✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
When Vulnerabilities Strike at Machine Speed: The 2026 Supply Chain Attack
In early 2026, a sophisticated global supply chain attack exploited vulnerabilities in widely used software components just hours after new CVEs were publicly disclosed. Threat actors weaponized exploit code at unprecedented speed, targeting unpatched enterprise systems across cloud, hybrid, and on-prem environments. The adversaries leveraged compromised update channels and lateral east-west movement to deploy malicious payloads, exfiltrate data, and disrupt critical services. Businesses faced operational downtime, data loss, and compliance exposures as traditional patch cycles failed to keep pace with machine-speed attacks. This breach underscores how the rapid turn from vulnerability disclosure to global exploitation has become a defining security risk. The event highlights the urgent need for automation, zero trust segmentation, and machine-speed threat detection to mitigate threats that now outpace human-led response.
6 months ago
Kill Chain
2024 Salesloft-Drift Supply Chain Breach: AWS Credential Exposure and Cloud Security Lessons
In early 2024, a sophisticated supply chain attack targeted the Salesloft and Drift integration, leading to the compromise of AWS credentials and unauthorized access to cloud environments. Threat actors exploited weaknesses in the integration pipeline, leveraging exposed secrets to move laterally and access sensitive customer data before the breach became public. Red Canary detected anomalous cloud activity tied to this attack, providing early detection prior to broad public awareness and response, thereby helping to mitigate further impact. This incident is significant as it demonstrates the growing frequency and sophistication of supply chain attacks within SaaS and cloud services, especially those exploiting secret leaks and third-party application integrations. The breach highlights the need for heightened vigilance, identity and credential protection, and advanced threat detection capabilities in the cloud ecosystem.
6 months ago
Kill Chain
Siemens Altair Grid Engine 2025: Local Privilege Escalation and OT Vulnerability Risks
In November 2025, Siemens disclosed two local privilege escalation vulnerabilities affecting all versions of Altair Grid Engine prior to V2026.0.0. These flaws, identified as CVE-2025-40760 (Generation of Error Message Containing Sensitive Information) and CVE-2025-40763 (Uncontrolled Search Path Element), could allow attackers with local access to extract password hashes or execute arbitrary code with superuser permissions by manipulating environment variables or error handling processes. Although there has been no evidence of exploitation in the wild, the vulnerabilities required only low attack complexity and affected critical manufacturing environments globally. This incident highlights ongoing risks posed by improper input validation and error handling in operational technology (OT) environments, especially as attackers increasingly target privilege escalation vectors. Regulatory bodies emphasize swift detection, patching, and IT/OT segmentation to reduce attack surface, as local escalation flaws remain a persistent threat vector in critical infrastructure.
6 months ago
Kill Chain
Operation Endgame 2024: Global Law Enforcement Strikes Down Major Malware Networks
In November 2024, a coalition of law enforcement agencies from 11 countries coordinated Operation Endgame, a major crackdown disrupting some of the most prolific malware networks globally. The operation targeted Rhadamanthys infostealer, VenomRAT remote access trojan, and the Elysium botnet—malware that collectively infected hundreds of thousands of computers and enabled the theft of millions of credentials. Authorities arrested the principal VenomRAT suspect in Greece, searched 11 sites across Europe, and dismantled more than 1,000 criminal servers and 20 illicit domains. With assistance from 30-plus cybersecurity companies, the operation also notified thousands of victims and exposed users of these illicit services, mitigating ongoing criminal campaigns. Operation Endgame underscores the rapidly evolving, cross-border nature of malware infrastructure and the growing need for coordinated responses by both public and private sectors. As attackers innovate and leverage distributed networks to evade law enforcement, regular collaborative enforcement actions and heightened detection capability are now critical to cybersecurity defenses worldwide.
6 months ago
Kill Chain
GlobalLogic's 2024 Ransomware Breach: Clop Hits Oracle E-Business Suite Customers
GlobalLogic, a subsidiary of Hitachi, suffered a significant data breach after the Clop ransomware group exploited a zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite. The breach, which began on July 10, 2024, went undetected for months and resulted in the theft of sensitive human resources data for nearly 10,500 current and former employees. Attackers accessed items such as names, SSNs, salary and bank details, passport information, and more, ultimately issuing extortion demands and threatening to leak the stolen data. GlobalLogic promptly initiated incident response actions, notified regulators, and applied Oracle's critical software patches to mitigate the threat after discovering the breach on October 9, 2024. This incident is part of a broader campaign targeting multiple Oracle customers, with ransom demands reaching as high as $50 million and almost 30 organizations named as victims on Clop’s data leak site. This attack underscores the ongoing threat of ransomware groups exploiting enterprise application vulnerabilities and highlights the growing risks posed by sophisticated supply chain and zero-day attacks. Organizations relying on popular ERP software must increase vigilance and prioritize patch management, while regulators and security leaders raise concern over attackers' speed, stealth, and extortion tactics.
6 months ago
Kill Chain
GlobalLogic Employee Data Breach: Lessons from the 2024 Oracle EBS Compromise
In early June 2024, GlobalLogic—a Hitachi-owned provider of digital engineering services—disclosed a significant data breach involving its Oracle E-Business Suite (EBS) platform. Attackers gained unauthorized access to EBS, resulting in the theft of sensitive data for over 10,000 current and former employees. The organization responded by launching an investigation, notifying affected individuals, and collaborating with Oracle and security experts to identify the root cause and contain the intrusion. The breach's exposure meant threat actors likely accessed personally identifiable information including names, addresses, and payroll details, elevating the risk of identity theft and further compromise. This incident highlights the ongoing vulnerabilities in complex legacy applications like Oracle EBS, especially as attackers increasingly target enterprise resource systems with sophisticated intrusion techniques. With regulatory scrutiny on employee data protection intensifying, organizations must prioritize robust segmentation, encryption, and visibility controls to counter evolving attack patterns.
6 months ago
Kill Chain
Malicious npm Typosquatting Campaign Targets GitHub Supply Chain — 2025 Incident Report
In October 2025, cybersecurity researchers detected a supply chain attack involving a malicious npm package named "@acitons/artifact," designed to typosquat the popular GitHub-associated package "@actions/artifact." The attacker attempted to infiltrate GitHub-owned repositories by enticing developers to inadvertently include the rogue package in their build pipelines. Once installed, the malicious code sought to exfiltrate sensitive build environment tokens, which could be exploited to gain unauthorized access to publish or modify code repositories, potentially impacting the integrity and security of widely used open-source projects. This incident highlights a broader trend in threat actor tactics leveraging typosquatting and supply chain vectors to compromise trusted development environments. With the rapid increase in CI/CD automation and open-source dependencies, organizations across industries face mounting risk from similar attacks targeting software supply chains.
6 months ago
Kill Chain
CISO Playbook: Responding to the 2025 AI Supply Chain Attack Crisis
In 2025, the global software development and technology sector faced one of the most disruptive AI-enabled supply chain attacks to date. Threat actors leveraged machine learning to automate the insertion and propagation of malicious packages into widely used open-source repositories, targeting dependencies incorporated by thousands of enterprises worldwide. The initial breach was undetected due to sophisticated code obfuscation and AI-driven capability to mimic legitimate update patterns. As organizations unwittingly integrated these compromised modules, attackers gained unauthorized access, facilitated credential theft, and enabled lateral movement within victim environments, ultimately impacting business operations and exposing sensitive data. This incident underscores the escalating threat posed by AI-assisted supply chain attacks, where attackers rapidly iterate and deploy tactics outpacing traditional detection measures. The significant surge in malicious package uploads, sophisticated polymorphic payloads, and targeted exploitation of widely trusted repositories reveal an urgent need for CISOs to reassess their supply chain defense strategies, especially as regulatory scrutiny around software provenance intensifies worldwide.
6 months ago
Kill Chain
GootLoader’s 2025 Comeback: Font Evasion Drives WordPress Malware Surge
In late October 2025, security firm Huntress detected a resurgence of the GootLoader malware, targeting WordPress sites by leveraging a novel font obfuscation technique to deliver malicious payloads. Over the course of several days, analysts observed three distinct GootLoader infections, two of which escalated to hands-on-keyboard intrusions, resulting in full domain controller compromises within 17 hours of initial exposure. Attackers exploited legitimate but vulnerable WordPress sites to lure victims, facilitating subsequent lateral movement once inside organizational networks, and maximizing their potential impact on business operations. GootLoader's resurgence, paired with new evasion techniques, exemplifies the ongoing arms race between threat actors and defenders. Security teams must maintain heightened vigilance amid renewed focus on web-based attack vectors and advanced malware loaders that can escalate quickly to business-critical breaches.
6 months ago
Kill Chain
GlassWorm Supply Chain Attack Exposes VS Code and Developer Ecosystems
In June 2024, a coordinated supply chain attack involving the GlassWorm malware targeted the Open VSX marketplace, enabling the spread of compromised Visual Studio Code extensions. Attackers weaponized these extensions to propagate malware onto developer devices globally, facilitating lateral movement and potential data exfiltration within development environments. Threat actors leveraged the trust inherent in popular code repositories to deploy self-propagating malware, which remained undetected for weeks, impacting thousands of developers and exposing software supply chains to significant risk. This incident underscores the vulnerabilities presented by reliance on third-party developer tools and the sophisticated nature of modern supply-chain threats. The GlassWorm incident highlights a growing trend where attackers exploit software development ecosystems to gain broad access to sensitive environments. As reliance on open source and marketplace extensions increases, organizations must strengthen their posture against these evolving supply-chain vulnerabilities and ensure detection capabilities span both inbound and internal (east-west) traffic.
6 months ago
Kill Chain
Expr-eval JavaScript Library Faces Supply-Chain RCE Vulnerability in 2024
In March 2024, a critical remote code execution (RCE) vulnerability was identified in expr-eval, a widely used JavaScript mathematical expression evaluator with over 800,000 weekly NPM downloads. The flaw, if exploited through maliciously crafted input, allowed attackers to execute arbitrary code within applications leveraging the vulnerable versions of the library. As expr-eval is integrated into numerous projects and frameworks, the supply-chain impact was significant, exposing countless downstream applications to the risk of compromise and highlighting the cascading dangers of third-party dependency vulnerabilities. This incident underscores the increasing focus by attackers on widely adopted open-source libraries as high-leverage supply-chain targets. The expr-eval vulnerability echoes a broader industry trend where modern development practices introduce risks outside direct organizational control, prompting renewed concerns about dependency management, zero trust for software supply chains, and regulatory calls for heightened software bill of materials (SBOM) transparency.
6 months ago
Kill Chain
GlassWorm: Malicious VS Code Extensions Trigger a New Wave of Supply-Chain Attacks
In late 2025, cybersecurity researchers discovered the 'GlassWorm' malware campaign actively targeting the Visual Studio Code (VS Code) ecosystem via three malicious extensions available on the official marketplace. With over 7,400 combined downloads, these extensions enabled threat actors to inject malware directly into developers' environments, facilitating credential theft, remote access, and potential downstream supply-chain attacks. Attackers leveraged trusted community tools as the entry vector, bypassing traditional perimeter defenses to gain a foothold in development workflows and potentially propagate malware throughout interconnected repositories. This incident underscores the rising prevalence of supply-chain attacks in the software development ecosystem and the unique risks posed by compromised IDE extensions. The popularity of VS Code amplifies the potential blast radius, highlighting an urgent need for improved extension vetting, granular access controls, and continuous threat monitoring within CI/CD pipelines.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports