Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 67 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 793–804 / 1289 reports
Fortinet EMS Vulnerability CVE-2026-35616: Immediate Action Required
Government Administration7 months ago

Fortinet EMS Vulnerability CVE-2026-35616: Immediate Action Required

In April 2026, a critical vulnerability (CVE-2026-35616) was discovered in Fortinet's FortiClient Enterprise Management Server (EMS). This flaw allowed unauthenticated attackers to bypass authentication controls and execute arbitrary code via specially crafted requests. Fortinet released emergency hotfixes to address the issue, urging immediate application to prevent exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch affected systems by April 9, 2026, highlighting the significant risk posed by this vulnerability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-fortinet-flaw-exploited-in-attacks-by-friday/?utm_source=openai)) The exploitation of CVE-2026-35616 underscores the persistent threat of zero-day vulnerabilities in widely used enterprise solutions. Organizations are reminded of the critical importance of timely patch management and proactive security measures to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Drift Protocol's $280M Loss: A Case Study in Advanced Social Engineering
Computer Software/Engineering7 months ago

Drift Protocol's $280M Loss: A Case Study in Advanced Social Engineering

In April 2026, Drift Protocol, a decentralized finance platform on the Solana blockchain, suffered a sophisticated cyberattack resulting in the theft of approximately $280 million in digital assets. The attackers, identified as the North Korean state-sponsored group UNC4736, infiltrated the organization over a six-month period by posing as a legitimate quantitative trading firm. They engaged with Drift contributors at multiple industry conferences, building trust through in-person meetings and continued communication via Telegram. This prolonged social engineering campaign allowed them to gain unauthorized access to Drift's Security Council administrative powers, leading to the rapid exfiltration of funds. This incident underscores the evolving tactics of state-sponsored cyber actors, who are increasingly leveraging extended social engineering strategies to compromise high-value targets. The attack highlights the critical need for organizations to implement robust security protocols, including stringent verification processes and continuous monitoring, to defend against such sophisticated infiltration methods.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Fortinet FortiClient EMS Vulnerability CVE-2026-35616: Immediate Action Required
Computer/Network Security7 months ago

Fortinet FortiClient EMS Vulnerability CVE-2026-35616: Immediate Action Required

In April 2026, Fortinet disclosed a critical vulnerability (CVE-2026-35616) in its FortiClient Enterprise Management Server (EMS) versions 7.4.5 and 7.4.6. This improper access control flaw allows unauthenticated attackers to execute arbitrary code or commands via specially crafted requests. The vulnerability was actively exploited in the wild, prompting Fortinet to release emergency patches and advise immediate application of hotfixes or upgrading to version 7.4.7 upon its release. This incident underscores the persistent threat posed by zero-day vulnerabilities and the importance of timely patch management. Organizations are reminded to maintain robust security practices, including regular software updates and monitoring for unauthorized activities, to mitigate risks associated with such critical flaws.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Fortinet FortiClient EMS Vulnerability CVE-2026-35616: Immediate Action Required
Computer/Network Security7 months ago

Fortinet FortiClient EMS Vulnerability CVE-2026-35616: Immediate Action Required

In early April 2026, Fortinet disclosed a critical vulnerability (CVE-2026-35616) in its FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. This improper access control flaw allows unauthenticated attackers to execute unauthorized code or commands via crafted requests, effectively bypassing API authentication and authorization mechanisms. The vulnerability has been actively exploited in the wild, prompting Fortinet to release out-of-band hotfixes and advise customers to upgrade to version 7.4.7 upon its release. ([thehackernews.com](https://thehackernews.com/2026/04/fortinet-patches-actively-exploited-cve.html?utm_source=openai)) The exploitation of CVE-2026-35616 underscores a growing trend of attackers targeting management interfaces to gain elevated privileges within enterprise environments. This incident highlights the critical need for organizations to promptly apply security patches and maintain vigilant monitoring of their network infrastructure to mitigate potential breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Drift Protocol's $285 Million Loss: A Wake-Up Call for Crypto Security
Financial Services7 months ago

Drift Protocol's $285 Million Loss: A Wake-Up Call for Crypto Security

On April 1, 2026, Drift Protocol, a Solana-based decentralized exchange, suffered a significant security breach resulting in the theft of approximately $285 million in various cryptocurrencies. The attackers employed a sophisticated social engineering campaign over six months, culminating in the compromise of administrative controls through the exploitation of durable nonces. This allowed them to manipulate governance mechanisms and execute unauthorized transactions, leading to substantial financial losses and operational disruption for Drift Protocol. This incident underscores the escalating threat posed by state-sponsored cyber actors, particularly those from the Democratic People's Republic of Korea (DPRK), who have increasingly targeted the cryptocurrency sector to fund national programs. The attack highlights the critical need for robust operational security measures, including stringent access controls and vigilant monitoring of administrative activities, to mitigate the risks associated with social engineering and insider threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
European Commission's 2026 Supply-Chain Breach: A Wake-Up Call for Cybersecurity
Government Administration7 months ago

European Commission's 2026 Supply-Chain Breach: A Wake-Up Call for Cybersecurity

In March 2026, the European Commission's cloud infrastructure hosting the Europa.eu platform was compromised through a supply-chain attack orchestrated by the cybercriminal group TeamPCP. The attackers exploited a vulnerability in the Trivy security tool to gain unauthorized access to the Commission's Amazon Web Services (AWS) environment. This breach led to the exfiltration of approximately 92 GB of compressed data, including personal information such as names, email addresses, and email content. Subsequently, the data extortion group ShinyHunters published the stolen data on their dark web leak site. The incident affected not only the European Commission but also at least 29 other Union entities utilizing the Europa.eu web hosting service. ([cert.europa.eu](https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain?utm_source=openai)) This breach underscores the escalating threat posed by supply-chain attacks, where vulnerabilities in third-party tools can serve as entry points for malicious actors. Organizations must enhance their cybersecurity measures, particularly in monitoring and securing their software supply chains, to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Drift Protocol's $285 Million Exploit: A Case Study in DeFi Vulnerabilities
Financial Services7 months ago

Drift Protocol's $285 Million Exploit: A Case Study in DeFi Vulnerabilities

On April 1, 2026, Solana-based decentralized exchange Drift Protocol suffered a significant security breach resulting in the loss of approximately $285 million. The attackers employed a sophisticated strategy involving the creation of a fictitious asset, CarbonVote Token (CVT), which was manipulated to appear as legitimate collateral through wash trading and oracle exploitation. Utilizing pre-signed durable nonce transactions and social engineering tactics, the attackers gained unauthorized access to Drift's administrative controls, enabling them to list CVT as valid collateral and remove withdrawal limits. This allowed for rapid, large-scale withdrawals of genuine assets, including USDC, SOL, and JLP tokens, within a 12-minute window. The stolen funds were swiftly bridged to Ethereum, complicating recovery efforts. ([trmlabs.com](https://www.trmlabs.com/resources/blog/north-korean-hackers-attack-drift-protocol-in-285-million-heist?utm_source=openai)) This incident underscores the evolving threat landscape in decentralized finance (DeFi), highlighting the vulnerabilities associated with governance mechanisms, oracle dependencies, and administrative controls. The use of durable nonce transactions and social engineering reflects a trend towards more complex and coordinated attacks targeting DeFi platforms. Additionally, the suspected involvement of North Korean state-sponsored actors emphasizes the geopolitical dimensions of cyber threats in the cryptocurrency sector. ([thehackernews.com](https://thehackernews.com/2026/04/drift-loses-285-million-in-durable.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
TA416's Renewed Cyber Espionage Campaigns Target European Governments
Government Administration7 months ago

TA416's Renewed Cyber Espionage Campaigns Target European Governments

In mid-2025, the China-aligned threat actor TA416 resumed cyber espionage operations targeting European government and diplomatic entities after a two-year hiatus. The group employed sophisticated techniques, including web bug reconnaissance and evolving malware delivery methods, to deploy the PlugX backdoor via DLL sideloading. These campaigns primarily focused on individuals associated with NATO and EU delegations, leveraging compromised accounts and freemail services to distribute malicious payloads. ([proofpoint.com](https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage?utm_source=openai)) This resurgence underscores the persistent threat posed by state-sponsored actors to governmental institutions, highlighting the need for enhanced cybersecurity measures and vigilance against evolving attack vectors. ([proofpoint.com](https://www.proofpoint.com/us/blog/threat-insight/id-come-running-back-eu-again-ta416-resumes-european-government-espionage?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CoBRA: Revolutionizing Malware Analysis by Simplifying MBA Obfuscation
Computer Software/Engineering7 months ago

CoBRA: Revolutionizing Malware Analysis by Simplifying MBA Obfuscation

On April 3, 2026, Trail of Bits released CoBRA, an open-source tool designed to simplify Mixed Boolean-Arithmetic (MBA) obfuscation. MBA obfuscation, commonly used by malware authors and software protectors, disguises simple operations behind complex arithmetic and bitwise expressions, making analysis challenging. CoBRA effectively simplifies 99.86% of over 73,000 tested expressions, providing security professionals with a powerful resource for deobfuscating code and enhancing malware analysis. The release of CoBRA addresses a significant challenge in cybersecurity, as MBA obfuscation has been a persistent hurdle in malware analysis. By automating the simplification process, CoBRA enables faster and more accurate analysis of obfuscated code, thereby improving threat detection and response capabilities.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ICE's Deployment of Paragon Spyware in 2026: A Privacy Concern
Government Administration7 months ago

ICE's Deployment of Paragon Spyware in 2026: A Privacy Concern

In April 2026, U.S. Immigration and Customs Enforcement (ICE) confirmed the deployment of Paragon Solutions' spyware, Graphite, in domestic drug trafficking investigations. This decision followed the reactivation of a $2 million contract with Paragon in September 2025, after an initial suspension due to privacy concerns. The spyware enables ICE to access encrypted communications, such as WhatsApp messages, directly from targeted devices, raising significant constitutional and privacy issues. The use of Graphite has been linked to previous surveillance of journalists and activists in Europe, intensifying concerns about potential misuse within the United States. The deployment of such advanced surveillance tools by ICE underscores the ongoing tension between national security objectives and individual privacy rights, highlighting the need for robust oversight and clear legal frameworks to prevent potential abuses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Residential Proxies: The Silent Threat Bypassing IP Reputation Systems
Financial Services7 months ago

Residential Proxies: The Silent Threat Bypassing IP Reputation Systems

In April 2026, cybersecurity intelligence firm GreyNoise analyzed 4 billion malicious sessions over three months, revealing that 39% originated from residential networks, with 78% of these evading IP reputation systems. This evasion is attributed to the rapid rotation and short lifespan of residential proxies, which are often used for network scanning and reconnaissance. The study highlights the challenges in distinguishing malicious traffic from legitimate users due to the dynamic nature of residential proxies. The increasing use of residential proxies by threat actors underscores the limitations of traditional IP reputation systems. Organizations are urged to adopt behavior-based detection methods, such as monitoring for sequential probing from rotating IPs and tracking device fingerprints that persist despite IP changes, to effectively identify and mitigate such threats.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Anthropic's 2026 Claude Code Source Code Leak Exploited to Distribute Infostealer Malware
Computer Software/Engineering7 months ago

Anthropic's 2026 Claude Code Source Code Leak Exploited to Distribute Infostealer Malware

In March 2026, Anthropic inadvertently exposed over 500,000 lines of Claude Code's source code due to a packaging error, leading to its rapid dissemination on platforms like GitHub. Threat actors exploited this leak by creating malicious GitHub repositories that masqueraded as the leaked code, enticing users to download files that deployed Vidar infostealer malware upon execution. This incident underscores the critical need for robust internal security measures and vigilance against opportunistic cyber threats that capitalize on such exposures. The exploitation of this leak highlights a growing trend where cybercriminals swiftly leverage publicly disclosed vulnerabilities to distribute malware, emphasizing the importance of prompt incident response and comprehensive security protocols to mitigate potential damages.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports