Computer/Network Security
Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.
Explore Other Sectors
Computer/Network Security Threat Reports
Nx npm Supply Chain Breach 2025: AI Stealer Exposes Over 1,000 Developer Secrets
In late August 2025, a highly automated supply chain attack compromised the popular Nx build system on npm, enabling unidentified attackers to infect more than 1,000 JavaScript developers within just four hours. Malicious packages, leveraging artificial intelligence through CLI integrations, actively scanned victim environments for GitHub tokens, npm credentials, SSH keys, cloud secrets, and cryptocurrency wallets—exfiltrating roughly 20,000 sensitive files. Instead of using traditional command and control servers, the attackers published victims’ stolen data into public GitHub repositories, complicating detection and enabling rapid collection by threat actors. This incident marks a significant escalation in software supply chain threats by demonstrating the abuse of AI-driven reconnaissance and novel exfiltration via legitimate platforms. The swift, large-scale impact underscores rising attacker sophistication and amplified operational risk, especially as AI and developer tooling become more deeply embedded in build pipelines and cloud-native workflows.
8 months ago
Kill Chain
APT Group Abuses AWS with HazyBeacon Malware in Southeast Asian Government Attacks
In early 2024, an advanced persistent threat (APT) group leveraged Amazon Web Services (AWS) infrastructure to conduct an intelligence-gathering campaign targeting government entities in Southeast Asia. The attackers deployed the novel "HazyBeacon" backdoor, which communicated with command-and-control (C2) infrastructure over legitimate cloud channels to evade detection, facilitating both surveillance and data exfiltration. By abusing trusted AWS services, the group masked malicious traffic as normal cloud activity, making identification and remediation complex and exposing sensitive government operations to compromise. This incident underscores a rapidly growing trend where threat actors exploit cloud provider services as covert C2 and exfiltration channels. With attackers blending into legitimate cloud workflows, organizations face heightened urgency to enhance cloud-native visibility, enforce east-west traffic controls, and implement zero trust segmentation to mitigate advanced threats.
8 months ago
Kill Chain
Malicious Implants in AI Supply Chains: 2024’s Stealth Attack Surface
In early 2024, security researchers uncovered evidence that malicious implants are increasingly targeting AI components and applications through vulnerabilities in the supply chain. Threat actors leveraged weaknesses in popular AI frameworks and third-party dependencies to introduce stealthy backdoors and implants, enabling them to evade modern security tools. The attackers often exploited insufficient validation of AI model inputs, compromised third-party code, or leveraged misconfigurations to achieve persistent access and lateral movement within enterprise environments, resulting in sensitive data exposure and operational risk for organizations deploying AI-driven solutions. This incident underlines an emerging trend where cybercriminals and nation-state actors prioritize supply-chain vectors to subvert the rapidly expanding AI ecosystem. As AI adoption accelerates and digital trust becomes paramount, organizations face increased regulatory scrutiny and pressure to implement robust controls around software provenance and supply chain integrity.
8 months ago
Kill Chain
State-Backed Attackers Breach SonicWall SMA1000 Devices via Zero-Day Chain in 2025
In December 2025, SonicWall urgently advised customers to patch a newly identified zero-day vulnerability (CVE-2025-40602) in its SMA1000 Appliance Management Console after attackers exploited it in the wild. The attack chain combined this medium-severity local privilege escalation flaw with a critical pre-authentication deserialization vulnerability (CVE-2025-23006), allowing remote unauthenticated threat actors to execute arbitrary OS commands with root privileges on vulnerable appliances. These appliances serve as secure remote access gateways for large enterprises and critical infrastructure, amplifying the risk of broad organizational compromise and lateral movement within protected networks. The incident follows prior breaches and repeated targeting of SonicWall solutions by sophisticated, potentially state-backed actors, with over 950 SMA1000 devices found internet-exposed. Immediate remediation was urged to prevent further exploitation amidst evidence of active, targeted attacks. The SonicWall SMA1000 incident underscores a persistent trend of advanced actors leveraging zero-day exploits in network infrastructure appliances, fueling urgency around patch management and segmentation. This breach highlights the evolving complexity of attack chains targeting foundational remote access technologies and the critical need for proactive defense-in-depth and threat visibility measures.
9 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports