Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 73 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 865–876 / 1289 reports
Apple's Response to Coruna Exploit Kit: Critical Security Updates Released
Computer Software/Engineering8 months ago

Apple's Response to Coruna Exploit Kit: Critical Security Updates Released

In March 2026, Apple released security updates for older iOS devices to address vulnerabilities exploited by the Coruna exploit kit. This sophisticated toolkit targeted iOS versions from 13.0 to 17.2.1, leveraging 23 vulnerabilities across five exploit chains. The Coruna kit was utilized by various threat actors, including state-sponsored groups and financially motivated cybercriminals, to gain unauthorized access to iPhones through malicious web content. The vulnerabilities allowed attackers to execute arbitrary code with kernel privileges, leading to potential data theft and device compromise. ([9to5mac.com](https://9to5mac.com/2026/03/11/apple-confirms-todays-ios-and-ipados-updates-for-older-devices-address-the-coruna-exploit/?utm_source=openai)) The Coruna exploit kit's widespread use underscores the critical importance of timely software updates and robust security measures. Its ability to bypass multiple layers of defense highlights the evolving sophistication of cyber threats targeting mobile devices. Organizations and individuals must remain vigilant, ensuring devices are updated to the latest software versions to mitigate such risks. ([arstechnica.com](https://arstechnica.com/security/2026/03/cisa-adds-3-ios-flaws-to-its-catalog-of-known-exploited-vulnerabilities/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Phishing Campaigns Overwhelm SOC Analysts in 2026
Financial Services8 months ago

Phishing Campaigns Overwhelm SOC Analysts in 2026

In early 2026, cybersecurity firms observed a surge in sophisticated phishing campaigns designed not only to deceive employees but also to inundate Security Operations Centers (SOCs) with an overwhelming volume of alerts. Attackers utilized automated tools to dispatch thousands of phishing emails, many of which were low-sophistication lures intended to flood SOCs with reports. Amidst this deluge, highly targeted spear-phishing emails were sent to individuals with critical system access, effectively camouflaging these high-risk threats within the noise. This tactic led to significant delays in threat detection and response, increasing the likelihood of successful breaches. This trend underscores a critical shift in cyberattack strategies, where adversaries exploit the operational limitations of SOCs, particularly their capacity to process high volumes of alerts. The effectiveness of these campaigns highlights the urgent need for organizations to enhance their SOC capabilities, incorporating advanced automation and AI-driven tools to manage alert triage efficiently and mitigate the risk of alert fatigue among analysts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Xygeni GitHub Action Compromised via Tag Poisoning in 2026
Computer Software/Engineering8 months ago

Xygeni GitHub Action Compromised via Tag Poisoning in 2026

In early March 2026, Xygeni's GitHub Action, xygeni-action, was compromised through a tag poisoning attack. An attacker with access to compromised credentials created pull requests injecting obfuscated shell code into action.yml. Although these pull requests were blocked by branch protection rules and not merged into the main branch, the attacker exploited the compromised GitHub App credentials to move the mutable v5 tag to point at a malicious commit. This allowed any workflow referencing xygeni/xygeni-action@v5 to fetch and execute the compromised code, resulting in a supply chain compromise via tag poisoning. Workflows using xygeni/xygeni-action@v5 during the affected window (approximately March 3–10, 2026) executed a command-and-control (C2) implant that granted the attacker arbitrary command execution on the CI runner for up to 180 seconds per workflow run. This incident underscores the critical need for robust security measures in CI/CD pipelines to prevent similar supply chain attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Mirai Botnet 2016: A Wake-Up Call for IoT Security
Information Technology/IT8 months ago

Mirai Botnet 2016: A Wake-Up Call for IoT Security

In October 2016, the Mirai botnet exploited default credentials on IoT devices to orchestrate one of the largest Distributed Denial-of-Service (DDoS) attacks in history. By scanning the internet for devices with open Telnet ports and using a list of common default usernames and passwords, Mirai infected hundreds of thousands of devices, including routers and IP cameras. These compromised devices were then used to launch massive DDoS attacks, notably targeting DNS provider Dyn, which resulted in widespread internet outages affecting major websites like Twitter, Netflix, and Amazon. The incident underscored the critical security risk posed by default credentials in IoT devices and highlighted the need for manufacturers and users to implement stronger security practices. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Mirai_%28malware%29?utm_source=openai)) The Mirai attack remains relevant today as IoT device proliferation continues, with many devices still shipping with default credentials. Recent studies indicate that a significant percentage of IoT devices retain factory-default passwords, making them susceptible to similar exploitation. This ongoing vulnerability emphasizes the importance of changing default credentials and implementing robust security measures to protect against potential large-scale cyberattacks. ([vulnsy.com](https://www.vulnsy.com/vulnerabilities/default-and-weak-iot-credentials?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets
Computer Software/Engineering8 months ago

Malicious Rust Crates and AI Bot Exploit CI/CD Pipelines to Steal Developer Secrets

In early March 2026, cybersecurity researchers identified a coordinated supply chain attack involving five malicious Rust crates—'chrono_anchor', 'dnp3times', 'time_calibrator', 'time_calibrators', and 'time-sync'—that masqueraded as time-related utilities. These crates exfiltrated sensitive '.env' files containing developer secrets to attacker-controlled infrastructure. Concurrently, an AI-powered bot named 'hackerbot-claw' exploited misconfigured GitHub Actions workflows in major open-source repositories, achieving remote code execution and stealing access tokens. This bot targeted repositories from organizations such as Microsoft, Datadog, and Aqua Security, leading to unauthorized code execution and potential repository takeovers. These incidents underscore the escalating threats to software supply chains, particularly through the exploitation of CI/CD pipeline vulnerabilities and the use of AI-driven automation in cyber attacks. Organizations must prioritize securing their development environments by auditing dependencies, implementing strict access controls, and continuously monitoring for anomalous activities to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
UNC6426's Rapid Exploitation of nx npm Supply Chain: A 72-Hour Breach to AWS Admin Access
Computer Software/Engineering8 months ago

UNC6426's Rapid Exploitation of nx npm Supply Chain: A 72-Hour Breach to AWS Admin Access

In August 2025, the threat actor UNC6426 exploited a supply chain vulnerability in the nx npm package to infiltrate a victim's cloud environment. The attackers published malicious versions of the nx package, which, when installed, exfiltrated developer credentials, including GitHub tokens. Utilizing these stolen tokens, UNC6426 gained unauthorized access to the victim's GitHub account, abused the GitHub-to-AWS OpenID Connect (OIDC) trust relationship to create a new AWS administrator role, and within 72 hours, exfiltrated data from Amazon S3 buckets and destroyed production environments. This incident underscores the escalating sophistication of supply chain attacks, where attackers leverage trusted relationships between development tools and cloud services to escalate privileges rapidly. The breach highlights the critical need for organizations to implement stringent security measures, such as enforcing the principle of least privilege, regularly rotating credentials, and monitoring for anomalous activities within their CI/CD pipelines and cloud environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
APT28's 2026 Espionage Campaign: Exploiting Office Vulnerabilities with Advanced Malware
Government Administration8 months ago

APT28's 2026 Espionage Campaign: Exploiting Office Vulnerabilities with Advanced Malware

In early 2026, the Russian state-sponsored threat actor APT28, also known as Fancy Bear, launched a sophisticated cyber-espionage campaign targeting Ukrainian military personnel. The attackers utilized spear-phishing emails containing malicious Microsoft Office documents to exploit the CVE-2026-21509 vulnerability, allowing them to execute code via OLE objects without macros or warnings. This method facilitated the deployment of two advanced malware implants: BeardShell, a custom C++ backdoor leveraging the Icedrive cloud service for command-and-control communications, and Covenant, a heavily modified open-source .NET post-exploitation framework. These tools enabled APT28 to conduct long-term surveillance, data exfiltration, and maintain persistent access to compromised systems. ([cyberpress.org](https://cyberpress.org/apt28-exploits-office-vulnerability/?utm_source=openai)) This incident underscores a significant evolution in APT28's tactics, techniques, and procedures (TTPs), highlighting their ability to rapidly weaponize newly disclosed vulnerabilities and integrate legitimate cloud services into their command-and-control infrastructure. The campaign's success emphasizes the urgent need for organizations to promptly apply security patches, enhance phishing defenses, and monitor for abuse of legitimate services in cyber operations. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/03/10/sednit-espionage-toolkit-stealing-data/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
APT28's Exploitation of Microsoft Office Vulnerability: A Deep Dive
Government Administration8 months ago

APT28's Exploitation of Microsoft Office Vulnerability: A Deep Dive

In early 2026, the Russian state-sponsored hacking group APT28, also known as Fancy Bear, exploited a newly disclosed Microsoft Office vulnerability (CVE-2026-21509) to target Ukrainian government agencies. The attackers distributed malicious documents via phishing emails, leading to the deployment of the COVENANT malware framework and the BEARDSHELL backdoor, facilitating long-term surveillance and data exfiltration. This campaign underscores the rapid weaponization of zero-day vulnerabilities by nation-state actors and highlights the persistent cyber threats facing governmental institutions. Organizations are urged to promptly apply security patches and enhance their cybersecurity measures to mitigate such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Unveiling 'Zombie ZIP': A New Frontier in Malware Evasion
Computer Software/Engineering8 months ago

Unveiling 'Zombie ZIP': A New Frontier in Malware Evasion

In March 2026, security researcher Chris Aziz unveiled a novel malware evasion technique termed 'Zombie ZIP.' This method involves manipulating ZIP file headers to mislead antivirus and endpoint detection systems into treating compressed malicious payloads as uncompressed data. Consequently, security tools scan the files without detecting the embedded threats. The technique proved effective against 50 out of 51 antivirus engines tested on VirusTotal. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-zombie-zip-technique-lets-malware-slip-past-security-tools/?utm_source=openai)) The emergence of 'Zombie ZIP' underscores the evolving sophistication of malware delivery methods, highlighting the need for enhanced detection mechanisms capable of identifying such deceptive techniques. Organizations must stay vigilant and update their security protocols to counteract these advanced evasion strategies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
BlackSanta EDR Killer: A New Threat to HR Departments in 2026
Human Resources/HR8 months ago

BlackSanta EDR Killer: A New Threat to HR Departments in 2026

In March 2026, a sophisticated cyberattack campaign was uncovered targeting human resources (HR) departments. Russian-speaking threat actors distributed malware via spear-phishing emails containing ISO image files disguised as resumes. Upon execution, these files initiated a multi-stage infection chain, culminating in the deployment of 'BlackSanta,' an Endpoint Detection and Response (EDR) killer. BlackSanta disabled security solutions by terminating antivirus processes, shutting down EDR agents, and suppressing system logging, allowing attackers to exfiltrate sensitive data undetected. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blacksanta-edr-killer-spotted-targeting-hr-departments/?utm_source=openai)) This incident underscores a growing trend of cybercriminals exploiting HR workflows to infiltrate organizations. The use of advanced evasion techniques, such as steganography and DLL sideloading, highlights the increasing sophistication of these attacks. Organizations must enhance security measures within HR processes to mitigate such threats. ([darkreading.com](https://www.darkreading.com/threat-intelligence/blacksanta-edr-killer-hr-workflows?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(low)
Read report
APT28's Stealthy Cyber-Espionage Tactics Target Ukrainian Military in 2026
Defense/Space8 months ago

APT28's Stealthy Cyber-Espionage Tactics Target Ukrainian Military in 2026

In April 2024, the Russian state-sponsored hacking group APT28 initiated a cyber-espionage campaign targeting Ukrainian military personnel. Utilizing spear-phishing messages sent via the Signal messaging app, attackers distributed malicious Microsoft Word documents embedded with macros. Once enabled, these macros triggered a multi-stage infection chain, deploying the COVENANT framework and the BEARDSHELL backdoor. The malware leveraged legitimate cloud services like Icedrive and Koofr for command-and-control communications, facilitating long-term surveillance and data exfiltration. ([thehackernews.com](https://thehackernews.com/2026/03/apt28-uses-beardshell-and-covenant.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored actors, who increasingly exploit trusted platforms and sophisticated obfuscation techniques to evade detection. The use of legitimate cloud services for command-and-control highlights the challenges in distinguishing malicious activity from normal network traffic, emphasizing the need for advanced threat detection mechanisms. ([scworld.com](https://www.scworld.com/news/fancy-bear-attacks-abuse-office-macros-legitimate-cloud-services?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials
Health Care / Life Sciences8 months ago

FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials

In early 2026, threat actors exploited vulnerabilities and weak credentials in FortiGate Next-Generation Firewall (NGFW) appliances to breach networks across healthcare, government, and managed service providers. By accessing these devices, attackers extracted configuration files containing service account credentials and network topology information, enabling unauthorized access to Active Directory environments and the enrollment of rogue workstations. The breaches were detected during lateral movement phases, preventing further escalation. ([sentinelone.com](https://www.sentinelone.com/blog/fortigate-edge-intrusions/?utm_source=openai)) This incident underscores the critical importance of securing network infrastructure devices, as their compromise can lead to significant data breaches and operational disruptions. The exploitation of such devices highlights the evolving tactics of threat actors targeting essential security appliances to gain deeper access into organizational networks. ([sentinelone.com](https://www.sentinelone.com/blog/fortigate-edge-intrusions/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports