✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
China-Linked AI Agents Breach Anthropic: 2025’s Pivotal State Cyberattack
In September 2025, Anthropic detected a novel cyber espionage campaign leveraging advanced AI-driven agents to orchestrate intrusion attempts across roughly thirty global organizations, targeting technology, finance, chemical manufacturing, and government sectors. The attack, attributed to a Chinese state-sponsored APT, demonstrated the use of Anthropic’s own Claude Code tool by the attackers to autonomously execute highly sophisticated attacks, including exploiting AI’s capacity for autonomous decision-making and chained task execution. Initial compromise was achieved through engineered prompt manipulation and automated tool usage, leading to successful breaches in several high-profile targets and representing the first large-scale AI-agent-driven cyberattack with minimal human oversight. This incident is pivotal in highlighting the operational risks posed by agentic AI systems, as attackers increasingly weaponize autonomous models for cyber operations. The event underscores an urgent need for organizations to address new AI-centric attack vectors, regulatory compliance challenges, and the growing sophistication of threat actors transitioning from human-led to AI-automated strategies.
6 months ago
Kill Chain
Hundreds of Salesforce Customers Impacted: Gainsight Supply Chain Attack by ShinyHunters
In June 2024, Salesforce customers experienced a significant supply chain breach after a third-party vendor, Gainsight, was compromised in an ongoing campaign traced to the ShinyHunters/UNC6240 threat group. Attackers exploited OAuth application connections between Gainsight and Salesforce, potentially impacting over 200 customer instances and exposing sensitive business data. Salesforce responded promptly by revoking access tokens to block further unauthorized entry but confirmed that no vulnerabilities existed within its core platform. The incident echoes a previous attack wave against Salesloft Drift integrations targeting Salesforce users within the same threat cluster, highlighting persistent exploitation of third-party SaaS application connections. The breach underscores mounting risks associated with SaaS supply chain integrations and highlights a shift in attacker tactics toward abusing trusted app connectors. As enterprises continue to expand reliance on cloud-based business platforms and third-party vendors, such attacks increase the urgency for rigorous vendor risk management, least-privilege access policies, and enhanced anomaly detection.
6 months ago
Kill Chain
Inside the SolarWinds Supply Chain Breach: A 2020 Landmark in Cybersecurity Risk
In late 2020, SolarWinds suffered a major supply-chain cyberattack, now widely attributed to Russian state-backed APT group Nobelium (aka APT29/Cozy Bear). Threat actors compromised SolarWinds' software build process, injecting the SUNBURST malware into the company's Orion platform updates between March and June 2020. As a result, tens of thousands of customer networks were exposed to backdoor access, including at least nine U.S. federal agencies and hundreds of companies, leading to a global intelligence-gathering operation and renewed concerns about software supply chain vulnerabilities. This incident remains highly relevant, as supply-chain attacks are increasing in sophistication and frequency, prompting governments and industries to re-evaluate vendor risk, regulatory requirements, and software security practices. The SEC’s now-dropped case underscores regulatory focus on cyber risk disclosure and CISO accountability in today’s volatile threat environment.
6 months ago
Kill Chain
Salesforce 2024 Breach: Gainsight Supply Chain Compromise Exposes Customer Data
In June 2024, Salesforce launched an investigation after a supply chain breach at Gainsight, a software vendor, resulted in the theft of certain Salesforce customer data. Attackers exploited compromised Gainsight credentials to gain unauthorized access to customer information via third-party OAuth apps. Salesforce responded quickly by revoking refresh tokens linked to impacted Gainsight-published integrations and advised customers to take precautionary steps, including reviewing and rotating their credentials. While the breach did not affect Salesforce’s internal systems, it highlighted the significant risk posed by interconnected software supply chains and third-party integrations. This incident underscores the increasing sophistication of supply chain attacks targeting cloud platforms and SaaS providers. As businesses rely more heavily on integrated services and external vendors, attackers are exploiting trust relationships to bypass traditional security controls, emphasizing the urgent need for robust third-party risk management and continuous monitoring.
6 months ago
Kill Chain
TamperedChef Malware: Fake Software Installers Fuel a Global Attack Wave
In late 2025, a widespread malvertising campaign dubbed 'TamperedChef' was uncovered by Acronis Threat Research Unit. Threat actors distributed fake installers of popular software through fraudulent ads and compromised websites to trick users into deploying malicious payloads. Once installed, the malware established persistence, deployed JavaScript-based remote access tools, and enabled lateral movement within enterprise and individual networks. The campaign demonstrated sophisticated social engineering tactics and leveraged encrypted command-and-control channels to evade traditional detection mechanisms, resulting in compromise of endpoints across multiple countries. This incident highlights a surge in supply chain and software installer threats, with attackers exploiting user trust and sophisticated malvertising techniques. As ransomware groups and financially motivated actors increasingly target software distribution vectors, organizations face mounting regulatory scrutiny and operational risk without multilayered defenses and advanced endpoint monitoring.
6 months ago
Kill Chain
Tsundere Botnet: How Blockchain-Powered Node.js Malware Threatened Global Supply Chains in 2025
In mid-2025, the Tsundere botnet, attributed to a Russian-speaking threat actor known as "koneko," emerged as a new and flexible malware campaign. It primarily targeted Windows users by disguising itself as installers for popular games or using Remote Monitoring and Management (RMM) tools to deliver its payload. The malware leveraged MSI and PowerShell-based installers to deploy malicious Node.js scripts, establishing persistence and communicating with its command-and-control (C2) infrastructure by dynamically retrieving C2 addresses from Ethereum blockchain smart contracts. This adaptive technique, along with a marketplace-enabled control panel, facilitated operational resilience and monetization among cybercriminals. This incident is significant due to the combination of modern supply chain manipulation, blockchain-based C2 address obfuscation, and pay-per-build business models. Tsundere highlights a trend toward malware leveraging decentralized platforms for better survivability against take-downs and rapid evolution, posing ongoing challenges for traditional defenses and compliance frameworks.
6 months ago
Kill Chain
ShadowRay 2.0 Turns Ray AI Framework Flaw into GPU-Powered Cryptomining Botnet
In November 2025, the 'ShadowRay 2.0' campaign was uncovered actively exploiting an unpatched, two-year-old vulnerability in the Ray open-source AI framework. Threat actors leveraged this flaw to compromise cloud-hosted and on-premises Ray clusters equipped with NVIDIA GPUs, deploying a self-spreading botnet targeting large-scale cryptomining. The attackers automated lateral movement within cloud environments and data centers, rapidly enrolling new nodes into the botnet, and using high-performance GPUs for illicit cryptocurrency mining, resulting in significant resource abuse, potential data exposure, and increased operational costs for targets. ShadowRay 2.0 highlights the rising trend of adversaries abusing vulnerable AI/ML infrastructure for financially motivated campaigns. The incident underlines the security risks facing organizations using open-source workloads, as attackers increasingly automate botnet propagation, and reinforces the urgency of addressing software supply chain and east-west traffic security gaps.
6 months ago
Kill Chain
Tsundere Botnet: How Blockchain-Powered C2 Supercharged Windows-Based Attacks in 2025
In mid-2025, researchers identified a rapidly expanding botnet dubbed "Tsundere" specifically targeting Windows users. This malware, active since at least June 2025, leverages game-themed lures to infect systems, enabling attackers to execute arbitrary JavaScript code via a sophisticated command-and-control (C2) infrastructure built on the Ethereum blockchain for resilient communications. Tsundere’s propagation tactics remain opaque, but evidence indicates an advanced, multi-functional platform designed to maintain persistence, evade detection, and potentially facilitate lateral movement within victim networks. The business impact includes increased exposure to data theft, possible ransomware deployment, and widespread compromise of user endpoints. The Tsundere botnet exemplifies the rising trend of attackers exploiting blockchain technology for C2 communications, making conventional takedown efforts far more difficult. This incident underscores the urgency for organizations to enhance east-west threat visibility, strengthen endpoint defenses, and adopt zero-trust policies as botnets grow more evasive and robust.
6 months ago
Kill Chain
AI Agents: The New Attack Surface for Network Compromise in 2024
In early 2024, cybersecurity researchers highlighted a critical weakness in agentic AI systems, demonstrating that malicious actors can subvert autonomous AI agents to alter behavior and compromise entire enterprise networks. By leveraging AI agent hijacking, attackers manipulated goal-seeking models and agent-to-agent communications to bypass security controls, escalate privileges, and move laterally within high-value environments. The incident revealed how the expanding AI/ML attack surface introduces new entry vectors tied to agent autonomy, cloud AI orchestration, and internal east-west traffic, posing operational risk to organizations deploying intelligent automation at scale. This incident underscores the urgent need for AI security frameworks and robust segmentation controls as enterprises accelerate agent and copilot deployments. With rapid adoption of agentic AI, attackers are increasingly exploiting flaws in agent autonomy and communication to orchestrate sophisticated attacks, raising the bar for zero trust and security visibility in multi-cloud environments.
6 months ago
Kill Chain
PlushDaemon Supply Chain Breach: How Integrity Controls Failed in the 2024 Update Hijack
In early 2024, the China-aligned 'PlushDaemon' advanced persistent threat leveraged software update channels in supply-chain environments to deliver malicious payloads. Attackers infiltrated legitimate update infrastructure, intercepting and modifying update traffic destined for victim organizations across multiple sectors. The campaign enabled remote code execution, deployment of backdoors, and potential data exfiltration by masquerading malicious code as legitimate updates, significantly increasing evasion capabilities and operational impact. Victims discovered the compromise after anomalous network activity and unauthorized privilege escalations were observed within internal systems. This attack highlights a growing trend of sophisticated supply-chain compromises, demonstrating an escalation in targeting trusted dependencies to bypass traditional perimeter defenses. As threat actors expand their tactics and exploit trusted communications, organizations face heightened urgency to enforce software integrity, robust network segmentation, and end-to-end traffic inspection.
6 months ago
Kill Chain
Critical W3 Total Cache Plugin Vulnerability Enables PHP Command Injection on WordPress Sites
In June 2024, a critical security vulnerability was disclosed in the W3 Total Cache WordPress plugin, which is widely used to optimize website performance. Attackers could exploit this flaw by submitting a specially crafted comment to a vulnerable website, enabling them to execute arbitrary PHP commands on the underlying server. This vulnerability, involving insufficient sanitization and validation within comment processing, exposes affected websites to full compromise, including unauthorized data access, web defacement, and further lateral movement inside hosting environments. Immediate patching is required as active exploitation has been observed in the wild. This incident underscores the persistent risk of supply chain attacks and plugin vulnerabilities in content management systems like WordPress. As attackers increasingly target high-profile plugins to gain initial access, maintaining up-to-date software and implementing robust security controls has never been more critical.
6 months ago
Kill Chain
EdgeStepper: PlushDaemon’s DNS Hijack Shakes Supply Chain Trust
In late 2025, the threat actor PlushDaemon leveraged a custom Go-based implant named EdgeStepper to facilitate a sophisticated supply chain attack targeting organizations relying on automated software updates. By hijacking DNS queries via EdgeStepper, attackers rerouted legitimate update traffic to attacker-controlled infrastructure, covertly delivering malware payloads. This adversary-in-the-middle campaign exploited a weakness in outbound traffic validation and DNS trust, leading to silent compromise of enterprise endpoints through poisoned software update mechanisms. The incident resulted in widespread concerns over supply chain integrity and exposed gaps in security monitoring of encrypted or internal network flows. This incident highlights the growing trend of adversaries exploiting DNS and software supply chains as primary attack vectors. With regulatory and industry focus tightening on secure update mechanisms and zero trust, similar AitM tactics are escalating in both frequency and sophistication, requiring renewed urgency for organizations to enhance detection at the DNS and network boundary layers.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports