Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Lies-in-the-Loop: When AI Coding Agents Become Supply Chain Threats
In June 2024, researchers at Checkmarx Zero demonstrated a novel supply chain attack called 'Lies-in-the-Loop' (LITL) targeting AI-assisted coding agents, specifically Anthropic's Claude Code. By leveraging prompt injection, attackers manipulated the AI into concealing malicious code execution behind benign prompts, effectively tricking human operators into approving dangerous actions. The attack exploited trust in the 'human-in-the-loop' workflow, showing that malicious context within public resources like GitHub issues could hide remote code execution triggers. Successful exploitation enabled attackers to deploy arbitrary commands and potentially introduce malicious packages into software repositories, increasing the risk of downstream supply chain compromise. This incident highlights a concerning trend: as AI coding agents are rapidly adopted, their interfaces become a ripe target for adversaries using social engineering and prompt manipulation. The attack underscores the evolving sophistication of supply chain threats, especially those that blur the lines between human fallibility and machine autonomy in development environments.
8 months ago
Kill Chain
North Korean Kimsuky Leverages Deepfake Military IDs in Sophisticated Social Engineering Attack
In April 2024, threat group Kimsuky, attributed to North Korea, launched a cyberattack campaign targeting South Korean organizations using advanced social engineering tactics. The attackers exploited ChatGPT to generate sophisticated deepfake military ID documents, which were then used as bait to compromise targets via phishing emails and messaging apps. By mimicking authentic credentials, Kimsuky aimed to breach sensitive military and governmental networks, potentially facilitating credential harvesting and further lateral movement within critical infrastructures. This incident highlights the increasing convergence of generative AI and cyberattack techniques, making impersonation and credential-based attacks far more convincing and widespread. It underscores rising urgency for organizations to strengthen verification processes and stay vigilant against emerging deepfake-enabled attack vectors.
8 months ago
Kill Chain
SXVM Ransomware PoC Reveals Next-Gen DLL Unhooking to Bypass EDR
In September 2024, a novel ransomware proof-of-concept dubbed 'SXVM' showcased advanced defensive evasion capabilities through DLL unhooking, enabling it to bypass traditional endpoint detection and response (EDR) tools. The threat leverages in-memory manipulation to restore .text sections of key system DLLs—effectively undoing any hooks or software breakpoints set by debuggers and security products. This approach allows ransomware operators to conceal malicious actions and access powerful Windows APIs unchecked. While initial analysis points to a low detection rate and proof-of-concept status, the technique underscores an escalating trend in ransomware sophistication and anti-forensic tactics. This incident is especially relevant as ransomware variants increasingly adopt anti-debugging and anti-EDR methods. The widespread use of DLL unhooking signals a maturing threat landscape, where attackers are continuously innovating to defeat security controls and leverage memory-based evasion techniques.
8 months ago
Kill Chain
npm’s Largest Supply Chain Compromise: Phishing and the Fragility of Open Source Security
In June 2024, a major npm supply chain compromise saw attackers inject malicious code into 18 highly popular JavaScript packages, including chalk and debug, which together accounted for over 2.6 billion weekly downloads. The breach began with a successful phishing attack targeting a package maintainer, resulting in the theft of two-factor authentication credentials. Threat actors quickly published backdoored versions of affected packages, which were downloaded millions of times in minutes before rapid detection and disclosure limited the fallout. The immediate financial losses were low, with only minimal amounts of cryptocurrency stolen, but the operational impact included widespread remediation efforts across thousands of organizations dependent on these open-source assets. This incident exemplifies the growing risk and frequency of supply chain attacks leveraging compromised maintainers and rapid malware propagation in software registries. It highlights the urgent need for enhanced account security, ecosystem-level safeguards, and improved transparency, as such compromises are increasingly targeted by sophisticated actors and threaten the core trust mechanisms of modern digital infrastructure.
8 months ago
Kill Chain
npm Supply-Chain Attack Exposes Open-Source Dependencies: 2024 Incident Analysis
In June 2024, a supply-chain attack struck the widely used npm ecosystem when a threat actor compromised developer Josh Junon's account via a phishing-enabled two-factor reset. The attacker injected malicious code into 18 high-download open-source JavaScript packages, including 'ansi-styles', 'chalk', and 'debug', targeting cryptocurrency transactions. Although the incident caused significant alarm due to the downloads’ reach (>2 billion/week), rapid detection by the open-source community and immediate takedown by npm limited the impact. The injected packages were removed within hours, and the attacker ultimately stole just over $1,000 in cryptocurrency. This incident highlights the growing sophistication of supply-chain and social engineering attacks on open-source platforms. As attackers target developer credentials and critical project maintainers, organizations face renewed urgency to reassess their software supply chain controls and dependency management.
8 months ago
Kill Chain
KazMunayGas Penetration Test Mistaken for Russian Cyberattack: Lessons From a Simulated Incident
In early 2024, Kazakhstan's largest oil company, KazMunayGas, was mistakenly believed to have suffered a cyberattack attributed to a Russian Advanced Persistent Threat (APT) group using a compromised employee email account. Initial reports claimed that attackers breached internal systems, raising alarm over possible business disruption and data compromise. However, after internal review, the company clarified the activity was actually part of an authorized penetration testing exercise, not a malicious breach, and no operational impact or data loss occurred. This incident comes amid heightened concern about cyberthreats targeting energy companies, particularly in regions where geopolitical tensions and state-sponsored actors are active. It demonstrates the confusion that can arise when security drills mimic genuine adversary tactics, highlighting the necessity for robust communication around cybersecurity validation activities.
8 months ago
Kill Chain
Global NPM Phishing Breach Exposes Billions to Supply Chain Malware
In September 2023, threat actors compromised the NPM account of Qix, a well-known developer, through a phishing attack and used the access to publish malicious updates to 18 highly popular open-source packages. These tainted packages, which collectively garnered over 2 billion weekly downloads, included 'ansi-styles', 'debug', 'chalk', and 'supports-color'. The inserted malware aimed to steal cryptocurrency by tampering with API calls and redirecting wallet transactions. The attack window was brief—about two hours—before the breach was discovered, the malicious versions withdrawn, and further spread prevented. While technical fallout was limited and the attackers profited minimally, the incident exposed significant vulnerabilities in the open-source software ecosystem and generated substantial remediation efforts globally. This episode highlights urgent risks inherent in software supply chains and the dependency of modern development on a small number of package maintainers. Public attention to supply chain defense, rapid incident response, and robust dependency vetting is rising as organizations face the reality of widespread reliance on community-maintained resources.
8 months ago
Kill Chain
Jaguar Land Rover Ransomware Breach Disrupts Global Operations in 2024
In June 2024, Jaguar Land Rover (JLR), the renowned luxury automotive manufacturer, experienced a major ransomware-related cyber incident that forced the company to shut down vital portions of its IT infrastructure. The disruption, which began on a Sunday and quickly affected production and retail activities globally, resulted in assembly line stoppages at key UK plants including Halewood and Solihull. JLR responded by disabling systems to prevent further attacker movement and data loss, launching an internal investigation with forensics partners to determine entry vectors, potential data exposure, and persistent threats. While the company stated there was no evidence of customer data being compromised, the operational and financial impacts were significant. This incident underscores the ongoing trend of ransomware actors targeting critical manufacturing and supply chain operations, where downtime can rapidly translate into massive losses. The event serves as a stark reminder that even mature organizations face evolving threats that can bypass traditional security controls, highlighting the urgent need for zero trust segmentation, enhanced network monitoring, and rapid anomaly detection.
8 months ago
Kill Chain
Logit-Gap Steering: New Jailbreak Threat Undermines LLM Security in 2024
In mid-2024, academic security researchers unveiled a novel attack against large language models (LLMs) termed "logit-gap steering." This technique exploits the mathematical limits of alignment training by manipulating the logits—the raw output probabilities—of refusal and affirmation tokens. Attackers found that by identifying and minimizing the gap through tailored prompt suffixes, they could frequently bypass internal model guardrails and elicit harmful or disallowed responses, even on the latest open-source models such as gpt-oss-20b, LLama, Gemma, and Qwen. The published methodology demonstrated over 75% attack success rates and triggered industry-wide concern about the resilience of current AI safety controls. This incident comes at a pivotal time as organizations accelerate adoption of AI and generative language models in production. The research spotlights a significant, previously underestimated vector for LLM jailbreak attacks, amplifying regulatory scrutiny and forcing enterprises to re-evaluate security practices for AI deployments.
8 months ago
Kill Chain
Sextortion at Scale: Lessons from 1,900 Cryptocurrency Extortion Emails (2021–2025)
Between June 2021 and August 2025, researchers analyzed nearly 1,900 sextortion emails sent globally as part of orchestrated financial extortion campaigns. Threat actors leveraged email as the primary attack vector, issuing blackmail demands and requesting payments to over 200 unique cryptocurrency addresses (primarily Bitcoin). The attackers frequently rotated wallet addresses to hinder tracing, with most being active for only a few days. While 28% of the wallet addresses received no payments, the majority collected varied sums, with a median received amount of approximately $4,315 per address; a handful captured large sums exceeding $75,000. These campaigns underline the continuing prevalence and evolution of cryptocurrency-enabled extortion tactics. Sextortion remains a persistent cybercrime threat, with campaigns adapting to changes in cryptocurrency use and email security. Recent analysis suggests a downward trend in victim willingness to pay, potentially reflecting higher user awareness and stronger resilience to such scams, but attackers are refining techniques to maintain extortion income.
8 months ago
Kill Chain
Attackers Exploit Velociraptor Forensics Tool for Covert C2 Tunneling With Visual Studio Code
In June 2025, cybersecurity researchers reported a sophisticated incident in which attackers abused the open-source forensic tool Velociraptor to deploy Visual Studio Code on compromised endpoints and establish an encrypted command-and-control (C2) channel. Threat actors leveraged the legitimate forensic software as a Living Off The Land Binary (LOLBin) to evade detection, achieve execution, and enable covert lateral movement within enterprise environments. This innovative TTP circumvented traditional perimeter detections, and resulted in unauthorized access to sensitive internal systems, raising concerns over the misuse of trusted IT tools in targeted intrusions and potential data exfiltration. The incident highlights a growing trend of blending legitimate IT and developer software within attack chains, making malicious activity harder to distinguish from normal operations. Organizations face increasing regulatory and operational pressure to implement robust east-west traffic monitoring, behavioral detection, and zero trust controls as attackers adopt stealthier methods.
8 months ago
Kill Chain
Inside the Salesloft Drift Supply Chain Breach: How OAuth Token Theft Exposed SaaS Leaders
In August 2023, the threat group UNC6395 exploited a vulnerability in Salesloft’s Drift SaaS marketing platform, targeting OAuth and refresh tokens stored within its Salesforce integration. By leveraging these stolen tokens, attackers performed lateral movement into several customer Salesforce environments, extracting business contact records, support case data, and in some instances, sensitive configuration details and access credentials from high-profile clients such as Zscaler, Palo Alto Networks, Cloudflare, Proofpoint, and Tenable. Salesloft and Salesforce responded by revoking tokens and disabling integrations, while impacted organizations rushed to assess and mitigate the damage. This incident underscores the persistent risk of supply chain compromises targeting SaaS integrations and identity-based authentication mechanisms. As attackers increasingly leverage token theft for stealthy, authorized access, organizations must adopt granular permissions, token security best practices, and rapid credential rotation to safeguard against similar threats.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports