Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 76 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 901–912 / 1289 reports
Global Operation Dismantles Tycoon2FA Phishing Platform
Banking/Mortgage8 months ago

Global Operation Dismantles Tycoon2FA Phishing Platform

In March 2026, a coordinated international operation led by Europol and Microsoft successfully dismantled Tycoon2FA, a prominent phishing-as-a-service (PhaaS) platform active since August 2023. Tycoon2FA enabled cybercriminals to bypass multi-factor authentication (MFA) by intercepting live authentication sessions, capturing credentials, one-time passcodes, and session cookies in real time. This service was responsible for tens of millions of phishing emails each month, targeting over 500,000 organizations globally, including schools, hospitals, and public institutions. The takedown involved seizing 330 domains that formed the platform's core infrastructure, significantly disrupting its operations and mitigating further harm. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/?utm_source=openai)) The dismantling of Tycoon2FA underscores the evolving sophistication of cyber threats, particularly the commoditization of tools that facilitate large-scale MFA bypass attacks. This incident highlights the critical need for organizations to adopt phishing-resistant authentication mechanisms and enhance their cybersecurity posture to defend against such advanced threats. ([newsroom.trendmicro.com](https://newsroom.trendmicro.com/2026-03-04-TrendAI-TM-Helps-Drive-Global-Takedown-of-Tycoon-2FA-MFA-Bypass-Phishing-Service?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UMMC's 2026 Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity
Health Care / Life Sciences8 months ago

UMMC's 2026 Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity

In February 2026, the University of Mississippi Medical Center (UMMC) experienced a significant ransomware attack attributed to the Medusa ransomware group. The attack led to the closure of 35 clinics and the cancellation of elective procedures, severely disrupting healthcare services. UMMC's electronic health record system and communication networks were compromised, necessitating a shift to manual operations. The medical center collaborated with federal authorities, including the FBI, to investigate and mitigate the attack. After nine days, UMMC restored its systems and resumed normal operations. ([nationaltoday.com](https://nationaltoday.com/us/ms/jackson/news/2026/03/04/ummc-resumes-operations-after-ransomware-attack/?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting critical infrastructure, particularly in the healthcare sector. The Medusa group's double extortion tactics, involving data encryption and threats to release sensitive information, highlight the urgent need for robust cybersecurity measures to protect patient data and ensure uninterrupted medical services. ([aha.org](https://www.aha.org/news/headline/2025-03-14-advisory-warns-medusa-ransomware-activity?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Coruna iOS Exploit Kit: A 2025 Cybersecurity Threat Analysis
Financial Services8 months ago

Coruna iOS Exploit Kit: A 2025 Cybersecurity Threat Analysis

In 2025, the Coruna iOS exploit kit emerged as a sophisticated tool targeting iPhone users across multiple campaigns. Initially identified in February 2025, it was deployed by a surveillance vendor's customer. By summer, the same exploit kit was utilized by the Russian espionage group UNC6353 in watering hole attacks on Ukrainian websites. Later in the year, the financially motivated Chinese threat actor UNC6691 employed Coruna to compromise fake Chinese gambling and cryptocurrency sites. The kit comprises 23 exploits forming five full exploit chains, affecting iOS versions 13.0 through 17.2.1. These exploits enable remote code execution, sandbox escapes, and kernel privilege escalation, leading to unauthorized access and data exfiltration. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks/?utm_source=openai)) The proliferation of Coruna underscores a concerning trend: advanced exploit kits, possibly originating from state-sponsored entities, are increasingly accessible to a broader range of threat actors. This shift highlights the urgent need for organizations to stay vigilant, update their systems promptly, and implement robust security measures to mitigate the risks posed by such sophisticated tools. ([wired.com](https://www.wired.com/story/coruna-iphone-hacking-toolkit-us-government/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Cisco Firewall Vulnerabilities Disclosed in 2026
Computer/Network Security8 months ago

Critical Cisco Firewall Vulnerabilities Disclosed in 2026

In March 2026, Cisco disclosed two critical vulnerabilities in its Secure Firewall Management Center (FMC) software: an authentication bypass flaw (CVE-2026-20079) and a remote code execution (RCE) vulnerability (CVE-2026-20131). Both vulnerabilities allow unauthenticated, remote attackers to gain root access to affected devices. CVE-2026-20079 enables attackers to execute scripts and commands by sending crafted HTTP requests, while CVE-2026-20131 allows execution of arbitrary Java code through crafted serialized Java objects. These flaws affect both on-premises FMC installations and Cisco's Security Cloud Control (SCC) Firewall Management. Cisco has released patches to address these issues and recommends immediate updates to mitigate potential risks. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh?utm_source=openai)) The disclosure of these vulnerabilities underscores the ongoing challenges in securing network management interfaces. Organizations are urged to review their security postures, especially concerning remote access and authentication mechanisms, to prevent potential exploitation of similar flaws in the future.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the Coruna iOS Exploit Kit: Implications and Protections
Financial Services8 months ago

Understanding the Coruna iOS Exploit Kit: Implications and Protections

In early 2026, Google’s Threat Intelligence Group identified 'Coruna,' a sophisticated iOS exploit kit targeting devices running iOS versions 13.0 through 17.2.1. The kit comprises five full exploit chains utilizing 23 vulnerabilities, enabling attackers to execute remote code and escalate privileges. Initially observed in February 2025 within a surveillance vendor's operations, Coruna was subsequently employed by Russian espionage groups in mid-2025 and later by financially motivated Chinese cybercriminals by December 2025. The exploit kit facilitates the deployment of malware capable of exfiltrating sensitive data, including cryptocurrency wallets and personal information. ([thehackernews.com](https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html?utm_source=openai)) The emergence of Coruna underscores a concerning trend where advanced cyber tools, potentially developed by nation-states, proliferate into the hands of various threat actors. This incident highlights the critical need for organizations and individuals to maintain up-to-date software and implement robust security measures to mitigate the risks posed by such sophisticated exploits. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Silver Dragon 2026: Unveiling APT41's Covert Cyberespionage Tactics
Government Administration8 months ago

Silver Dragon 2026: Unveiling APT41's Covert Cyberespionage Tactics

In mid-2024, the Chinese state-sponsored group Silver Dragon, associated with APT41, initiated cyberespionage campaigns targeting government organizations across Southeast Asia and Europe. The group gained initial access through exploiting public-facing servers and phishing emails containing malicious attachments. To maintain persistence, Silver Dragon hijacked legitimate Windows services, allowing their malware to blend seamlessly with normal system activities. They deployed custom tools like GearDoor, which utilized Google Drive for covert command-and-control communications, SSHcmd for remote access, and SliverScreen for capturing user activity screenshots. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who are increasingly leveraging trusted cloud services and legitimate system processes to evade detection. The use of such sophisticated methods highlights the need for organizations to enhance their cybersecurity measures and remain vigilant against advanced persistent threats. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
INTERPOL's Operation Sentinel: A Landmark Cybercrime Crackdown in Africa
Banking/Mortgage8 months ago

INTERPOL's Operation Sentinel: A Landmark Cybercrime Crackdown in Africa

Between October 27 and November 27, 2025, INTERPOL coordinated Operation Sentinel, a significant cybercrime crackdown across 19 African countries. The operation led to the arrest of 574 suspects involved in business email compromise (BEC), digital extortion, and ransomware attacks. Authorities dismantled over 6,000 malicious links, decrypted six ransomware variants, and recovered approximately USD 3 million. The cases investigated were linked to estimated financial losses exceeding USD 21 million. Notable incidents included a thwarted USD 7.9 million BEC attempt targeting a petroleum company in Senegal and a ransomware attack in Ghana that encrypted 100 terabytes of data, with nearly 30 terabytes successfully recovered. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai)) This operation underscores the escalating threat of cybercrime in Africa, with online offenses now accounting for a significant proportion of all crimes in many regions. The success of Operation Sentinel highlights the effectiveness of international collaboration in combating cyber-related offenses and the critical need for continued vigilance and cooperation to protect critical infrastructure and sensitive data. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Coruna Exploit Kit: Unveiling the First Mass-Scale iOS Attack
Government Administration8 months ago

Coruna Exploit Kit: Unveiling the First Mass-Scale iOS Attack

In early 2026, security researchers uncovered the 'Coruna' exploit kit, a sophisticated suite of hacking tools capable of compromising iPhones running older iOS versions. Initially identified in February 2025 during a surveillance vendor's attempt to deploy spyware on behalf of a government client, Coruna was later observed in attacks targeting Ukrainian users by a Russian espionage group and subsequently by financially motivated hackers in China. The exploit kit chains together multiple vulnerabilities, allowing attackers to bypass iOS defenses and gain full control over targeted devices. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai)) The proliferation of Coruna underscores the risks associated with the leakage of advanced cyber tools originally developed for government use. Similar to the EternalBlue exploit that fueled the WannaCry and NotPetya attacks in 2017, Coruna's widespread availability has enabled various threat actors to conduct mass-scale attacks on iOS devices, affecting at least 42,000 devices to date.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Perplexity Comet Browser's 'PleaseFix' Vulnerabilities Expose Critical Security Flaws
Computer Software/Engineering8 months ago

Perplexity Comet Browser's 'PleaseFix' Vulnerabilities Expose Critical Security Flaws

In March 2026, Zenity Labs disclosed critical vulnerabilities in Perplexity's AI-powered Comet browser, collectively termed 'PleaseFix.' These flaws allowed attackers to exploit indirect prompt injections, enabling unauthorized access to local files and credential theft without user interaction. By embedding malicious prompts in trusted content, such as calendar invites, attackers could manipulate the AI agent to perform unauthorized actions, including exfiltrating sensitive data and compromising password managers like 1Password. Perplexity addressed these vulnerabilities following responsible disclosure, implementing fixes to prevent autonomous access to local file systems and unauthorized credential manipulation. This incident underscores the inherent security challenges in agentic AI systems, highlighting the need for robust safeguards against prompt injection attacks and the importance of continuous monitoring and updating of AI-driven applications to mitigate emerging threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CyberStrikeAI: The AI Tool Empowering Hackers in 2026
Computer/Network Security8 months ago

CyberStrikeAI: The AI Tool Empowering Hackers in 2026

In early 2026, cybersecurity researchers identified that threat actors had adopted CyberStrikeAI, an open-source AI-native security testing platform, to automate and enhance their cyberattacks. This tool integrates over 100 security tools with an intelligent orchestration engine, enabling end-to-end automation from vulnerability discovery to attack-chain analysis. Notably, the same infrastructure used in a campaign that breached over 500 Fortinet FortiGate firewalls was observed running CyberStrikeAI, indicating its role in facilitating these attacks. The adoption of AI-powered tools like CyberStrikeAI by cybercriminals signifies a shift towards more sophisticated and automated attack methodologies. This trend underscores the urgent need for organizations to bolster their defenses against AI-driven threats, as traditional security measures may become increasingly inadequate.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AI-Assisted FortiGate Breach 2026: A Wake-Up Call for Network Security
Computer/Network Security8 months ago

AI-Assisted FortiGate Breach 2026: A Wake-Up Call for Network Security

Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor utilized multiple commercial generative AI services to compromise over 600 Fortinet FortiGate firewalls across more than 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking multi-factor authentication, without leveraging any known FortiGate vulnerabilities. This campaign underscores the growing trend of cybercriminals employing AI tools to automate and scale attacks, significantly reducing the technical expertise required to execute large-scale intrusions. The incident highlights the urgent need for organizations to secure management interfaces, enforce strong authentication mechanisms, and stay vigilant against AI-assisted cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
North Korean Hackers Exploit npm Packages in 2026 Supply Chain Attack
Computer Software/Engineering8 months ago

North Korean Hackers Exploit npm Packages in 2026 Supply Chain Attack

In March 2026, North Korean state-sponsored hackers launched a sophisticated supply chain attack by publishing 26 malicious npm packages disguised as developer tools. These packages utilized steganography to extract command-and-control (C2) URLs from seemingly benign Pastebin content, ultimately deploying a cross-platform remote access trojan (RAT) targeting developers. The C2 infrastructure was hosted on Vercel across 31 deployments, enabling the attackers to execute commands, exfiltrate sensitive data, and maintain persistent access to compromised systems. This incident underscores the evolving tactics of threat actors in exploiting trusted open-source ecosystems to infiltrate developer environments. The use of steganography and multi-stage payload delivery highlights the increasing complexity of supply chain attacks, emphasizing the need for enhanced vigilance and security measures within the software development community.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports