact across the region. This incident underscores a growing trend of APT groups leveraging legitimate cloud services to evade detection and maintain persistent access. Organizations must enhance their monitoring of cloud-based communications and implement robust security measures to detect and mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Checkmarx Supply Chain Breach: Malicious KICS Docker Images and VS Code Extensions Detected
Computer Software/Engineering6 months ago

Checkmarx Supply Chain Breach: Malicious KICS Docker Images and VS Code Extensions Detected

In April 2026, Checkmarx's supply chain was compromised when attackers uploaded malicious images to the official 'checkmarx/kics' Docker Hub repository. These images, including versions v2.1.20 and a fraudulent v2.1.21, contained modified KICS binaries with unauthorized data collection and exfiltration capabilities. Additionally, certain Visual Studio Code extensions were altered to execute remote code without user consent. Organizations using these compromised tools to scan infrastructure-as-code files risked exposing sensitive credentials and configurations. ([thehackernews.com](https://thehackernews.com/2026/04/malicious-kics-docker-images-and-vs.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools. It highlights the necessity for organizations to implement stringent security measures, such as verifying the integrity of third-party software and continuously monitoring for unauthorized modifications, to safeguard against similar vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports