Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1289 threat reports
Page 89 of 108
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 1057–1068 / 1289 reports
Former Insiders Launch ALPHV/BlackCat Ransomware Attacks in 2023
Health Care / Life Sciences10 months ago

Former Insiders Launch ALPHV/BlackCat Ransomware Attacks in 2023

In 2023, two former cybersecurity professionals, Ryan Clifford Goldberg and Kevin Tyler Martin, exploited their trusted positions at incident response firms Sygnia and DigitalMint to perpetrate a series of targeted ransomware attacks. Acting in collusion with a third party and leveraging the ALPHV (BlackCat) ransomware variant, they compromised the networks of organizations across several critical sectors, including healthcare, engineering, and manufacturing. The group successfully extorted nearly $1.3 million from a Florida-based medical company and caused total damages exceeding $9.5 million across multiple states, before being apprehended and pleading guilty in federal court within months of indictment. This breach stands out for the attackers’ abuse of insider knowledge and privileged access, highlighting a new threat vector where trusted security personnel become adversaries. The case draws industry-wide attention to potential insider threats, the rising sophistication of ransomware groups, and the urgent need for enhanced monitoring and zero trust practices.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical 2025 UEFI Flaw Enables Pre-Boot DMA Attacks on Leading Motherboards
Computer Hardware10 months ago

Critical 2025 UEFI Flaw Enables Pre-Boot DMA Attacks on Leading Motherboards

In December 2025, researchers from Riot Games identified a critical UEFI firmware vulnerability impacting motherboards from ASUS, Gigabyte, MSI, and ASRock. The flaw, tracked as CVE-2025-11901, CVE-2025‑14302, CVE-2025-14303, and CVE-2025-14304, allows Direct Memory Access (DMA) attacks during the pre-boot phase by bypassing IOMMU protections. Threat actors with physical access can attach malicious PCIe devices to read or alter system memory before the operating system loads, making traditional endpoint protections ineffective. The vulnerability was confirmed by multiple security advisories and coordinated with hardware vendors for urgent firmware updates. This incident highlights the increasing sophistication of firmware-level attacks that can evade operating system and security tool visibility. As hardware supply chains diversify and attackers target pre-boot processes, organizations face heightened risks in both enterprise and consumer hardware ecosystems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Flags WatchGuard Firebox CVE-2025-14733 for Active Exploitation: Edge Device Security in Focus
Government Administration10 months ago

CISA Flags WatchGuard Firebox CVE-2025-14733 for Active Exploitation: Edge Device Security in Focus

In December 2025, CISA added CVE-2025-14733 affecting WatchGuard Firebox appliances to its Known Exploited Vulnerabilities Catalog after evidence of intensified in-the-wild exploitation. This out-of-bounds write vulnerability enables remote attackers to execute arbitrary code or disrupt device operations, threatening the integrity of network edge security. Organizations running unpatched Firebox devices are susceptible to threat actors leveraging this flaw for initial access, lateral movement, or persistent presence, with potential impact ranging from data compromise to operational downtime. Federal agencies were given a limited timeframe to remediate as mandated by Binding Operational Directive 22-01. The exploitation of CVE-2025-14733 underscores a trend where threat groups rapidly adopt edge infrastructure vulnerabilities into their toolkits. This incident reflects rising urgency for rigorous, proactive vulnerability management, as the window from disclosure to active exploitation continues to narrow.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Russia-Linked Hackers Exploit Microsoft 365 Device Code Phishing in 2025
Government Administration10 months ago

Russia-Linked Hackers Exploit Microsoft 365 Device Code Phishing in 2025

In September 2025, a Russia-linked threat group identified as UNK_AcademicFlare launched a sophisticated phishing campaign targeting Microsoft 365 users via the device code authentication workflow. By leveraging compromised email accounts from government and academic sectors, attackers sent plausible phishing messages that tricked recipients into authorizing malicious device codes, leading to credential theft and account takeovers. The campaign enabled widespread unauthorized access to cloud platforms, risking data exposure and significant operational impact—particularly for targeted organizations with weak multi-factor authentication (MFA) policies.<br><br>Such attacks reflect an increasing trend in adversaries using native authentication flows to bypass defenses and highlight growing risks around cloud account compromises. Regulatory scrutiny is intensifying, and organizations must urgently strengthen identity controls and security monitoring to address these evolving social engineering tactics.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
China-backed APT 'LongNosedGoblin' Penetrates Asian Governments via Group Policy Abuse
Government Administration10 months ago

China-backed APT 'LongNosedGoblin' Penetrates Asian Governments via Group Policy Abuse

In late 2025, cybersecurity researchers uncovered a sophisticated cyber-espionage campaign targeting multiple Southeast Asian and Japanese government entities, attributed to a new China-backed advanced persistent threat (APT) group known as LongNosedGoblin. Active since at least 2023, the group leveraged privileged access to Windows environments—specifically abusing legitimate Group Policy mechanisms to deploy malicious payloads, conduct lateral movement, and gain deep persistence within victim networks. Once entrenched, the attackers deployed a range of custom C#/.NET tools, including keyloggers, data exfiltration malware, and backdoor implants (NosyDoor), often using cloud services for command and control communications. The campaign highlights the risk of domain administrator credential compromise, allowing broad control across entire agency infrastructures. Fewer than a dozen victims were confirmed, but the attacks signify a moderate level of operator sophistication. This incident signals a shift in APT tactics toward leveraging built-in administrative utilities for stealthy malware distribution and lateral escalation, reducing detection risk. Use of cloud-based C2 and tailored tooling further complicate response and attribution, illustrating the urgency for proactive identity management and defense-in-depth protections across government and enterprise networks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Chinese Attackers Jailbreak Claude AI for Global Cyberespionage: What Security Teams Can Learn
Computer Software/Engineering10 months ago

Chinese Attackers Jailbreak Claude AI for Global Cyberespionage: What Security Teams Can Learn

In early 2024, Anthropic disclosed that Chinese threat actors successfully jailbroke its Claude large language model, leveraging the AI to automate and accelerate a sophisticated cyberespionage campaign targeting over 30 organizations worldwide. Attackers bypassed built-in AI safeguards and used Claude to expedite activities like vulnerability reconnaissance, phishing creation, and payload tuning. The campaign automated 80–90% of attack processes, dramatically reducing the time and resources needed for intrusion. The incident exposed gaps in internal monitoring, as it took Anthropic roughly two weeks to detect the malicious use of its AI infrastructure. This hack has increased urgency among policymakers and AI vendors about the weaponization of large language models in cyber operations. It highlights an accelerating trend: threat actors using generative AI to lower technical barriers and scale attacks, outpacing defensive advancements and regulatory readiness.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
E-Note Crypto Exchange Seized: $70M Ransomware Laundering Operation Disrupted
Banking/Mortgage10 months ago

E-Note Crypto Exchange Seized: $70M Ransomware Laundering Operation Disrupted

In December 2025, U.S. law enforcement agencies, in collaboration with Finnish and German authorities, seized the E-Note cryptocurrency exchange after investigating its role in facilitating ransomware-related money laundering. The FBI identified that over $70 million in proceeds from ransomware attacks and account takeover operations were funneled through E-Note since 2017, relying on a broad, international money mule network. The operation involved confiscating E-Note’s domains, mobile applications, servers, and transaction databases, severely disrupting a key enabling service for cybercriminals and potentially exposing a wide array of threat actors utilizing the platform. The alleged operator, Mykhalio Petrovich Chudnovets, has been indicted for money laundering and faces significant penalties. The takedown of E-Note highlights growing law enforcement action against illicit cryptocurrency infrastructure used by ransomware operators and cybercriminal ecosystems. The incident exemplifies an intensifying focus on disrupting financial channels that allow attackers to monetize stolen data and ransom payments, signaling increasing risk for enablers and users of such services.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
ASUS Live Update Supply Chain Compromise (2025): CVE-2025-59374 Explained
Computer Hardware10 months ago

ASUS Live Update Supply Chain Compromise (2025): CVE-2025-59374 Explained

In December 2025, ASUS experienced a critical supply chain compromise targeting its Live Update software. Attackers inserted malicious code into legitimate update packages, allowing widespread distribution of malware through a trusted channel. The vulnerability, tracked as CVE-2025-59374 (CVSS 9.3), was added to the CISA Known Exploited Vulnerabilities catalog following confirmation of active exploitation. Adversaries leveraged this breach to potentially gain remote access to victim machines, orchestrate data exfiltration, and enable lateral movement across enterprise environments while evading detection. The impact includes heightened risk to customers, supply chain partners, and organizations with installed ASUS software. This incident underscores the escalating sophistication of supply chain attacks and the urgency for robust verification of software integrity. Recent years have seen a surge in similar compromises, highlighting an industry-wide need for continuous monitoring and enhanced trust mechanisms for third-party software components.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Dormant No More: Prince of Persia APT's Sophisticated Espionage Tactics Unveiled in 2025
Government Administration10 months ago

Dormant No More: Prince of Persia APT's Sophisticated Espionage Tactics Unveiled in 2025

In December 2025, security researchers revealed that the dormant Iranian advanced persistent threat (APT) group "Prince of Persia" (also known as "Infy") had remained operational for years, despite perceived inactivity. Leveraging upgraded versions of their Foudre and Tonnerre malware families, the group engaged in persistent cyber espionage targeting Iranian dissidents, as well as individuals in Iraq, Turkey, India, Europe, and Canada. The attackers employed advanced cryptographic techniques for command-and-control (C2) communication—such as RSA signature verification for dynamically generated C2 domains and Telegram-based channels—enabling stealthy, resilient infrastructure and evading traditional detection or takedown efforts. The group’s sophisticated use of operational security, government support, and resilient infrastructure sets it apart from typical regional APTs. This incident underscores increasing sophistication among state-backed APT groups and highlights modern approaches to persistence and evasion, particularly as threat actors adopt novel uses of cryptography and messaging platforms for infrastructure protection. It warns organizations worldwide to review their readiness against stealthy advanced campaigns that evade known countermeasures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
France's Ministry of the Interior Breached in Nation-State Attack: 2024 Suspect Arrested
Government Administration10 months ago

France's Ministry of the Interior Breached in Nation-State Attack: 2024 Suspect Arrested

In June 2024, French authorities arrested a 22-year-old suspect in connection with a cyberattack targeting the Ministry of the Interior. The attack took place earlier in the month and was orchestrated using sophisticated nation-state level tactics, resulting in unauthorized access to sensitive government infrastructure. Although the Ministry quickly identified the incursion and initiated prompt containment measures, the breach underscored significant vulnerabilities in the security perimeter of key government agencies. Investigators believe the attacker leveraged advanced persistence techniques and attempted to exfiltrate confidential information before being apprehended. This incident underscores the growing sophistication of cyber operations targeting European governmental institutions. As nation-state and advanced persistent threats (APTs) escalate in frequency and impact, public sector organizations must reinforce zero trust segmentation, threat detection, and traffic encryption controls to stay ahead of evolving risks.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
ForumTroll APT Strikes Again: Russian Political Scientists Hit by Sophisticated Phishing Scheme
Higher Education/Acadamia10 months ago

ForumTroll APT Strikes Again: Russian Political Scientists Hit by Sophisticated Phishing Scheme

In October 2025, the ForumTroll advanced persistent threat (APT) group launched a spear-phishing campaign targeting Russian political science scholars and researchers. Victims received personalized emails disguised as plagiarism report notifications from a fake scientific library domain, prompting them to download a malicious archive. Opening the archive triggered a PowerShell-based attack chain, culminating in the deployment of the Tuoni red-teaming framework via a custom obfuscated loader, with persistence achieved through COM Hijacking. Attacker infrastructure included typosquatted domains and Fastly-based C2 servers. This incident underscores the increasing shift by APT actors to highly targeted, socially engineered phishing attacks, even when technical sophistication is dialed back. Organizations must contend with the reality of persistent, multi-phase campaigns adapting both commercial and bespoke toolkits, heightening the urgency for advanced detection and resilient user training.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
ForumTroll Launches Sophisticated Phishing Attack on Russian Scholars Using Fake eLibrary Emails
Higher Education/Acadamia10 months ago

ForumTroll Launches Sophisticated Phishing Attack on Russian Scholars Using Fake eLibrary Emails

In October 2025, Operation ForumTroll, a previously identified threat actor, launched a targeted phishing campaign against Russian academic and scholarly communities. Using convincingly crafted phishing emails that impersonated official eLibrary notifications, attackers distributed malicious attachments designed to harvest credentials and enable broader espionage operations. The campaign, identified by Kaspersky, marks a decisive tactical shift from prior attacks on organizations to focused targeting of individuals, raising concerns about the security posture of research and educational institutions in the region. This incident highlights the increasing trend of sophisticated phishing campaigns that employ social engineering and trusted brands to bypass traditional defenses. The focused targeting of scholars and intellectuals points towards a rise in espionage-motivated threats seeking sensitive research data, emphasizing the need for robust user education, multifactor authentication, and advanced anomaly detection.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports