Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
A $0 Transaction Triggers a Nation-State Cyberattack on Anthropic’s AI Platform
In early 2024, Anthropic, a leading artificial intelligence company, was targeted in a sophisticated nation-state cyber espionage campaign. Adversaries utilized compromised payment cards—previously validated through Chinese-operated card-testing services—to attempt unauthorized access to Anthropic's AI platform. The attackers leveraged an established cybercriminal kill chain: stealing card data, validating credentials through tester merchants, and ultimately using the compromised accounts to escalate their intrusion attempts. While no sensitive customer data was confirmed to be compromised, the incident underscored the vulnerability of downstream cloud-based AI assets to upstream financial fraud and highlighted the intersection of cybercrime with state-sponsored intelligence objectives. This attack serves as a high-profile example of how advanced fraud intelligence can act as an early detection mechanism for state-sponsored cyber operations. The incident exemplifies rapid convergence between financial fraud and targeted espionage, emphasizing the need for cross-domain threat visibility and proactive controls.
8 months ago
Kill Chain
Russian Nation-State Hackers Breach Critical Infrastructure via Edge Device Flaws
In early 2024, Russian-linked APT actors launched a prolonged cyberattack campaign targeting critical infrastructure organizations globally, with a particular focus on the energy sector. Leveraging misconfigured edge networking devices, attackers gained initial access to internal networks, allowing them to perform lateral movement and conduct espionage on sensitive operational systems. The campaign, detailed by Amazon's security division, utilized unencrypted management traffic, enabling threat actors to intercept data-in-transit and issue command-and-control instructions undetected. Widespread exploitation resulted in data exfiltration, system compromise, and operational disruptions for affected organizations. This incident highlights a surge in advanced persistent threats exploiting basic configuration weaknesses in edge devices. The continued targeting of critical sectors by nation-state actors underscores the urgent need for stronger segmentation, encrypted network traffic, and improved detection capabilities, as attackers are increasingly adept at bypassing conventional perimeter defenses.
8 months ago
Kill Chain
2025 Ransomware Attack Disrupts Venezuela’s State Oil Giant PDVSA
In December 2025, Petróleos de Venezuela (PDVSA), Venezuela’s national oil and gas company, experienced a significant ransomware attack that targeted its administrative systems. While official company communications downplayed the incident and attributed blame to international adversaries, media reports indicated substantial disruption: the attack resulted in major outages, took down vital IT systems, impacted cargo deliveries, and forced network disconnections. Efforts to remediate using antivirus software exacerbated downtime, and export activities, including loading instructions, were suspended. The incident highlighted operational fragility due to reliance on legacy infrastructure and a lack of segmentation between administrative and critical operational technologies. This breach spotlights the ongoing wave of ransomware attacks targeting energy and critical infrastructure sectors worldwide. It underscores how geopolitically charged environments, and legacy technologies without zero trust segmentation, remain especially vulnerable. The incident serves as a stark warning for the urgent adoption of robust east-west traffic controls and resilient response playbooks to mitigate emerging ransomware TTPs.
8 months ago
Kill Chain
Sandworm Shifts Tactics: How Misconfigured AWS Edge Devices Enabled State Espionage in 2025
In early 2025, Amazon Threat Intelligence disclosed a sustained campaign by Russia's GRU-linked Sandworm (APT44) targeting Western critical infrastructure, with a focus on the energy sector. The threat actors shifted tactics from exploiting software vulnerabilities to exploiting misconfigured network edge devices hosted on AWS as their primary entry vector. Once inside, attackers intercepted sensitive network traffic to steal credentials and leveraged these to expand and maintain access across enterprise and critical infrastructure environments, including electric utilities, energy providers, and managed security providers. Remediation included notification of affected customers, removal of compromised AWS EC2 instances, and intelligence sharing with partners. This incident marks a concerning evolution in nation-state attack tradecraft: adversaries are prioritizing misconfigurations over traditional exploits, highlighting the need for organizations to reassess cloud and hybrid network security. The prevalence of cloud-hosted infrastructure increases urgency around identity and segmentation defenses.
8 months ago
Kill Chain
Illusory Systems 2022 Crypto Breach: Smart Contract Flaw Leads to FTC Settlement
In July 2022, Illusory Systems (also known as Nomad) suffered a major security breach when attackers exploited an application security flaw in its Token Bridge smart contract platform. After pushing inadequately tested and poorly secured code to production, the company left the cross-chain bridge exposed to a vulnerability that was quickly leveraged by hackers to drain approximately $186 million in user-held cryptocurrencies. The breach went undetected internally, with staff first learning about it from a user on social media; response delays and lack of effective controls allowed attackers to empty the bridge. Regulatory investigation found misaligned security claims, absence of key safeguards, lack of automated fraud monitoring, and ineffective incident response processes, leading to severe financial and reputational damages for Illusory Systems. This incident echoes the rising threat landscape targeting blockchain infrastructure, with smart contract vulnerabilities increasingly exploited for high-value thefts. The FTC’s enforcement action against Illusory Systems highlights growing regulatory scrutiny and the urgent need for strong application security practices in the crypto-asset sector.
8 months ago
Kill Chain
How Attackers Exploit Windows Race Conditions with Path Lookups
In December 2025, security researchers identified a critical exploitation technique leveraging race conditions within the Windows Object Manager namespace. Attackers can use specially crafted path lookups, combining recursive directories, symbolic links, shadow directories, and hash collisions, to artificially inflate kernel resource lookup times—sometimes up to several minutes. By exploiting this behavior, an attacker could significantly increase the window to win race conditions, potentially bypassing security checks and securing unauthorized access or escalating privileges. The impact of this exploit affects modern Windows 11 systems and is especially relevant for environments relying heavily on object access protections. This exploitation method highlights an enduring structural weakness that remains open even in recent Windows releases. With a broader trend toward complex system attacks and system resource manipulation, awareness and mitigations for race-based vulnerabilities have become a growing priority for enterprises and regulators.
8 months ago
Kill Chain
Venezuelan Oil Giant PDVSA Hit by Cyberattack—Exports Disrupted in 2024 Incident
In June 2024, Petróleos de Venezuela S.A. (PDVSA), Venezuela’s state-owned oil giant, suffered a major cyberattack that disrupted its oil export operations. Attackers reportedly targeted IT infrastructure critical to the export scheduling and operational logistics of PDVSA, forcing the company to revert to manual processes while systems were restored. Although the precise entry vector and threat actor remain unconfirmed, preliminary indications suggest ransomware or disruptive malware may have played a role, leading to significant business interruption and delayed global shipments. This incident underscores the persistent risks facing critical infrastructure sectors worldwide, with cyberattacks increasingly targeting essential energy supply chains. With ransomware and nation-state threats evolving in sophistication, organizations must urgently prioritize segmentation, threat detection, and resilient network architectures.
8 months ago
Kill Chain
Inside the 2025 KPop Malware Hunter Takedowns: Exposing Cloud Attack Trends
In 2025, a coordinated intelligence operation led by an international alliance of cybersecurity researchers, dubbed the KPop Malware Hunters, dismantled several prolific malware campaigns targeting global cloud and data center environments. Threat actors, including the group Salt Typhoon, exploited east-west traffic routes and unencrypted data in transit to achieve lateral movement post-compromise. Using advanced encrypted traffic analytics and inline IPS, defenders identified high-volume command-and-control exchanges masked within routine inter-region traffic. The operation led to significant disruption of adversary infrastructure, restoration of business operations, and improved threat visibility for impacted organizations worldwide. This takedown is highly relevant amid heightened attacks on hybrid and multicloud architectures, where sophisticated adversaries increasingly exploit internal cloud pathways and vulnerable segmentation. 2025’s events spotlight the urgent need for zero trust, inline threat detection, and rigorous compliance alignment as attackers leverage AI-driven evasion and cloud-native persistence.
8 months ago
Kill Chain
French Interior Ministry 2024 Email Server Breach: What Happened & Key Lessons
In June 2024, the French Interior Ministry confirmed a significant cyberattack that targeted its internal email servers. Threat actors conducted a sophisticated intrusion into the ministry's IT infrastructure, accessing and potentially exfiltrating sensitive email communications. The breach was detected after suspicious activity was found on the email systems. While no citizen data has reportedly been compromised, the attack forced authorities to rapidly isolate affected servers and implement remedial security protocols, causing temporary disruption to some official communications and raising concerns about government data confidentiality and resilience. This incident is emblematic of an increasing trend of targeted attacks on government email and communication systems. With attackers becoming more adept at breaching core administrative platforms, nations are under heightened pressure to bolster segmentation, encryption in transit, and detection capabilities to safeguard critical infrastructure.
8 months ago
Kill Chain
ShadyPanda’s Browser Extension Supply-Chain Attack Exposes Millions in 2025
In December 2025, security researchers uncovered a widespread supply-chain attack perpetrated by the threat group ShadyPanda, which had silently compromised several popular Chrome and Edge browser extensions. Over the course of seven years, ShadyPanda either published or acquired seemingly innocuous extensions, allowed them to build credibility and large user bases, and then weaponized them through malicious updates. The attackers exploited the implicit trust in browser extension ecosystems to exfiltrate user data and potentially inject hostile code into millions of browsers worldwide, impacting individuals and organizations alike. This incident underscores persistent risks in software supply chains, as threat actors increasingly target trusted application ecosystems to achieve broad access. As browser extensions remain integral to productivity and daily workflows, the event highlights the urgency for organizations to monitor third-party components and reassess extension management, especially amid evolving regulatory scrutiny and attacker sophistication.
8 months ago
Kill Chain
10 Critical November 2025 CVEs: Quality Over Quantity in Exploitation Trends
In November 2025, a sharp 69% drop in reported critical vulnerabilities masked a surge in the intensity of exploitation campaigns. Threat intelligence from Recorded Future revealed 10 high-risk CVEs—including two critical Fortinet FortiWeb flaws—actively targeted by threat actors. Notably, the LANDFALL spyware campaign weaponized Samsung's image processing vulnerability for zero-click remote attacks, while seven of ten vulnerabilities had public proof-of-concept code released. Vulnerabilities included OS command injection, out-of-bounds writes, access control failures, and issues affecting major vendors such as Microsoft, Oracle, and Google. This incident highlights how attackers are shifting to fewer but far more impactful vulnerabilities, emphasizing quality over quantity in their exploitation. Security teams must adapt, maintaining vigilance even during perceived lulls and prioritizing fast patching, advanced monitoring, and comprehensive exposure management to counter rapidly evolving threats.
8 months ago
Kill Chain
Mesa County's 2021 Election System Data Breach: The Insider Threat Exposed
In 2021, Mesa County, Colorado experienced a significant breach of its election system data, orchestrated by then-county election clerk Tina Peters. Unauthorized copies of sensitive voting-system hard drives were made following the 2020 U.S. Presidential election and leaked to the public, purportedly to expose alleged voter fraud. The breach, which did not reveal any evidence of fraud, exposed highly confidential election infrastructure information, leading to criminal charges against Peters. The incident is widely recognized as one of the most impactful attacks on U.S. election security in recent years and undermined trust within the local community and beyond. This case highlights the ongoing risks to election system integrity posed by insider threats and emphasizes the importance of robust access controls, encryption, and segmentation. It is particularly relevant today as the U.S. prepares for upcoming elections amid heightened scrutiny of both technical and human vulnerabilities in election infrastructure.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports