Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Networking

Breach intelligence, attack campaigns, and threat reports targeting the Computer Networking sector.

14 threat reports
Page 1 of 2
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Networking Threat Reports

Showing 1–12 / 14 reports
D-Link DGS-3130 Zero-Days: Unpatched Switch Flaws Put Enterprise Networks at Risk
D-Link DGS-3130 Zero-Days: Unpatched Switch Flaws Put Enterprise Networks at Risk
Information Technology/IT2 days ago

D-Link DGS-3130 Zero-Days: Unpatched Switch Flaws Put Enterprise Networks at Risk

In November 2026, D-Link disclosed multiple unpatched zero-day vulnerabilities affecting its DGS-3130 series managed Gigabit stackable switches, widely deployed in SMB and metro Ethernet environments. Discovered by network engineer Giresh Kumar Enugu, the flaws reside in the D-Link Discovery Protocol (DDP) authentication, access control, and information-handling components. Successful exploitation could allow an attacker with network access to extract sensitive device data, perform unauthorized administrative operations, alter device configurations, leak SNMP community strings, or trigger service disruptions and device resets. No CVE IDs or firmware patches have been released, and D-Link is still investigating the full scope of impact across its switching portfolio. Unpatched network infrastructure vulnerabilities are an accelerating trend in 2026, with threat actors increasingly targeting edge and campus switches as initial footholds rather than endpoints. With no patch available, the risk window remains open indefinitely, making compensating controls and network segmentation critical defensive priorities for any organization running affected D-Link hardware.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Zyxel Zero-Day CVE-2026-107441: How Kapibala Bypassed a Patch to Compromise 1,000 Network Switches
Zyxel Zero-Day CVE-2026-107441: How Kapibala Bypassed a Patch to Compromise 1,000 Network Switches
Government Administration4 days ago

Zyxel Zero-Day CVE-2026-107441: How Kapibala Bypassed a Patch to Compromise 1,000 Network Switches

In mid-2026, a suspected Chinese-speaking threat actor tracked as Kapibala exploited a zero-day vulnerability (CVE-2026-107441) in Zyxel GS1900 series network switches, compromising nearly 1,000 devices across 48 countries. Initial attribution pointed to a previously patched flaw (CVE-2026-7273), but firmware security firm Binarly discovered the attackers had developed an exploit that bypassed the June 2026 patch entirely by corrupting a parameter counter before validation. The attackers executed unauthenticated remote commands, downloaded scripts to harvest device configurations, hashed root credentials, and network topology data. Zyxel released remediation firmware on October 22, 2026, after confirming the new vulnerability on October 11. This incident is part of a broader pattern of state-linked actors targeting network edge infrastructure to establish persistent footholds and harvest credentials. The Kapibala group's linkage to the Red Heron campaign—which also deployed the JITTERLY backdoor and SIXZUT rootkit—signals a maturing, multi-vector threat posture that specifically targets unpatched or recently patched network devices as entry points into enterprise and government environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Alpine Linux's GitLab Rebuild: What a Near-Miss CI/CD Supply-Chain Attack Reveals About Egress Blind Spots
Alpine Linux's GitLab Rebuild: What a Near-Miss CI/CD Supply-Chain Attack Reveals About Egress Blind Spots
Computer Software/Engineering1 week ago

Alpine Linux's GitLab Rebuild: What a Near-Miss CI/CD Supply-Chain Attack Reveals About Egress Blind Spots

On October 20–21, 2026, threat actors attempted to exploit CVE-2026-97229, a maximum-severity remote code execution vulnerability in GitLab's CI/CD regex compiler (Onigmo/Ruby), against Alpine Linux's development infrastructure. Attackers submitted malicious CI configurations that caused eight worker process crashes, with four attempts coming close to full exploitation. Alpine Linux had inadvertently deployed unpatched container images that omitted the required Ruby fix. Unable to rule out a successful compromise due to missing logs and absent outbound connection records, Alpine rebuilt its GitLab instance from scratch and reset all credentials. No confirmed code tampering or package poisoning was found, but the incident exposed the fragility of custom container build pipelines as a supply-chain attack surface. This incident underscores a growing attacker pattern: targeting open-source project infrastructure—specifically CI/CD and GitLab environments—to achieve downstream supply-chain impact at scale. With Docker-based Alpine images underpinning millions of containerized workloads globally, even an attempted compromise at this layer carries outsized risk, amplifying urgency for CI/CD pipeline hardening and patch governance.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Hundreds of Millions of Devices at Risk: GoAhead TLS Flaws Let Revoked Certificates Pass and Sessions Be Decrypted
Hundreds of Millions of Devices at Risk: GoAhead TLS Flaws Let Revoked Certificates Pass and Sessions Be Decrypted
Computer Networking1 week ago

Hundreds of Millions of Devices at Risk: GoAhead TLS Flaws Let Revoked Certificates Pass and Sessions Be Decrypted

In October 2026, security researcher Sébastien Féry of FoxIO disclosed three TLS vulnerabilities in the GoAhead embedded web server, which runs in hundreds of millions of routers, printers, industrial controllers, and gateways from vendors including HP, Siemens, Rockwell, Canon, and D-Link. The most critical flaw, CVE-2026-115881 (rated 9.1), allows a revoked client certificate to complete mutual-TLS authentication because GoAhead's OpenSSL backend loads a certificate revocation list at startup but never enforces it. A second flaw permits over-length certificate chains to bypass authentication on LibreSSL legacy builds, and a third causes a 1-byte Diffie-Hellman value to be transmitted over Mbed TLS, enabling passive session decryption. Fix version 6.1.1 was released August 2, 2026, but device owners depend entirely on individual manufacturers to ship firmware updates. These flaws expose a systemic firmware supply-chain risk: the attack surface is determined at compile time, invisible to device owners, and remediation velocity is controlled by OEM manufacturers rather than the software vendor. As embedded systems increasingly anchor industrial and enterprise network edges, unpatched TLS flaws in shared components like GoAhead represent a durable, low-noise pathway for credential bypass and traffic interception that persists until each OEM ships and deploys a firmware update.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CISA Adds Collabora Online RCE and Arista VeloCloud SQL Injection to KEV: What Network Security Teams Must Do Now
CISA Adds Collabora Online RCE and Arista VeloCloud SQL Injection to KEV: What Network Security Teams Must Do Now
Information Technology/IT2 weeks ago

CISA Adds Collabora Online RCE and Arista VeloCloud SQL Injection to KEV: What Network Security Teams Must Do Now

In October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-110447 (CVSS 9.2), an OS command injection flaw in Collabora Online's Built-in CODE Server enabling remote code execution via proxy.php on Nextcloud platforms, and CVE-2026-114625 (CVSS 9.9), an SQL injection vulnerability in Arista VeloCloud Orchestrator allowing remote attackers with only read-only access to reach privileged internal functionality. Active exploitation of CVE-2026-110447 involved web shell implantation on Nextcloud servers followed by credential harvesting, while CVE-2026-114625 exploitation was traced to two IP addresses geolocated to Japan, marking the third VeloCloud vulnerability weaponized since July 2026. This incident underscores an accelerating pattern of critical infrastructure and SD-WAN orchestration platforms being targeted through high-CVSS injection vulnerabilities. With three VeloCloud flaws actively exploited within a four-month window, attackers are systematically probing network management planes—raising the stakes significantly for organizations relying on these platforms for hybrid and multi-cloud connectivity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Eight Max-Severity ArubaOS Flaws Expose Enterprise Wireless Infrastructure to Unauthenticated RCE
Eight Max-Severity ArubaOS Flaws Expose Enterprise Wireless Infrastructure to Unauthenticated RCE
Information Technology/IT2 weeks ago

Eight Max-Severity ArubaOS Flaws Expose Enterprise Wireless Infrastructure to Unauthenticated RCE

In October 2026, Hewlett Packard Enterprise released emergency security patches addressing 72 vulnerabilities in ArubaOS (AOS), the operating system powering Aruba Networking enterprise wireless infrastructure including mobility conductors, access points, controllers, and gateway devices. Eight of these flaws carry maximum CVSS severity scores and enable unauthenticated remote code execution and authentication bypass across both AOS-8 and AOS-10 software versions. The vulnerabilities—spanning command injection, SQL injection, and buffer overflow vectors—require no privileges and no user interaction, making them trivially exploitable at scale across HPE's installed base of over 55,000 enterprise customers, including 90% of Fortune 500 companies. HPE confirmed no active exploitation or public proof-of-concept code existed at time of disclosure. This disclosure follows a pattern of critical HPE network infrastructure vulnerabilities in 2025–2026, including StoreOnce auth bypass flaws, hardcoded Aruba credentials, and actively exploited HPE OneView weaknesses flagged by CISA. Attackers increasingly target network infrastructure operating systems as a high-leverage initial access vector, making unpatched edge devices a primary risk surface for enterprise environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-114625: How Attackers Are Exploiting Arista VeloCloud Orchestrator to Own Your SD-WAN
CVE-2026-114625: How Attackers Are Exploiting Arista VeloCloud Orchestrator to Own Your SD-WAN
Information Technology/IT2 weeks ago

CVE-2026-114625: How Attackers Are Exploiting Arista VeloCloud Orchestrator to Own Your SD-WAN

In October 2026, Arista Networks disclosed and patched CVE-2026-114625, a critical zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that was already being actively exploited in the wild. The flaw allows any authenticated user with basic privileges and access to the VCO web interface to escalate to operator-level privileges via low-complexity SQL injection, effectively masquerading as a local superuser. Attackers leveraging IP addresses 74.82.197.86 and 38.54.50.151 were observed exploiting the flaw, threatening the confidentiality, integrity, and availability of SD-WAN infrastructure and all data managed by the orchestrator. This is the fourth actively exploited zero-day patched by Arista in 2026 alone. This incident underscores a persistent and accelerating pattern: management-plane and orchestration-layer vulnerabilities in SD-WAN and network infrastructure are prime targets for threat actors. As enterprises consolidate network control into centralized orchestrators, a single privilege escalation flaw can hand attackers keys to the entire wide-area network, making rapid patch cadence and layered runtime controls non-negotiable.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Alert: Chinese Threat Actors Actively Exploiting Zyxel and Veeam Vulnerabilities
Critical Alert: Chinese Threat Actors Actively Exploiting Zyxel and Veeam Vulnerabilities
Computer Networking1 month ago

Critical Alert: Chinese Threat Actors Actively Exploiting Zyxel and Veeam Vulnerabilities

CISA has added CVE-2026-7273, a stack-based buffer overflow vulnerability in Zyxel GS1900 series switches, to its Known Exploited Vulnerabilities catalog following evidence of active exploitation by suspected Chinese threat actors. The attackers successfully compromised 996 Zyxel switches across 48 countries since August 2026, using crafted HTTP requests to execute operating system commands and deploy TFTP tools for data exfiltration. Simultaneously, Arctic Wolf reported active exploitation of CVE-2026-32996 in Veeam Agent for Windows, allowing local privilege escalation to SYSTEM-level access through manipulation of gRPC named pipe sessions. These incidents highlight the growing trend of threat actors rapidly weaponizing newly disclosed vulnerabilities to target network infrastructure and backup systems, emphasizing the critical need for immediate patch deployment and enhanced monitoring of privileged access controls in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
UAT-7810's Deployment of LONGLEASH Malware: A New Threat to Network Security
Telecommunications4 months ago

UAT-7810's Deployment of LONGLEASH Malware: A New Threat to Network Security

In July 2026, the Chinese advanced persistent threat (APT) group UAT-7810 enhanced its Operational Relay Box (ORB) network by deploying new malware variants, notably LONGLEASH, DOGLEASH, and JARLEASH. These tools target unpatched Ruckus wireless routers, exploiting vulnerabilities such as CVE-2020-22653, CVE-2020-22658, and CVE-2023-25717, to establish a robust infrastructure for subsequent cyber operations. The ORB network serves as a relay platform, facilitating attacks by other China-aligned threat actors, including UAT-5918, which has been implicated in cyber attacks against critical infrastructure in Taiwan since at least 2023. The development of these sophisticated malware tools underscores the evolving capabilities of UAT-7810 and the persistent threat posed to global network security. Organizations utilizing vulnerable networking devices are at heightened risk, emphasizing the need for proactive defense measures and timely patch management to mitigate potential intrusions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Chinese Hackers Deploy LONGLEASH Malware to Expand ORB Network
Telecommunications4 months ago

Chinese Hackers Deploy LONGLEASH Malware to Expand ORB Network

In July 2026, the Chinese state-sponsored threat actor UAT-7810 expanded its Operational Relay Box (ORB) network by deploying the LONGLEASH malware. This campaign targeted unpatched Ruckus and ASUS AiCloud routers, exploiting known vulnerabilities such as CVE-2020-22653, CVE-2020-22658, CVE-2023-25717, and CVE-2025-2492. The ORB network serves as a relay infrastructure for other China-aligned APTs, facilitating covert cyber-espionage operations. The introduction of LONGLEASH, an evolution of the previously documented SHORTLEASH backdoor, enhances the ORB network's capabilities, including reverse shell access, multiple proxying methods, and the ability to act as an intermediate C2 server. This development underscores the persistent and evolving nature of state-sponsored cyber threats targeting critical infrastructure. The emergence of LONGLEASH highlights a trend among nation-state actors to develop sophisticated malware that leverages existing vulnerabilities in widely used networking devices. This approach not only complicates attribution but also emphasizes the need for organizations to maintain rigorous patch management and network security practices to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AryStinger Malware Hijacks 4,300 Legacy Routers in 2026
Telecommunications4 months ago

AryStinger Malware Hijacks 4,300 Legacy Routers in 2026

In June 2026, security researchers at QiAnXin's XLab identified a new malware strain named AryStinger, which has compromised over 4,300 outdated routers, primarily D-Link models like DIR-850L and DIR-818LW. The malware exploits old vulnerabilities—CVE-2013-3307 and CVE-2016-5681—to transform these devices into a distributed network for reconnaissance and proxying malicious traffic. Unlike typical botnets used for DDoS attacks, AryStinger focuses on pre-intrusion activities such as internet scanning, service fingerprinting, subdomain enumeration, and traffic tunneling, effectively masking the attacker's origin. This incident underscores the critical risks posed by unpatched, legacy hardware in both residential and small office environments. The widespread infection, notably concentrated in South Korea and China, highlights the necessity for regular firmware updates and the decommissioning of unsupported devices to prevent their exploitation in sophisticated cyber operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
KadNap Malware: Over 14,000 Asus Routers Hijacked into Stealth Botnet
Telecommunications8 months ago

KadNap Malware: Over 14,000 Asus Routers Hijacked into Stealth Botnet

In August 2025, cybersecurity researchers identified a new malware strain named KadNap, which primarily targets Asus routers to conscript them into a botnet used for proxying malicious traffic. By March 2026, over 14,000 devices had been infected, with more than 60% located in the United States. KadNap employs a customized version of the Kademlia Distributed Hash Table (DHT) protocol, enabling it to conceal command-and-control (C2) infrastructure within a peer-to-peer network, thereby evading traditional network monitoring and enhancing resilience against detection and disruption efforts. The malware is distributed through a shell script that establishes persistence via cron jobs, downloads a malicious ELF file, and executes it, effectively integrating the compromised device into the botnet. ([thehackernews.com](https://thehackernews.com/2026/03/kadnap-malware-infects-14000-edge.html?utm_source=openai)) The emergence of KadNap underscores a growing trend of sophisticated malware targeting edge networking devices, exploiting their vulnerabilities to build resilient botnets. This incident highlights the critical need for organizations and individuals to secure their network infrastructure, as such compromised devices can be leveraged for various malicious activities, including anonymizing cybercriminal operations and facilitating large-scale attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-kadnap-botnet-hijacks-asus-routers-to-fuel-cybercrime-proxy-network/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports