The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer/Network Security

Breach intelligence, attack campaigns, and threat reports targeting the Computer/Network Security sector.

1194 threat reports
Page 92 of 100
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer/Network Security Threat Reports

Showing 1093–1104 / 1194 reports
SonicWall 2024: Every Cloud Firewall Backup Breached in Major Supply Chain Attack
Financial Services9 months ago

SonicWall 2024: Every Cloud Firewall Backup Breached in Major Supply Chain Attack

In June 2024, SonicWall confirmed that the previously disclosed breach of its cloud backup service was far more extensive than initially announced. The attack resulted in unauthorized access to firewall configuration backups for 100% of customers using SonicWall's cloud backup platform, rather than the 5% originally estimated. The compromise exposed sensitive customer network data, including credentials and VPN configurations, after attackers exploited vulnerabilities in SonicWall’s systems. This breach underscores significant supply chain risks, as attackers targeted third-party-managed infrastructure to circumvent perimeter defenses. This incident highlights the rising threat of supply chain attacks targeting security vendors themselves, which can expose downstream customer environments. With increasing regulatory scrutiny and heightened awareness of lateral movement risks across managed services, organizations must revisit both technical and vendor controls to ensure comprehensive zero trust segmentation and backup protection.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Inside the 2025 Mysterious Elephant Cyber-Espionage Attacks Across South Asia
Government Administration9 months ago

Inside the 2025 Mysterious Elephant Cyber-Espionage Attacks Across South Asia

In early 2025, the cyber-espionage group known as "Mysterious Elephant" conducted a sophisticated campaign targeting government and diplomatic agencies across South Asia. Exploiting previously unseen custom tools, the threat actors gained initial access through spear-phishing and deployed a combination of new malware and legacy techniques to maintain persistence and facilitate covert lateral movement. The attackers exfiltrated sensitive communications and state documents while evading traditional detection mechanisms, resulting in significant exposure of confidential information and escalating regional tensions. This incident highlights the evolution of state-sponsored threat actors beyond recycled malware toward bespoke toolkits and advanced TTPs. Security leaders should note the rapid escalation of intelligence-driven attacks against public sector targets, an indicator of rising geopolitical cyber conflict and regulatory scrutiny.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
GlassWorm: A Self-Propagating Supply Chain Worm Targets VS Code Developers
Computer Software/Engineering9 months ago

GlassWorm: A Self-Propagating Supply Chain Worm Targets VS Code Developers

In early 2024, a sophisticated supply chain attack targeting the Visual Studio Code (VS Code) developer ecosystem was uncovered, leveraging a self-propagating worm dubbed 'GlassWorm.' The attack exploited weaknesses in package distribution and dependency validation, spreading rapidly via malicious code hidden in open-source extensions and packages. Once executed on developer machines, GlassWorm covertly harvested credentials and turned compromised systems into nodes for broader criminal infrastructure, affecting nearly 36,000 endpoints globally. The incident illuminated the risks posed by highly automated, invisible code propagation through trusted development tools, impacting developer productivity and increasing the potential for downstream compromise across organizations that rely on shared code repositories. This breach is emblematic of the accelerating trend of supply chain attacks against development environments, with threat actors increasingly leveraging automation and legitimate software to undermine trust. The GlassWorm incident underscores the urgency for enhanced visibility, stringent code validation, and zero trust controls in modern software supply chains to counter evolving adversary tactics.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ColdRiver Malware Surge: 2024 Espionage Attack Analysis
Government Administration9 months ago

ColdRiver Malware Surge: 2024 Espionage Attack Analysis

In early 2024, the Russia-linked threat group ColdRiver launched a fresh cyber espionage campaign targeting Western government entities, research institutions, and non-governmental organizations. Exploiting spear-phishing emails laden with custom-designed malware, the attackers accessed sensitive emails and files by leveraging well-crafted lures and technical evasion methods. The operation showcased ColdRiver’s rapid adaptation: when prior campaign tactics were exposed, the group swiftly pivoted to deploy new malware strains and infrastructure, signifying a high level of technical agility. The impact included unauthorized data access, intelligence gathering, and operational disruptions for targeted organizations. This incident stands out due to its demonstration of how quickly sophisticated espionage actors can update their tactics in response to detection. With global instability rising and state-aligned groups escalating campaigns, the rapid agility in threat activity puts extra pressure on organizations to strengthen detection and incident response protocols.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Velociraptor Misused: LockBit Ransomware & Storm-2603 Weaponize DFIR Tools in 2025 Attacks
Computer/Network Security9 months ago

Velociraptor Misused: LockBit Ransomware & Storm-2603 Weaponize DFIR Tools in 2025 Attacks

In October 2025, cybersecurity researchers uncovered that threat actors associated with Storm-2603 (also known as Gold Salem or CL-CRI-1040) leveraged Velociraptor, a legitimate open-source digital forensics and incident response (DFIR) tool, to facilitate a series of LockBit ransomware attacks. Adversaries exploited Velociraptor’s capabilities to gather intelligence and move laterally within target environments, evading detection by blending in with regular security operations. The attacks led to significant data encryption events and operational disruptions, primarily impacting organizations with insufficient internal security segmentation and monitoring. This incident marks a significant evolution in attacker tradecraft, as it demonstrates that widely trusted security tools—often present for defensive use—can be repurposed as offensive weapons. Increased regulatory scrutiny and the recurrent rise of double extortion ransomware attacks highlight the urgent need for organizations to monitor tool usage and improve east-west visibility.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Pwn2Own Ireland 2025: Security Researchers Expose 34 Zero-Day Vulnerabilities
Computer/Network Security9 months ago

Pwn2Own Ireland 2025: Security Researchers Expose 34 Zero-Day Vulnerabilities

On the first day of Pwn2Own Ireland 2025, security researchers successfully exploited 34 unique zero-day vulnerabilities across a range of enterprise technologies, earning $522,500 in awards. The event, renowned for responsible disclosure and sponsored by leading vendors, demonstrated both the speed and sophistication with which zero-day flaws can be discovered and exploited in widely used software and hardware platforms. While no criminal group was involved (these are sanctioned research efforts), the findings underscore prevailing vulnerabilities in enterprise defenses and often result in rapid product updates and critical security advisories. This incident highlights the ongoing arms race between researchers and vendors to identify and remediate unknown security gaps. The large number of zero-days found in a single day signals both the growing complexity of attack surfaces and the pressing need for automated detection and proactive patching mechanisms across the digital ecosystem.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
How UNC5142 Hijacked WordPress & Blockchain for Next-Gen Stealer Attacks (2025)
Computer Software/Engineering9 months ago

How UNC5142 Hijacked WordPress & Blockchain for Next-Gen Stealer Attacks (2025)

In October 2025, threat actor UNC5142 leveraged compromised WordPress sites to distribute a wave of information-stealing malware using an innovative attack method dubbed 'EtherHiding.' The adversaries abused blockchain-based smart contracts to conceal malicious code, enabling malware such as Atomic Stealer, Lumma, Rhadamanthys, and Vidar to infect both Windows and macOS endpoints. This technique allowed attackers to rapidly update payloads beyond the reach of static blocklists and frequently evade traditional security controls. Victims included a variety of enterprises and individuals, with attackers capitalizing on the popularity and trust of infected WordPress content management platforms. This incident highlights an emerging TTP where blockchain infrastructure is repurposed to enhance delivery persistence and obfuscation for criminal campaigns. The rapid uptake of such blockchain-based methods demonstrates the need for organizations to evolve threat detection and response strategies as attackers diversify beyond conventional web infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
North Korean Hackers Employ EtherHiding for Unprecedented Cryptocurrency Heist
Financial Services9 months ago

North Korean Hackers Employ EtherHiding for Unprecedented Cryptocurrency Heist

In October 2025, threat group UNC5342—attributed to North Korea—executed an advanced cryptocurrency theft operation by leveraging the novel EtherHiding technique. Attackers embedded malicious code within blockchain smart contracts to distribute malware, evading conventional detection mechanisms. Google Threat Intelligence Group (GTIG) identified this as the first known use of EtherHiding by a state-sponsored actor, resulting in the covert compromise of multiple cryptocurrency platforms and significant asset loss. The incident underscores an evolving trend: nation-state actors are adopting increasingly sophisticated blockchain-based attack methods. With rising blockchain adoption, such TTPs present serious risks for organizations involved in digital assets, regulation, and financial technology.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Europol Busts Global SIM Farm Fueling Industrial-Scale Fake Accounts and Cybercrime
Telecommunications9 months ago

Europol Busts Global SIM Farm Fueling Industrial-Scale Fake Accounts and Cybercrime

In October 2025, Europol led Operation SIMCARTEL to dismantle a sophisticated cybercrime-as-a-service (CaaS) organization running an extensive SIM farm network. This criminal service provisioned more than 49 million SIM cards to cybercriminals worldwide, enabling the rapid creation and management of fake online accounts. Threat actors leveraged the infrastructure for phishing campaigns, investment fraud, impersonation, and large-scale social engineering schemes, causing substantial financial and reputational harm to both individuals and businesses. The coordinated law enforcement operation involved 26 property searches, resulted in seven arrests, and the seizure of equipment and digital assets tied to the illicit platform. This incident highlights the growing industrialization of cybercrime, where turnkey services significantly lower the barrier to entry and accelerate threat actor operations. Law enforcement and the security industry face increasing challenges as cybercriminals exploit scalable CaaS platforms, requiring organizations to modernize their defenses and policy enforcement.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Salt Typhoon Breaches European Telecom via Citrix Flaw and Snappybee Malware
Telecommunications9 months ago

Salt Typhoon Breaches European Telecom via Citrix Flaw and Snappybee Malware

In July 2025, a major European telecommunications provider suffered a targeted cyber espionage breach attributed to Salt Typhoon (aka Earth Estries), a suspected China-nexus group. Attackers exploited a vulnerability in a Citrix NetScaler Gateway appliance to gain initial access, then deployed the custom Snappybee malware for persistent network infiltration and surveillance. The operation allowed lateral movement across critical systems, putting sensitive customer and infrastructure data at risk. Timely detection by Darktrace helped contain the breach, but the incident highlights the telecom industry's growing exposure to sophisticated APT tactics and advanced malware. This breach exemplifies how state-aligned actors are exploiting enterprise VPN and appliance vulnerabilities for initial access, a recurring trend influencing regulatory scrutiny and CISO priorities. Telecom providers remain high-value targets due to their access to critical national infrastructure and vast troves of sensitive data.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Google Uncovers Rapidly Evolving COLDRIVER Malware Campaigns in 2025
Government Administration9 months ago

Google Uncovers Rapidly Evolving COLDRIVER Malware Campaigns in 2025

In May 2025, Google’s Threat Intelligence Group (GTIG) identified a surge in new malware developed by the Russian state-sponsored hacking group COLDRIVER (also known as Callisto or SEABORGIUM). In rapid succession, three new malware families were discovered, each demonstrating increased sophistication and frequent code variations. The attackers leveraged targeted spear-phishing campaigns to compromise government, defense, and policy sector targets across Europe and North America. The swift adaptation and deployment of these malware strains highlight COLDRIVER’s evolving tradecraft and acceleration of offensive cyber operations, posing heightened risks to sensitive data and infrastructure. This campaign signals a broader trend of rapidly evolving Russian cyber-espionage efforts against Western entities. The increased pace, tooling variation, and focus on intelligence collection underline the critical need for organizations to upgrade monitoring, segmentation, and encryption controls across hybrid cloud and on-prem networks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
GlassWorm Supply Chain Malware: VS Code & OpenVSX Infected in 2025
Computer Software/Engineering9 months ago

GlassWorm Supply Chain Malware: VS Code & OpenVSX Infected in 2025

In October 2025, a highly sophisticated supply chain attack involving the GlassWorm malware targeted developers via the OpenVSX and Microsoft Visual Studio Code (VS Code) extension marketplaces. Malicious actors inserted invisible Unicode characters into multiple popular extensions, enabling self-spreading malware to infect users without detection during automatic updates. GlassWorm stole credentials for developer services and cryptocurrency wallets, established remote access, and transformed compromised workstations into nodes within a broader criminal infrastructure. The malware leveraged blockchain (Solana) transactions, Google Calendar events, and distributed Peer-to-Peer protocols for resilient command-and-control, impacting at least 35,800 installations and keeping several malicious extensions available before remediation. This incident highlights the growing threat of self-propagating malware in software supply chains, especially via extension ecosystems critical to development workflows. Its combination of advanced evasion tactics, automated propagation, and leveraging of decentralized infrastructure sets a new precedent, signaling broader risks for organizations relying on trusted code repositories and accelerating regulatory and industry scrutiny on supply chain security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports