The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1194 threat reports
Page 91 of 100
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 1081–1092 / 1194 reports
First Wap's SS7 Exploit: How Altamides Changed Global Surveillance in 2025
Telecommunications9 months ago

First Wap's SS7 Exploit: How Altamides Changed Global Surveillance in 2025

In 2025, surveillance-technology firm First Wap, based in Jakarta, was revealed to have quietly built and operated the 'Altamides' system, a covert platform leveraging SS7 telecom vulnerabilities for global phone tracking. Unlike conventional spyware, Altamides enabled real-time location tracking of mobile devices across regions—from the Vatican to Silicon Valley—without requiring user interaction, installation, or leaving traces on targeted phones. The technology exploited legacy telecom protocols to access cell tower information, bypassing most modern mobile security defenses. As a result, sensitive locations and communications were exposed to persistent surveillance risk, with broad geopolitical and privacy implications. This incident underscores a worrying rise in the commercial proliferation of offensive surveillance tools exploiting underprotected telecom infrastructure. It highlights the urgent need for stronger regulatory action and zero trust defenses, as targeted espionage techniques move further away from traditional malware and towards systemic protocol abuse.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Pwn2Own Ireland 2025: Researchers Unveil 73 Zero-Day Vulnerabilities
Computer/Network Security9 months ago

Pwn2Own Ireland 2025: Researchers Unveil 73 Zero-Day Vulnerabilities

In June 2025, the Pwn2Own Ireland hacking competition saw security researchers successfully exploit 73 unique zero-day vulnerabilities across a variety of enterprise software and devices. Over $1,024,750 in rewards were awarded as teams identified and demonstrated live, working exploits, many targeting critical business platforms. These zero-days, by definition previously unknown to vendors, highlight the rapid pace at which vulnerabilities are discovered and the ongoing challenges organizations face in maintaining strong security posture against both sophisticated and opportunistic attackers. This event underscores the persistent risk of zero-day vulnerabilities and the growing sophistication of offensive security research. The scale and speed of exploit identification at Pwn2Own reflect broader industry trends, including increased investment in bug bounties and rising regulatory expectations for vulnerability management and disclosure.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
APT36 Exploits Golang-Based Malware to Compromise Indian Government in 2025
Government Administration9 months ago

APT36 Exploits Golang-Based Malware to Compromise Indian Government in 2025

In August and September 2025, the state-sponsored hacking group APT36 (also known as Transparent Tribe) launched a spear-phishing campaign targeting Indian government entities. The campaign delivered a new variant of a Golang-based remote access trojan, DeskRAT, which allowed attackers to gain persistent access, conduct reconnaissance, and exfiltrate sensitive information. The phishing emails, likely crafted to impersonate trusted sources, succeeded in infecting victim networks, enabling APT36 to conduct espionage activities against high-profile targets, further compromising Indian national security interests. This incident underscores the persistent risk posed by well-resourced, nation-state threat actors using continuously evolving malware families and novel programming languages like Golang. The rise of such campaigns highlights an urgent need for improved east-west traffic monitoring, zero trust network segmentation, and advanced user awareness against targeted phishing techniques.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Former L3Harris Executive Charged with Selling Cyber Trade Secrets to Russia
Defense/Space9 months ago

Former L3Harris Executive Charged with Selling Cyber Trade Secrets to Russia

In August 2025, U.S. federal prosecutors charged Peter Williams, a former executive at L3Harris Technologies’ cyber division, with stealing and selling sensitive trade secrets to an undisclosed Russian buyer. Williams, the former general manager of specialized hacking group Trenchant, allegedly misappropriated eight proprietary technologies from two companies between April 2022 and August 2025, totaling $1.3 million in illicit gains. The Department of Justice seeks forfeiture of assets derived from the scheme. Neither L3Harris nor Trenchant is accused of direct wrongdoing. This incident underscores the growing threat posed by insiders with privileged access to highly sensitive cyber capabilities. As governments and critical industries bolster defenses, advanced techniques to detect, monitor, and mitigate insider risk are essential to prevent breaches that could have national security consequences.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Lazarus APT Penetrates European Defense Firms with Fake Job Lures in 2024
Defense/Space9 months ago

Lazarus APT Penetrates European Defense Firms with Fake Job Lures in 2024

In early 2024, the North Korean state-sponsored Lazarus Group orchestrated a targeted cyberattack against at least three European defense sector companies. Using a spear-phishing strategy known as 'Operation DreamJob,' attackers impersonated defense recruiters, luring employees with fake job offers and malicious documents. Once compromised, the attackers gained unauthorized access, moved laterally within victims' networks, and exfiltrated sensitive corporate and government data with minimal detection. The sophistication and persistence demonstrated in this operation highlight the evolving threat landscape posed by well-resourced APT actors. This campaign underscores the escalating risks facing critical industries from nation-state cyber espionage. As advanced phishing and lateral movement techniques proliferate, even mature security programs remain vulnerable to targeted, multi-stage attacks from groups like Lazarus.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Over 100 Government Agencies Breached by Iranian MuddyWater APT with Phoenix Backdoor
Government Administration9 months ago

Over 100 Government Agencies Breached by Iranian MuddyWater APT with Phoenix Backdoor

In early 2024, the Iranian state-sponsored threat group MuddyWater executed widespread attacks leveraging the Phoenix backdoor (version 4), successfully targeting over 100 government entities worldwide. The campaign exploited spear-phishing and malicious document attachments to deliver the backdoor, enabling persistent access, lateral movement, and data exfiltration from compromised systems. This sophisticated intrusion allowed the attackers to maintain a long-term foothold within highly sensitive government networks, posing significant operational and intelligence risks across multiple regions. This incident underscores a sharp escalation in advanced persistent threat (APT) tactics targeting public sector organizations. It highlights both the evolving sophistication and relentless nature of nation-state cyber operations, amplifying regulatory and operational pressure on government organizations to strengthen east-west traffic security, anomaly detection, and Zero Trust segmentation strategies.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
BetterBank DeFi 2025: How a Reward Logic Flaw Led to a $5M Crypto Breach
Financial Services9 months ago

BetterBank DeFi 2025: How a Reward Logic Flaw Led to a $5M Crypto Breach

From August 26 to 27, 2025, BetterBank, a DeFi protocol on PulseChain, suffered a major exploit in its ESTEEM reward logic, allowing an attacker to mint unlimited bonus tokens by abusing flaws in liquidity pool validation. The vulnerability enabled the creation of fake trading pairs and a recursive loop of reward minting, resulting in an initial $5 million loss. Notably, after open negotiations, $2.7 million of the pilfered assets were returned, but the net damage remained at approximately $1.4 million to users and the protocol. The breach highlights organizational and technical oversights, as a prior security audit flagged this very issue. This incident exemplifies the growing threat of sophisticated smart contract exploits targeting DeFi platforms. As similar attacks proliferate across decentralized protocols, regulators and security teams are intensifying scrutiny and demanding higher levels of design and audit rigor.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
MuddyWater's 2025 Global Espionage Campaign Targets 100+ Organizations
Government Administration9 months ago

MuddyWater's 2025 Global Espionage Campaign Targets 100+ Organizations

In late 2025, the Iranian nation-state threat group known as MuddyWater launched a sophisticated espionage campaign targeting over 100 organizations across the Middle East and North Africa (MENA) region. Leveraging a compromised email account as an entry point, the attackers distributed a custom backdoor named Phoenix to high-value government entities, enabling covert infiltration and sustained intelligence gathering. The operation involved methods designed to evade detection and facilitate ongoing access to sensitive data, underscoring the persistent risk posed by nation-state actors. This campaign highlights a continued escalation in advanced cyberespionage activities targeting governmental and critical infrastructure sectors. With threat actors increasingly exploiting social engineering and custom malware, organizations face intensified pressure to strengthen defenses and adhere to evolving security frameworks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
WhatsApp Bans NSO Group: Landmark Legal Win Over Spyware Surveillance (2024)
Government Administration9 months ago

WhatsApp Bans NSO Group: Landmark Legal Win Over Spyware Surveillance (2024)

In June 2024, WhatsApp achieved a legal victory against NSO Group following a six-year battle over the use of commercial spyware targeting WhatsApp users. NSO Group had exploited zero-day vulnerabilities to deploy its Pegasus spyware, surreptitiously compromising user devices for surveillance. As a result of the court decision, NSO Group is permanently banned from accessing or reverse-engineering WhatsApp and must pay $4 million in damages. The court's judgement underscores the broader risks posed by commercial surveillance tools, impacting end-user privacy and digital trust on a global scale. This incident comes amidst intensifying global scrutiny over spyware vendors and increasing pressure for technology companies to safeguard user data. The legal ruling sets a precedent for software platforms defending against targeted surveillance campaigns, emphasizing the role of legal strategy alongside technical security countermeasures.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Canada Fines Cryptomus $176M Over Cybercrime Payment Networks
Financial Services9 months ago

Canada Fines Cryptomus $176M Over Cybercrime Payment Networks

In October 2024, the Financial Transactions and Reports Analysis Center of Canada (FINTRAC) levied a record $176 million fine against Cryptomus, a digital payments platform, for violating Canada's anti-money laundering laws. Investigations uncovered that Cryptomus helped facilitate transactions for dozens of Russian cryptocurrency exchanges and cybercrime-related services without submitting suspicious transaction reports. Infractions were linked to money laundering for child sexual abuse material, fraud, ransomware, and sanctions evasion. The business used a Vancouver address also tied to numerous other questionable entities, none of which had any physical presence at the location. This enforcement action highlights intensifying global scrutiny on cryptocurrency payment processors and money service businesses (MSBs) operating as shadow facilitators for cybercriminals, particularly in regions facing heightened sanctions. As regulators ramp up pressure, organizations relying on cryptographic payment tools, or with exposure to digital currency ecosystems, must reassess their compliance, monitoring, and due diligence procedures in light of evolving financial crime threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How a Vulnerable AI Plugin in Figma MCP Opened the Door for Remote Code Attacks
Computer Software/Engineering9 months ago

How a Vulnerable AI Plugin in Figma MCP Opened the Door for Remote Code Attacks

In early 2025, a critical vulnerability (CVE-2025-53967) was discovered in a third-party connector integrating agentic AI capabilities with Figma’s Multi-Cloud Platform (MCP) server. This supply-chain flaw enabled remote code execution (RCE), allowing attackers to exploit the connection to infiltrate organizational environments using the affected plugin. Threat actors leveraged the unsanctioned plugin to gain unauthorized access to internal systems, potentially exposing sensitive design data, intellectual property, and user information. The compromise highlighted risks associated with insufficient east-west security controls, lack of zero trust segmentation, and inadequate traffic visibility, ultimately impacting business continuity and trust in the collaboration platform. This incident exemplifies the growing threat of supply-chain vulnerabilities targeting enterprise SaaS applications, amid increasing adoption of AI integrations. Organizations are re-evaluating their third-party risk, agentic AI governance, and internal segmentation postures as regulatory scrutiny and attacker sophistication intensify.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Red Hat Consulting Breach 2024: Crimson Collective Launches Major Supply Chain Attack
Computer Software/Engineering9 months ago

Red Hat Consulting Breach 2024: Crimson Collective Launches Major Supply Chain Attack

In April 2024, the Crimson Collective, in collaboration with elements of the Lapsus$ group, executed a supply chain attack targeting Red Hat Consulting by breaching its GitLab instance. The attackers gained unauthorized access through credential compromise and lateral movement across internal infrastructure, successfully exfiltrating sensitive source code and internal communications. The breach, which remained undetected for several days, raised concerns over east-west traffic security, lack of segmentation, and insufficient anomaly detection within Red Hat Consulting’s cloud development supply chain. This incident highlights the increasing prevalence of supply chain attacks leveraging lateral movement and sophisticated alliance between threat groups. Its relevance is underscored by renewed regulatory scrutiny, the growing risk posed by collaborative cybercriminal operations, and heightened demand for zero trust architecture and cloud-native threat mitigation strategies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports