Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Malicious npm Packages Leverage Adspect Cloaking to Fuel Crypto Supply Chain Scam (2024)
In early 2024, a sophisticated supply chain attack was uncovered involving a wave of malicious npm packages that abused Adspect cloaking techniques to avoid detection. Attackers published seemingly benign JavaScript libraries to the official npm registry. Once installed, these packages deployed malware via fake cryptocurrency-related sites, using cloaking to distinguish between legitimate victims and security researchers. The campaign allowed threat actors to evade automated scans, maximize the longevity of their malicious payloads, and target developers and end users with credential theft and crypto scams. This incident highlights the evolving threat landscape around open-source software supply chains. The use of advanced traffic cloaking and victim filtering marks a new escalation in attacker TTPs, forcing organizations to revisit how they vet third-party dependencies and monitor developer ecosystems for hidden threats.
8 months ago
Kill Chain
APT42’s ‘SpearSpecter’: Iranian State Hackers Breach Defense & Government Targets in 2025
In September 2025, the Iranian state-sponsored threat group APT42 launched a targeted cyber-espionage campaign, codenamed 'SpearSpecter', against global defense and government organizations with ties or relevance to the Iranian Islamic Revolutionary Guard Corps (IRGC). Attackers employed spear-phishing and advanced malware to infiltrate internal systems, establish encrypted backdoors, and move laterally, aiming to gather intelligence and monitor sensitive communications. The operation has compromised multiple agencies, with impacts including loss of classified data and exposure of critical government operations. This incident underscores the intensifying sophistication of state-sponsored actors leveraging advanced persistence techniques and custom tooling to evade detection. These campaigns highlight the persistent threat posed by geopolitically motivated attacks and the urgent need for robust intrusion detection and segmenting sensitive assets.
8 months ago
Kill Chain
150,000 Malicious Packages Flood NPM in Record-Breaking Token Farming Attack
In early June 2024, attackers unleashed a self-replicating campaign on the NPM package registry, flooding it with over 150,000 malicious packages. The attack targeted user authentication tokens linked to the tea.xyz protocol, leveraging automation to exploit repository weaknesses and propagate at scale. The malicious packages were largely automated, making detection and removal challenging. The attackers’ actions threatened to undermine trust in the open-source JavaScript ecosystem, potentially exposing developers and end users integrating these packages into their applications to credential theft and further compromise. This incident underscores the escalating risks in software supply chains, where open-source dependencies serve as fertile ground for large-scale token harvesting and distributed attacks. It highlights a concerning rise in automation-driven supply chain exploits and the urgent need for enhanced package repository security and vetting processes.
8 months ago
Kill Chain
North Korean Threat Actors Weaponize JSON Services for Stealthy Malware Campaigns
In late 2025, security researchers from NVISO identified a new supply chain attack campaign attributed to North Korean threat actors, leveraging popular JSON storage services—such as JSON Keeper, JSONsilo, and npoint.io—to covertly distribute trojanized malware payloads. The attackers embedded malicious code in legitimate-looking coding projects and lured developers, weaponizing widely used file formats and cloud APIs as their delivery mechanism. Consequently, targeted organizations experienced risks of credential theft, data exfiltration, and potential network breaches, with increased threat visibility due to attackers’ creative use of benign infrastructure as covert command and control channels. This incident highlights a broader trend: state-sponsored actors are rapidly innovating malware delivery by abusing cloud-based, trusted SaaS platforms. The use of developer-centric resources and supply chain lures expands attack surfaces and increases risk to technology-driven enterprises, intensifying the need for zero trust controls and supply chain vigilance.
8 months ago
Kill Chain
North Korean Insider Fraud Breach: How US Firms Were Infiltrated in 2024
In early 2024, the U.S. Department of Justice announced that five individuals pleaded guilty to helping North Korean operatives illicitly obtain remote IT work with American companies. The accused provided support and deception to facilitate North Korean nationals—working under assumed identities—to infiltrate U.S. organizations in a widespread insider threat campaign. These operatives gained access to proprietary data and corporate resources, generating significant revenue for North Korea through fraudulently obtained salaries, often paid in cryptocurrency. The scheme exploited remote work arrangements and weaknesses in identity verification, posing serious risks to sensitive sectors and exposing organizations to data theft and compliance violations. This case illustrates the increasing sophistication of insider threat attacks using stolen or falsified identities, especially targeting remote workforces. Organizations face growing urgency to enhance zero trust security, segment lateral movement, and strengthen controls for detecting and verifying remote personnel as geopolitical actors intensify efforts to bypass western sanctions and exploit globalized IT supply chains.
8 months ago
Kill Chain
Fortinet FortiWeb’s 2025 Path Traversal Attack: What You Need to Know
In November 2025, Fortinet's FortiWeb product was found vulnerable to an actively exploited path traversal flaw, designated as CVE-2025-64446. Malicious actors leveraged this vulnerability to bypass web application security measures, gaining unauthorized access to sensitive files on the system. As a result, attackers could exfiltrate data and potentially escalate privileges, thereby putting organizations at significant risk of broader compromise. The flaw became a critical concern for organizations using FortiWeb, prompting immediate remediation actions to protect against ongoing attacks targeting US federal and private sector networks. The incident highlights the growing trend of sophisticated exploitation of web application devices by threat actors. A surge in path traversal and similar vulnerabilities in critical infrastructure underscores the need for robust, proactive vulnerability management as required by directives like CISA BOD 22-01 and made clear by its inclusion in the Known Exploited Vulnerabilities Catalog.
8 months ago
Kill Chain
Malicious ‘Safery’ Chrome Extension Steals Ethereum: Anatomy of a 2025 Infostealer Attack
In November 2025, cybersecurity researchers identified a malicious Chrome extension named "Safery: Ethereum Wallet," which masqueraded as a legitimate cryptocurrency management tool but was designed to steal users' Ethereum wallet seed phrases. The extension was covertly uploaded to the Chrome Web Store, targeting unsuspecting cryptocurrency holders by promising enhanced security and flexible settings. After users entered their wallet credentials, the extension exfiltrated sensitive seed phrases via transactions on the Sui blockchain, effectively enabling attackers to compromise and drain user wallets. The incident rapidly gained attention due to its stealthy distribution and use of decentralized channels for data exfiltration. This breach underscores a growing trend of sophisticated infostealers leveraging browser extensions and blockchain-based exfiltration routes to exploit gaps in endpoint and cloud application security. The persistent evolution of phishing and credential theft tactics increases regulatory pressure and demands more robust zero trust and egress policy enforcement across digital ecosystems.
8 months ago
Kill Chain
Russian Hackers Create 4,300 Fake Travel Sites to Phish Hotel Guests
In early 2025, a Russian-speaking threat group orchestrated a widespread phishing campaign targeting the hospitality sector by registering over 4,300 fraudulent travel and hotel websites. Posing as legitimate booking platforms, the attackers lured hotel guests via persuasive spam emails, harvesting sensitive payment data and personal information from unsuspecting travelers. The threat actor leveraged sophisticated domain registration strategies and rapid site turnover to evade detection, resulting in a significant exposure of financial data and reputational harm to both guests and affected hospitality brands. This incident signals an ongoing trend of highly targeted phishing operations in the travel industry, exploiting the surge in online bookings and trust in familiar brand identities. The campaign underscores the critical need for advanced threat detection, greater scrutiny of online domains, and robust security awareness for organizations and their customers.
8 months ago
Kill Chain
Coyote & Maverick Banking Trojans: 2024 Banking Attacks Sweep Brazil
In 2024, cybersecurity researchers observed a surge in banking Trojan activity in Brazil, notably from two malware strains named Coyote and Maverick. These Trojans specifically target financial institutions and individual banking customers by using advanced phishing campaigns, malicious email attachments, and fake banking apps to infiltrate devices. Once installed, they deploy credential-stealing modules, monitor browser activity, and intercept authentication data, often leveraging encrypted and east-west network traffic to evade security controls. Maverick is engineered to self-terminate if it detects a target located outside Brazil, indicating a strong geo-targeting component. The campaign’s impact includes stolen banking credentials, financial fraud, and operational disruption for affected users and banks in the region. The continued advancement and targeted nature of these Brazilian banking Trojans demonstrate a significant evolution in threat actor sophistication, especially toward region-specific attacks. Organizations need to heighten their defenses and monitor emerging tactics as financially motivated cybercrime rises across Latin America.
8 months ago
Kill Chain
Amazon Detects APT Group Exploiting Cisco & Citrix Zero-Days in 2024
In summer 2024, Amazon’s threat intelligence team identified that an advanced persistent threat (APT) group exploited zero-day vulnerabilities in Cisco Identity Services Engine (CVE-2025-20337) and Citrix NetScaler (CVE-2025-5777), months before official patches were released. The attackers leveraged custom malware with advanced evasion capabilities, demonstrating a deep understanding of enterprise Java and network edge products. Exploitation was detected as early as May, prior to vendor disclosure, allowing the threat actor prolonged access to target environments for likely espionage purposes. Massive exploitation attempts followed public disclosure, impacting thousands of organizations globally. This incident underscores the increased speed and sophistication with which threat groups are identifying and weaponizing zero-day vulnerabilities in critical network and identity infrastructure. The trend poses escalating risks for organizations relying on edge devices, making timely patching and layered defenses more crucial than ever.
8 months ago
Kill Chain
Synnovis 2024 Ransomware Breach: UK Healthcare Services and Patient Data Exposed
In June 2024, Synnovis, a leading UK pathology services provider, suffered a significant ransomware attack that led to operational disruption and the exposure of sensitive patient data. The attack, attributed to Russian-speaking threat actor group Qilin, resulted in widespread IT outages across London hospitals, delaying critical healthcare procedures and temporarily halting diagnostic services. Investigations revealed that attackers were able to steal files containing patient information before encrypting core systems, underscoring the vulnerability of healthcare organizations to ransomware campaigns targeting their critical infrastructure. This incident is emblematic of a surge in highly targeted ransomware attacks against the healthcare sector globally. With a marked increase in double-extortion tactics and operationally disruptive attacks, this event highlights escalating cyber risk, increasing regulatory oversight, and the urgent need for robust cyber-resilience in healthcare.
8 months ago
Kill Chain
Cisco ASA & Firepower Exploits: 2025 Emergency Directive and Breach Analysis
In September 2025, critical vulnerabilities (CVE-2025-20333 and CVE-2025-20362) in Cisco Adaptive Security Appliance (ASA) and Firepower devices were actively exploited by unidentified threat actors. The initial compromise stemmed from unpatched or insufficiently updated devices, enabling attackers to bypass security controls, conduct lateral movement, and potentially gain persistent access to affected networks. CISA responded by issuing Emergency Directive 25-03, requiring federal agencies to verify patch levels, perform core dump analyses with RayDetect, and execute urgent remediation steps. Numerous organizations that assumed their systems were protected were found to be running outdated software, escalating operational risks and exposing sensitive data. This incident underscores a growing trend of attackers targeting critical network infrastructure devices leveraging newly discovered or previously unpatched vulnerabilities. With increasing regulatory scrutiny, immediate and robust vulnerability management is required across all sectors to prevent exploitation of supply chain and edge network technologies.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports