Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
PyPI’s 2025 GhostAction Attack: Massive Token Exfiltration Exposes Supply Chain Risk
In September 2025, the Python Software Foundation discovered that the GhostAction supply chain attack led to the exfiltration of thousands of sensitive access tokens—including PyPI, npm, DockerHub, and AWS keys—from compromised GitHub repositories via malicious GitHub Actions workflows. Although attackers obtained over 3,300 secrets by modifying open-source project workflows to funnel credentials to remote servers, swift response from security teams and open-source maintainers prevented the abuse of stolen tokens on PyPI. The PyPI team proactively invalidated all impacted tokens and urged affected maintainers to adopt short-lived Trusted Publishers tokens and review account security. This incident highlights the increasing sophistication and scope of supply chain attacks targeting developer ecosystems and CI/CD pipelines, underscoring the urgent need for automated detection, better secrets management, and cross-ecosystem collaboration. The prevalence of such attacks demonstrates an evolving threat landscape exploiting automation and cloud-based tooling.
8 months ago
Kill Chain
SonicWall Cloud Backup Breach: Firewall Configurations Compromised, Credential Resets Urged
In September 2025, SonicWall disclosed a cloud security incident that exposed firewall configuration backup files tied to less than 5% of MySonicWall accounts, prompting a company-wide advisory to reset credentials for impacted users. The breach involved unauthorized access to backup firewall preference files hosted in SonicWall’s cloud backup service, which could potentially allow attackers insight into sensitive network policies and infrastructure details. Upon detection, SonicWall revoked affected credentials, reset authentication tokens, and notified regulatory authorities and end-users. The incident underscores operational risks associated with cloud-based configuration repositories and the downstream consequences for enterprise security posture. This breach highlights ongoing attacker focus on cloud storage services and device configuration files, which are increasingly targeted for initial access or lateral movement. As regulatory scrutiny grows and advanced threats seek out persistent footholds, organizations face mounting urgency to harden cloud storage, segment sensitive data, and enforce continuous credential hygiene.
8 months ago
Kill Chain
Dshield Honeypot Exposes IoT Botnet Worm Using Default Credentials in 2024
In September 2024, analysis of a Dshield honeypot deployed on AWS revealed a campaign targeting internet-exposed systems with IoT-focused botnet malware. Attackers attempted to upload shell scripts and architecture-specific binaries using known default credentials and exploited weak or unchanged passwords, particularly on Raspberry Pi and IoT devices. The payloads, often delivered over unencrypted FTP and SSH methods, led to the installation of UNIX_PIMINE.A malware, which achieves persistence, removes competing malware, and connects to IRC-based command-and-control channels, highlighting an active botnet spreading via automated credential stuffing and remote file uploads. This incident underscores a persistent threat: legacy systems and embedded devices with default or weak credentials remain a prime target for botnets. With continued rises in IoT deployments and exposed services, automated malware propagation using basic scripts and known default logins is resurging, driving renewed regulatory scrutiny and best-practice emphasis for credential management and east-west traffic security.
8 months ago
Kill Chain
SonicWall 2024 Breach: Cloud Portal Attack Exposes Firewall Configurations
In June 2024, SonicWall confirmed a security incident impacting its MySonicWall.com portal, where threat actors gained unauthorized access to backup firewall configuration files belonging to fewer than 5% of their customers. The attackers employed targeted brute-force attacks to access encrypted preference files stored in the cloud, potentially exposing sensitive network architecture and policy information. While SonicWall promptly disabled the affected backup feature, notified law enforcement and affected customers, and engaged incident response specialists, the exposure raises substantial risk of follow-on attacks and exploitation due to the detailed nature of the data compromised. This incident highlights a growing concern with threats targeting cloud-managed administrative platforms, especially those operated by key infrastructure vendors. As attackers pivot from device exploits to systemic attacks on cloud portals, organizations must scrutinize cloud data storage and vendor security practices more rigorously to mitigate downstream and supply chain risks.
8 months ago
Kill Chain
Chinese APT Bypasses Philippine Military Defenses with EggStreme Fileless Malware (2025)
In September 2025, a Chinese advanced persistent threat (APT) group breached a Philippines-based military company using a sophisticated multi-stage attack leveraging the novel fileless malware framework, EggStreme. According to Bitdefender, the attackers achieved persistence and stealth by injecting their malicious code directly into memory and utilizing DLL sideloading to execute payloads without writing files to disk. This allowed them to maintain an undetected presence, conduct espionage, and potentially exfiltrate sensitive military and government data. The breach underscores ongoing risks to national security organizations from highly resourced nation-state actors employing advanced techniques. This incident highlights the emergence of more evasive, memory-resident malware frameworks targeting defense and critical infrastructure. Fileless attack methods such as those used by EggStreme are increasingly common and harder to detect, urging organizations to adopt advanced threat detection, improved segmentation, and robust incident response capabilities.
8 months ago
Kill Chain
Apple Warns French Users of Fourth Major Spyware Campaign in 2025
In September 2025, Apple issued alerts to French users after identifying a sophisticated spyware campaign targeting their devices, marking the fourth such warning within the year. According to CERT-FR, the attack exploited vulnerabilities in Apple’s ecosystem—potentially via malicious links or zero-day exploits linked to iCloud accounts—allowing unauthorized surveillance and data exfiltration. The incident highlights persistent targeting of high-profile users in France, including journalists, activists, and officials, by advanced threat actors suspected to have nation-state-level capabilities. Impact includes compromised device privacy, risk of sensitive information leaks, and possible reputational harm to affected organizations. This incident underscores a worrying trend of recurrent, targeted campaigns using advanced spyware in Western Europe. The persistence of these attacks illustrates evolving threat actor sophistication and growing urgency for companies to strengthen device and network-level security, particularly as regulatory and public scrutiny intensifies.
8 months ago
Kill Chain
AI-Powered Villager Tool: How Cyberspike's PyPI Release Raised Global Supply-Chain Alarm
In 2025, a China-based group known as Cyberspike released an AI-powered penetration testing framework called 'Villager' on the Python Package Index (PyPI). Garnering nearly 11,000 downloads, Villager was marketed as a red teaming tool but drew significant attention after security researchers highlighted its dual-use potential for both legitimate and malicious activities. The framework’s advanced automation and stealth features make it attractive for attackers seeking to exploit software supply chains and pivot across cloud and hybrid environments, raising the risk profile for developers and organizations using open-source components. This incident underscores growing concerns about the unintended consequences of democratized offensive security tooling, particularly when distributed through popular code repositories. The rapid adoption and potential for supply-chain compromise highlight the urgency for heightened code vetting, continuous monitoring, and robust supply-chain security policies.
8 months ago
Kill Chain
DOJ Resentences BreachForums Founder in 2025 Cybercrime Marketplace Crackdown
In September 2025, the U.S. Department of Justice resentenced Conor Brian Fitzpatrick—known online as Pompompurin and the former administrator of the notorious BreachForums cybercrime marketplace—to three years in prison. Fitzpatrick pleaded guilty after orchestrating access device fraud and facilitating the sale of stolen data, in addition to possessing child sexual abuse material (CSAM). BreachForums had become a major platform for trading compromised credentials, payment card information, and illicit content before law enforcement seized the site and apprehended its leader. The takedown disrupted a key meeting ground for cybercriminals involved in massive data breaches and identity theft operations. This incident underlines heightened law enforcement focus on cybercrime forums as hubs for illegal commerce, reflecting rising pressure on both administrators and users. The prosecution of BreachForums’ founder highlights regulatory and investigative trends aimed at deterring similar platforms and enforcing accountability for cyber-enabled offenses.
8 months ago
Kill Chain
KillSec Ransomware Campaign Targets Brazilian Healthcare Supply Chain
In April 2024, the KillSec ransomware group orchestrated a cyberattack against a major Brazilian healthcare software provider, targeting a core element of the nation’s healthcare technology supply chain. According to cybersecurity researchers, the attackers leveraged sophisticated ransomware tactics to breach the provider’s environment, exfiltrate sensitive patient data, and subsequently encrypt vital systems, disrupting normal operations. The breach involved the theft of confidential healthcare records, potentially exposing personally identifiable information (PII) as well as critical medical data, raising alarms across Brazil’s healthcare sector. As a result, provider services experienced significant operational delays and financial impact, and the wider ecosystem faces cascading risks from the exposed data. This incident is particularly noteworthy due to the healthcare sector’s growing vulnerability to ransomware attacks, with supply chain vectors increasingly exploited by threat actors like KillSec. The event reflects a concerning trend of ransomware groups shifting toward critical infrastructure and service-provider targets, amplifying regulatory, compliance, and patient safety pressures.
8 months ago
Kill Chain
Shai-Hulud Worm: Self-Propagating Malware Hits 180+ NPM Packages in Major Supply Chain Breach
In September 2025, a novel self-replicating worm, dubbed 'Shai-Hulud,' targeted the JavaScript NPM ecosystem by infecting over 180 code packages. The malware exploited developer authentication tokens found on Linux and macOS devices, replicating itself into the top 20 packages accessible to the compromised account and rapidly publishing malicious package versions. Stolen credentials were published in new, public GitHub repositories, compounding the supply chain risk. Though the initial infection included several packages managed by CrowdStrike, the company quickly removed the compromised code and rotated secrets, preventing wider impact to its flagship products. This incident highlights the increasing sophistication and automation of supply chain compromise, especially in open-source software development. The self-propagating nature of Shai-Hulud, combined with credential harvesting and public exposure, represents a growing risk trend for organizations relying on software registries.
8 months ago
Kill Chain
2024 Shai-hulud Worm: Major Supply Chain Attack Strikes NPM
In September 2024, a self-replicating malware dubbed "Shai-hulud" infiltrated the open source ecosystem by targeting hundreds of NPM (Node Package Manager) packages. The worm initiates its campaign by compromising a single software component, and automatically harvests secrets, tokens, and credentials present in affected developers' environments. By leveraging compromised NPM accounts, Shai-hulud spreads itself through subsequent package uploads, injecting malicious payloads into new releases and perpetuating a chain reaction across software supply chains. Impacted parties range from individual developers to prominent tech companies and security vendors. This incident highlights a concerning escalation in supply chain threats, demonstrating advanced automation in malware propagation and the weaponization of interconnected open source dependencies. The attack underscores the rising prevalence of highly automated, lateral-moving malware and the systemic risks posed by compromised development ecosystems.
8 months ago
Kill Chain
K2 Think AI Model Jailbroken Within Hours of 2024 Release
On September 9, 2024, the UAE-backed 'K2 Think' large language model (LLM) was released with the goal of industry-leading transparent reasoning. Within hours, however, cybersecurity researchers discovered a critical vulnerability known as Partial Prompt Leakage. This flaw allowed adversaries to observe the model's internal logic in plain text, making it easier to methodically bypass safeguards and jailbreak the AI system. The exploit was demonstrated by researcher Alex Polyakov, who publicly documented how attackers could uncover and iterate against the model’s defenses, enabling harmful behaviors such as malware generation. The breach did not result in immediate large-scale misuse, but it revealed a key tradeoff between transparency and security in modern LLM development. This incident is emblematic of new AI security risks emerging as open, auditable models grow in popularity. It underscores the urgency for vendors to balance transparency with robust protection, as attackers quickly adapt to and exploit unique model features. With increased regulatory scrutiny and rising enthusiasm for open-source AI, safeguarding model reasoning is now a critical surface organizations cannot ignore.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports