Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 78 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 925–936 / 1289 reports
Trend Micro Apex One 2026 Critical RCE Vulnerabilities
Health Care / Life Sciences8 months ago

Trend Micro Apex One 2026 Critical RCE Vulnerabilities

In February 2026, Trend Micro identified and patched two critical vulnerabilities (CVE-2025-71210 and CVE-2025-71211) in its Apex One endpoint security platform. These flaws, both with a CVSS score of 9.8, allowed unauthenticated remote attackers to execute arbitrary code via path traversal weaknesses in the management console. Exploitation required access to the console, posing significant risks to organizations with externally exposed management interfaces. Trend Micro released Critical Patch Build 14136 to address these issues and advised customers to update promptly. This incident underscores the persistent threat posed by vulnerabilities in security management consoles, emphasizing the need for organizations to implement stringent access controls and maintain up-to-date systems to mitigate potential exploitation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UAT-10027's Dohdoor Backdoor: A New Threat to U.S. Education and Healthcare
Higher Education/Acadamia8 months ago

UAT-10027's Dohdoor Backdoor: A New Threat to U.S. Education and Healthcare

In December 2025, the threat actor group UAT-10027 initiated a sophisticated cyber campaign targeting the U.S. education and healthcare sectors. The attackers employed a novel backdoor named Dohdoor, which utilizes DNS-over-HTTPS (DoH) for covert command-and-control communications, effectively evading traditional network monitoring tools. The initial infection vector is suspected to involve phishing emails that execute PowerShell scripts, leading to the download and execution of malicious DLLs via DLL side-loading techniques. These DLLs facilitate the deployment of additional payloads, such as Cobalt Strike Beacons, directly into the memory of compromised systems. The campaign's use of legitimate Windows processes and encrypted communications poses significant challenges for detection and mitigation. ([thehackernews.com](https://thehackernews.com/2026/02/uat-10027-targets-us-education-and.html?utm_source=openai)) This incident underscores a growing trend of advanced persistent threats (APTs) leveraging encrypted communication channels like DoH to conceal malicious activities. The targeting of critical sectors such as education and healthcare highlights the urgent need for enhanced cybersecurity measures and vigilance against sophisticated attack vectors. ([thehackernews.com](https://thehackernews.com/2026/02/uat-10027-targets-us-education-and.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
Chinese Police Exploit ChatGPT in Smear Campaign Against Japan's PM Takaichi
Government Administration8 months ago

Chinese Police Exploit ChatGPT in Smear Campaign Against Japan's PM Takaichi

In October 2025, OpenAI identified and banned a ChatGPT account linked to Chinese law enforcement that was used to orchestrate a smear campaign against Japan's Prime Minister, Sanae Takaichi. The individual behind the account attempted to leverage ChatGPT to generate and amplify negative content about Takaichi, including drafting complaints impersonating Japanese citizens and creating social media posts to incite public dissent. These activities were part of a broader, covert influence operation aimed at discrediting foreign officials critical of China's policies. ([theregister.com](https://www.theregister.com/2026/02/25/chinese_law_enforcement_chatgpt_abuse/?utm_source=openai)) This incident underscores the evolving use of artificial intelligence in state-sponsored disinformation campaigns. The exposure of such tactics highlights the need for vigilance against AI-driven influence operations, especially as they become more sophisticated and harder to detect. ([axios.com](https://www.axios.com/2026/02/25/openai-chatgpt-china-japan-prime-minister?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ex-L3Harris Executive Sentenced for Selling Zero-Day Exploits to Russian Broker
Defense/Space8 months ago

Ex-L3Harris Executive Sentenced for Selling Zero-Day Exploits to Russian Broker

Between 2022 and 2025, Peter Williams, a 39-year-old Australian national and former general manager of Trenchant—a cybersecurity unit of defense contractor L3Harris—stole at least eight sensitive cyber-exploit components intended exclusively for the U.S. government and its allies. Williams sold these zero-day exploits to Operation Zero, a Russian cyber-tools broker that advertises its services to non-NATO buyers, including the Russian government. The theft resulted in $35 million in losses to L3Harris and potentially enabled unauthorized access to millions of devices worldwide. In October 2025, Williams pleaded guilty to two counts of theft of trade secrets and, in February 2026, was sentenced to 87 months in federal prison, forfeiting $1.3 million in cryptocurrency, a house, and luxury items. ([justice.gov](https://www.justice.gov/opa/pr/former-general-manager-us-defense-contractor-sentenced-87-months-selling-stolen-trade?utm_source=openai)) This incident underscores the critical threat posed by insider threats within defense and cybersecurity sectors. The sale of zero-day exploits to adversarial entities highlights the urgent need for robust internal security measures, comprehensive employee vetting, and continuous monitoring to prevent unauthorized access and exfiltration of sensitive information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Marquis Software Solutions Ransomware Attack: A Supply Chain Vulnerability Exposed
Banking/Mortgage8 months ago

Marquis Software Solutions Ransomware Attack: A Supply Chain Vulnerability Exposed

In August 2025, Marquis Software Solutions, a Texas-based fintech firm serving over 700 financial institutions, experienced a ransomware attack that compromised sensitive data of more than 780,000 individuals across at least 80 banks and credit unions. The attackers exploited a vulnerability in SonicWall's firewall backup service, gaining unauthorized access to Marquis's network and exfiltrating personal information, including names, addresses, Social Security numbers, and financial account details. This breach underscores the critical importance of securing third-party services and the potential cascading effects of supply chain vulnerabilities. The incident highlights the growing trend of cybercriminals targeting supply chain weaknesses to infiltrate organizations, emphasizing the need for comprehensive security assessments and robust vendor management practices to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Chinese Cyberspies Exploit Google Sheets in 2026 Telecom Breach
Telecommunications8 months ago

Chinese Cyberspies Exploit Google Sheets in 2026 Telecom Breach

In February 2026, Google's Threat Intelligence Group, in collaboration with Mandiant and other partners, disrupted a sophisticated cyber-espionage campaign attributed to a Chinese state-sponsored actor known as UNC2814. This campaign, active since at least 2023, targeted 53 organizations across 42 countries, primarily within the telecommunications and government sectors. The attackers deployed a novel backdoor named 'GRIDTIDE,' which exploited the Google Sheets API to facilitate covert command-and-control operations, effectively blending malicious traffic with legitimate network activity. The initial access vector remains unidentified; however, UNC2814 has a history of exploiting vulnerabilities in web servers and edge systems to infiltrate target networks. ([thehackernews.com](https://thehackernews.com/2026/02/google-disrupts-unc2814-gridtide.html?utm_source=openai)) The disruption of this campaign underscores the persistent and evolving nature of cyber threats posed by state-sponsored actors. The use of legitimate services like Google Sheets for command-and-control highlights the increasing sophistication of such attacks, making detection and mitigation more challenging. Organizations, especially those in critical infrastructure sectors, must remain vigilant and adopt comprehensive cybersecurity measures to defend against these advanced persistent threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
L3Harris Insider Breach: Zero-Day Exploits Sold to Russian Broker
Defense/Space8 months ago

L3Harris Insider Breach: Zero-Day Exploits Sold to Russian Broker

In October 2025, Peter Williams, a 39-year-old Australian national and former general manager at L3Harris's Trenchant division, pleaded guilty to stealing and selling eight zero-day exploits to a Russian broker, Operation Zero. Over a three-year period, Williams transferred these sensitive cyber-exploit components, originally intended for U.S. government and allied use, in exchange for approximately $1.3 million in cryptocurrency. This unauthorized sale resulted in significant national security concerns and financial losses exceeding $35 million for L3Harris. ([techcrunch.com](https://techcrunch.com/2025/10/29/former-l3harris-trenchant-boss-pleads-guilty-to-selling-zero-day-exploits-to-russian-broker/?utm_source=openai)) This incident underscores the critical need for stringent internal security measures within defense contractors, especially concerning personnel with high-level access to sensitive information. The case highlights the growing threat posed by insider threats and the importance of robust monitoring and compliance frameworks to prevent unauthorized dissemination of national security assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Google Disrupts UNC2814's Global Cyber Espionage Campaign
Telecommunications8 months ago

Google Disrupts UNC2814's Global Cyber Espionage Campaign

In February 2026, Google, in collaboration with industry partners, disrupted a sophisticated cyber espionage campaign orchestrated by the Chinese-linked group UNC2814. Active since at least 2017, UNC2814 infiltrated 53 organizations across 42 countries, primarily targeting telecommunications and government sectors. The group employed a novel backdoor, GRIDTIDE, which exploited the Google Sheets API to disguise command-and-control (C2) communications, enabling the execution of arbitrary shell commands and data exfiltration. The attackers gained initial access by compromising web servers and edge systems, subsequently moving laterally within networks using service accounts and living-off-the-land techniques. ([thehackernews.com](https://thehackernews.com/2026/02/google-disrupts-unc2814-gridtide.html?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors in leveraging legitimate cloud services to evade detection. The global scale and sophistication of UNC2814's operations highlight the critical need for organizations to enhance their cybersecurity measures, particularly in monitoring and securing cloud-based applications and APIs. ([thehackernews.com](https://thehackernews.com/2026/02/google-disrupts-unc2814-gridtide.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
Critical Security Flaws Discovered in Gardyn Home Kit: What You Need to Know
Food Production8 months ago

Critical Security Flaws Discovered in Gardyn Home Kit: What You Need to Know

In February 2026, multiple critical vulnerabilities were identified in the Gardyn Home Kit, an AI-powered indoor gardening system. These flaws included insecure credential exchange (CVE-2025-29628), weak default SSH credentials (CVE-2025-29629), command injection vulnerabilities (CVE-2025-29631), and API credential leakage (CVE-2025-1242). Exploitation could have allowed unauthenticated users to remotely control devices, access user information, and pivot to other devices within the Gardyn cloud environment. Gardyn promptly addressed these issues by releasing firmware updates and advising users to ensure their devices were connected to the internet to receive automatic updates. ([mygardyn.com](https://mygardyn.com/blog/security-update/?utm_source=openai)) This incident underscores the growing security challenges in IoT devices, particularly those integrated into personal living spaces. The vulnerabilities highlight the importance of robust security practices in the development and maintenance of smart home technologies to prevent unauthorized access and potential data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
L3Harris Executive Sentenced for Selling Zero-Day Exploits to Russian Broker
Defense/Space8 months ago

L3Harris Executive Sentenced for Selling Zero-Day Exploits to Russian Broker

In February 2026, Peter Williams, a former executive at L3Harris's cyber division Trenchant, was sentenced to 87 months in prison for selling eight zero-day exploits to a Russian broker, Operation Zero. Over a three-year period, Williams stole proprietary cyber tools intended for exclusive use by the U.S. government and its allies, causing an estimated $35 million in losses to L3Harris. He received approximately $1.3 million in cryptocurrency for the stolen exploits, which he used to purchase luxury items. This case underscores the severe risks posed by insider threats within defense contracting firms, especially concerning sensitive cybersecurity tools. The incident highlights the critical need for robust internal security measures and monitoring to prevent unauthorized access and exfiltration of proprietary information. Additionally, the U.S. Department of the Treasury sanctioned Operation Zero and its founder, Sergey Zelenyuk, for their role in acquiring and distributing cyber tools harmful to U.S. national security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ShinyHunters Breach Exposes 6.2 Million Odido Customers in 2026
Telecommunications8 months ago

ShinyHunters Breach Exposes 6.2 Million Odido Customers in 2026

In February 2026, Dutch telecommunications provider Odido suffered a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers infiltrated Odido's customer service system, compromising sensitive personal information of approximately 6.2 million customers. The stolen data included full names, home addresses, email addresses, phone numbers, bank account numbers (IBAN), dates of birth, and identity document details such as passport and driver's license numbers. ShinyHunters threatened to release this data on the dark web unless a ransom was paid. Odido confirmed the breach and advised customers to remain vigilant for potential misuse of their personal information. ([scancomply.com](https://scancomply.com/blog/february-2026-data-breach-report?utm_source=openai)) This incident underscores the escalating threat posed by sophisticated cybercriminal groups like ShinyHunters, who have previously targeted major organizations worldwide. The breach highlights the critical need for robust cybersecurity measures, especially in sectors handling vast amounts of personal data. Organizations must prioritize the implementation of advanced security protocols and employee training to mitigate the risks associated with such targeted attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Anthropic Uncovers Unauthorized Distillation Attacks by Chinese AI Firms in 2026
Computer Software/Engineering8 months ago

Anthropic Uncovers Unauthorized Distillation Attacks by Chinese AI Firms in 2026

In February 2026, Anthropic, a U.S.-based AI company, reported that three Chinese AI firms—DeepSeek, Moonshot AI, and MiniMax—conducted large-scale distillation attacks to extract capabilities from its Claude AI model. These companies generated over 16 million interactions using approximately 24,000 fraudulent accounts, violating Anthropic's terms of service and regional access restrictions. The attacks focused on Claude's advanced features, including reasoning, coding, and tool use, aiming to enhance their own AI models without proper authorization. This incident underscores the escalating risks of intellectual property theft in the AI sector, particularly through distillation techniques. Such activities not only compromise proprietary technologies but also pose significant national security concerns, as models developed through illicit means may lack essential safety measures, potentially facilitating malicious applications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports