Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
How a Zimbra Zero-Day Breach Exposed the Brazilian Military: Lessons for Secure Collaboration
In early 2025, a zero-day vulnerability in Zimbra Collaboration (CVE-2025-27915), a widely used email and collaboration platform, was exploited to target the Brazilian military. Attackers used malicious ICS calendar files containing unsanitized HTML and JavaScript to trigger stored cross-site scripting (XSS) within Zimbra's Classic Web Client. This entry vector effectively bypassed standard security controls and provided attackers the ability to execute malicious code in users' browsers, potentially enabling credential theft, session hijacking, and further movement inside the organization before the vulnerability was patched. The campaign underscores how attackers are increasingly leveraging vulnerabilities in collaborative and communication tools to gain a foothold in targeted organizations and critical infrastructure. This breach is particularly relevant today given the ongoing surge in zero-day exploits against widely deployed business applications, especially in sectors such as government and defense. The rapid weaponization of collaboration-tool vulnerabilities highlights the need for timely patch management, robust segmentation, and vigilant threat detection to combat sophisticated phishing and XSS-based initial access.
8 months ago
Kill Chain
How Chinese Front Organizations Exploited Western Research to Advance State Cyber Capabilities
In early 2024, coordinated investigations revealed that Chinese government-linked academic and research institutions were covertly collaborating with Western organizations and researchers. Operating under seemingly neutral fronts, these entities facilitated the transfer of advanced cyber technologies and expertise, ultimately benefitting the intelligence apparatus of the People’s Republic of China (PRC). The campaign included joint projects, academic exchanges, and technology partnerships that enabled the PRC to sidestep export controls and gain access to cutting-edge cyber defense and offensive capabilities. The outcome potentially undermines intellectual property protections and heightens risks to network and national security within targeted Western sectors. This incident underscores a marked escalation in supply chain and technology transfer tactics used by nation-state actors. As the global competition for cyber advantage intensifies, regulators and organizations must heighten vigilance around academic, research, and cross-border tech collaborations to mitigate risks of inadvertent technology leakage.
8 months ago
Kill Chain
Palo Alto Networks Faces Massive Surge in Login Portal Recon Scans
In early October 2025, cybersecurity firm GreyNoise detected a sharp 500% spike in reconnaissance scans targeting Palo Alto Networks GlobalProtect and PAN-OS login portals. Over 1,285 unique suspicious IP addresses, predominantly from the U.S., but also from the UK, Canada, the Netherlands, and Russia, launched automated probes against these authentication portals. The campaign appeared targeted, leveraging data from public scanning platforms like Shodan and Censys. No verified exploit or compromise has been confirmed, with Palo Alto Networks asserting their systems remain secure and attributing much of the observed activity to external fingerprinting, not internal breach. This incident highlights a broader escalation in focused reconnaissance tactics against major infrastructure platforms, often preceding attempts to weaponize new vulnerabilities. Organizations should remain vigilant about emerging threats, monitor authentication endpoints, and proactively patch known and zero-day-related risks.
8 months ago
Kill Chain
Palo Alto Networks Portals Targeted by 500% Surge in Reconnaissance Scanning
On October 3, 2025, cybersecurity researchers at GreyNoise detected an unprecedented 500% spike in scanning activity targeting Palo Alto Networks login portals, marking the highest volume observed over a three-month period. The scanning involved a surge of IP addresses systematically probing these portals, suggesting highly targeted reconnaissance efforts by unknown threat actors. While no direct exploitation or breach was reported, such coordinated scanning is often the precursor to exploitation attempts against potential vulnerabilities in security infrastructure, especially as targeted technologies are foundational for enterprise security postures. This incident exemplifies the growing trend of automated reconnaissance on high-value network assets as adversaries aim to map attack surfaces for later campaigns. Organizations relying on exposed management interfaces must bolster detection, segmentation, and access controls to address these evolving reconnaissance tactics.
8 months ago
Kill Chain
Salesforce Breach 2024: Scattered Lapsus$ Hunters' Massive Data Extortion Campaign
In October 2024, the cybercriminal collective Scattered Lapsus$ Hunters resurfaced with a dedicated leak site, threatening to publish stolen data related to Salesforce customers if their extortion demands were not met. This group, an alliance of threat actors including Scattered Spider, Lapsus$, and ShinyHunters, allegedly compromised Salesforce environments through social engineering—specifically vishing IT support personnel to obtain credentials and, in parallel campaigns, exploiting OAuth token theft. The attackers claimed to possess approximately one billion records from 39 prominent organizations, including sensitive personally identifiable information (PII) like Social Security and driver’s license numbers. This incident underscores the increased targeting of SaaS platforms via identity and access manipulation, as well as the growing sophistication of multinational threat actor collaborations. It signals elevated risk for organizations relying on cloud applications and highlights the necessity of enforcing multi-factor authentication and vigilant third-party access controls.
8 months ago
Kill Chain
Dutch Teens Arrested for Wi-Fi Sniffer Recon in 2024 Russian Espionage Case
In June 2024, Dutch law enforcement arrested two 17-year-olds suspected of conducting cyber-espionage for Russian-backed threat actors. The teens reportedly canvassed high-profile locations in The Hague, including several embassies and European law enforcement headquarters, using a Wi-Fi sniffer to gather network intelligence. Authorities allege they were recruited via Telegram and that state-sponsored Russian actors utilized the pair for reconnaissance, leveraging youth engagement to mask attribution. The operation came to light after a tip-off from Dutch intelligence, resulting in swift arrests and raising significant policy concerns. This incident underscores a rising trend of nation-states outsourcing early reconnaissance to foreign youth via social media, reducing their risk of direct detection. The use of simple yet effective tools for physical/digital hybrid espionage highlights growing operational sophistication—and creates new urgency for organizations to shore up network perimeter and monitoring controls.
8 months ago
Kill Chain
Israeli-Linked AI Disinformation Campaign Targets Iran Amid Evin Prison Strike
In June 2023, a coordinated network linked to the Israeli government, dubbed PRISONBREAK, used AI-generated deepfake content and social media manipulation to incite unrest in Iran amid escalating regional tensions and real-world airstrikes. Researchers at Citizen Lab and Clemson University uncovered how this sophisticated influence campaign leveraged newly created accounts on X to disseminate doctored videos and imagery—often timed with kinetic events such as an Israeli strike on Tehran’s Evin Prison. The operation successfully tricked news outlets and amassed significant engagement, specifically pushing calls for uprisings against the Iranian government. This incident spotlights the growing use of state-backed AI-enabled disinformation as a tool of hybrid warfare, bridging digital and physical attacks to maximize psychological impact. It exemplifies the broadening threat landscape, where credible-seeming content can intensify volatility and erode trust in open information ecosystems.
8 months ago
Kill Chain
Cavalry Werewolf APT Hits Russian Agencies with FoalShell and StallionRAT in 2025
In October 2025, a sophisticated threat actor known as Cavalry Werewolf, believed to share links with the YoroTrooper group, orchestrated targeted cyber attacks against Russian public sector agencies. Utilizing custom malware families FoalShell and StallionRAT, the attackers infiltrated key government systems, establishing covert access for potential espionage and data theft. Security firm BI.ZONE detected the activity, noting operational overlaps with other known clusters such as SturgeonPhisher and Comrade Saiga. The cyber-espionage campaign leveraged a mix of spear-phishing, credential theft, and advanced persistence techniques to evade detection and conduct lateral movement within critical infrastructure environments. This incident highlights a continuing trend of state-aligned espionage campaigns that exploit zero trust gaps, advanced malware, and blended tactics to compromise sensitive government data. The increasing frequency and sophistication of such attacks elevate the urgency for robust segmentation and monitoring strategies within public sector networks.
8 months ago
Kill Chain
Android Spyware Masquerades as Messaging Apps in UAE: ESET Uncovers 2024 Mobile Threats
In June 2024, ESET researchers uncovered two Android spyware campaigns—ProSpy and ToSpy—masquerading as popular messaging apps Signal and ToTok, specifically targeting residents in the United Arab Emirates. The malware was distributed via third-party websites impersonating legitimate app stores, such as the Samsung Galaxy Store, and required users to manually install them. Upon installation, the spyware requested extensive permissions, gaining access to contacts, messages, stored files, audio, images, and more, enabling extensive data exfiltration. The campaigns utilized regional delivery tactics to focus on UAE users, exploiting trusted local app brands. These findings highlight a persistent threat trend: attackers disguising malware as legitimate communication apps to bypass official channels and exploit regional trust. With increased scrutiny on privacy and secure messaging, such campaigns pose heightened operational and compliance risks for organizations and individuals alike, underscoring the urgent need for enhanced mobile security measures and user awareness.
8 months ago
Kill Chain
Android Spyware Campaigns Target Signal and ToTok Users in Sophisticated 2025 Attack
In June 2025, cybersecurity firm ESET uncovered targeted Android spyware campaigns, dubbed ProSpy and ToSpy, which impersonated upgrades and plugins for the popular messaging apps Signal and ToTok. Threat actors distributed malicious APK files via websites masquerading as official app sites and third-party stores, luring users primarily in the United Arab Emirates. Once installed, these spyware variants harvested sensitive data including device information, contacts, SMS, files, and backups, using sophisticated persistence mechanisms and disguising themselves as legitimate apps. Data exfiltration was conducted using encrypted channels to evade detection. This incident underscores the increasing threat of mobile malware leveraging convincing social engineering tactics and fake branding. It highlights a macro trend of attackers exploiting trust in widely used apps to infiltrate user devices, reflecting rising complexity in mobile threat landscapes and growing regulatory pressure on app distributors.
8 months ago
Kill Chain
Confucius Launches Targeted Campaign Against Pakistan with WooperStealer and Anondoor Malware
In October 2025, the advanced persistent threat group Confucius launched a sophisticated phishing campaign targeting Pakistani government, defense, and critical industry sectors. Leveraging spear-phishing emails and malicious documents, the attackers deployed two custom malware strains—WooperStealer and Anondoor—to infiltrate victim environments. These tools enabled the exfiltration of sensitive information and lateral movement across internal networks, potentially exposing military secrets and compromising operational capabilities. The attack underlines the evolving TTPs used by regional espionage actors and demonstrates substantial gaps in defending east-west traffic and data exfiltration from secure environments. This incident highlights the growing prevalence of specialized information-stealing malware and the targeting of governmental infrastructure by geopolitical adversaries. It reflects broader trends in cyber-espionage and underscores heightened regulatory expectations for securing critical east-west and outbound traffic flows.
8 months ago
Kill Chain
ShinyHunters Target Salesforce: Social Engineering Breach Exposes SaaS Security Gaps
In early 2024, Google’s Mandiant research team identified a targeted campaign by the ShinyHunters threat group leveraging advanced social engineering techniques against Salesforce environments. The attackers—tracked as UNC6040—used convincing phishing lures and manipulation of Salesforce user credentials to gain unauthorized access to sensitive corporate data. By circumventing authentication measures and exploiting insufficient internal network segmentation and monitoring, ShinyHunters exfiltrated confidential business records, customer data, and intellectual property. The breach highlighted the group’s evolving tactics and the risks posed to organizations that rely on cloud SaaS platforms like Salesforce for critical operations. This incident underscores the increasing sophistication of social engineering attacks, with criminals exploiting both technical and human vulnerabilities in cloud platforms. As SaaS adoption accelerates, similar threats are expected to rise, placing renewed emphasis on identity security, comprehensive threat detection, and adherence to zero trust principles.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports