✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
GlassWorm: A Self-Propagating Supply Chain Worm Targets VS Code Developers
In early 2024, a sophisticated supply chain attack targeting the Visual Studio Code (VS Code) developer ecosystem was uncovered, leveraging a self-propagating worm dubbed 'GlassWorm.' The attack exploited weaknesses in package distribution and dependency validation, spreading rapidly via malicious code hidden in open-source extensions and packages. Once executed on developer machines, GlassWorm covertly harvested credentials and turned compromised systems into nodes for broader criminal infrastructure, affecting nearly 36,000 endpoints globally. The incident illuminated the risks posed by highly automated, invisible code propagation through trusted development tools, impacting developer productivity and increasing the potential for downstream compromise across organizations that rely on shared code repositories. This breach is emblematic of the accelerating trend of supply chain attacks against development environments, with threat actors increasingly leveraging automation and legitimate software to undermine trust. The GlassWorm incident underscores the urgency for enhanced visibility, stringent code validation, and zero trust controls in modern software supply chains to counter evolving adversary tactics.
6 months ago
Kill Chain
Remote Code Execution Flaw in Abandoned Rust Library Exposes Global Supply Chain
In August 2024, Edera researchers discovered CVE-2025-62518, a high-severity remote code execution vulnerability in the abandoned async-tar library for the Rust programming language. This logic flaw, named "TARmageddon," was unwittingly propagated to millions of users through downstream forks like tokio-tar and widely used build tools such as uv and testcontainers. The systemic risk arises because the vulnerability was replicated across a deep lineage of forks, making it very difficult to detect and patch comprehensively. Exploitation allows attackers to achieve remote code execution by overwriting files via malicious tar archives—a threat amplified by the lack of direct visibility into indirect dependencies in modern supply chains. The incident is especially impactful as it highlights the persistent risks of open-source abandonware and insufficient maintenance of foundational software libraries. It underscores growing industry focus on supply-chain security, indirect dependency management, and the need for rapid, coordinated vulnerability disclosure and remediation.
6 months ago
Kill Chain
Stealit Malware Abuses Node.js SEA in 2025 Infostealer Supply Chain Campaign
In October 2025, cybersecurity experts uncovered an active malware campaign involving Stealit, an advanced infostealer that exploits Node.js' Single Executable Application (SEA) feature to deliver its malicious payloads. The campaign also utilized the Electron framework and disguised its distribution through popular but trojanized game and VPN installers. Once executed, Stealit exfiltrated sensitive data from victims—such as credentials, browser information, and cryptocurrency wallets—using stealthy techniques while evading detection. The attack led to significant risks of account compromise and potential financial loss, particularly for organizations relying on affected software supply chains. This incident highlights a broader trend of attackers weaponizing modern development frameworks (like Node.js and Electron) to bypass traditional endpoint defenses. The use of legitimate-looking installers and supply chain manipulation signal an evolution in infostealer delivery tactics, making vigilance and advanced network segmentation crucial for organizational resilience.
6 months ago
Kill Chain
Astaroth Banking Trojan Leverages GitHub to Evade Takedowns in 2025
In October 2025, cybersecurity researchers uncovered a sophisticated campaign distributing the Astaroth banking trojan, which leveraged GitHub repositories as its primary command-and-control infrastructure. By shifting away from traditional, easily dismantled C2 servers, attackers used public code-hosting platforms to deploy configuration files and payloads. Targeted endpoints were infected through phishing campaigns, after which Astaroth would harvest credentials and financial data undetected. The integration with GitHub provided attackers increased operational resilience, making takedown efforts by defenders and law enforcement more challenging. Financial institutions and users experienced notable disruptions and heightened risk of unauthorized account activity due to these stealthy techniques. This incident highlights a growing trend of threat actors abusing legitimate platforms for illicit operations, undermining trust in cloud services. Organizations must reassess controls and detection strategies as adversaries increasingly exploit mainstream tools and shift to fileless, cloud-hosted malware models.
6 months ago
Kill Chain
How Malicious Open Source Packages Used Discord to Breach Developer Supply Chains in 2025
In October 2025, security researchers uncovered a widespread supply chain attack targeting popular open source repositories—including npm, PyPI, and RubyGems. Malicious packages were uploaded to these ecosystems and leveraged Discord webhooks as a covert command-and-control (C2) channel to exfiltrate sensitive developer data upon installation. The attackers took advantage of the ease of publishing code to open source registries, embedding scripts that silently siphoned credentials, environment variables, and other project secrets. Dozens of projects and potentially thousands of developers or organizations were impacted, risking further compromise via credential leakage and downstream dependency poisoning. This incident underscores the urgency of enforcing robust dependency hygiene and highlights a rising trend: attackers increasingly abusing trusted supply chains and common collaboration tools for exfiltration. As open source usage soars and supply chain security intensifies, organizations must be vigilant against covert exfiltration methods and adopt multilayered security controls.
6 months ago
Kill Chain
AMD RMPocalypse: 2025 SEV-SNP Hardware Flaw Shakes Confidential Computing
In October 2025, researchers from ETH Zürich disclosed a critical vulnerability, dubbed RMPocalypse, affecting AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) technology. The flaw allowed attackers to undermine confidential computing protections by exploiting incomplete memory protections, making it feasible to alter a single 8-byte memory location and bypass hardware security boundaries. This discovery prompted AMD to release urgent patches across impacted EPYC server platforms, as the risk permitted threat actors—potentially including malicious tenants or insiders in cloud environments—to access sensitive workload data previously thought to be isolated and encrypted. This incident highlights persistent risks within hardware-assisted security frameworks and confidential computing platforms, as attackers increasingly target trusted execution environments. With a rise in high-confidence threats and supply-chain attacks, this breach sets a new precedent for cross-layer vulnerability research and the urgency of continuous hardware and firmware security validation.
6 months ago
Kill Chain
Critical SAP NetWeaver Zero-Day in 2025 Enables Unauthenticated Server Takeover
In October 2025, SAP disclosed and patched a critical zero-day vulnerability (CVE-2025-42944) in its NetWeaver Application Server Java platform, stemming from insecure deserialization. The vulnerability, rated CVSS 10.0, enabled unauthenticated remote attackers to execute arbitrary commands on affected servers, potentially compromising entire SAP landscapes. Though SAP issued urgent patches addressing 13 issues, the deserialization flaw was particularly notable for its potential to allow complete server takeover without credential access. Organizations were urged to deploy security updates immediately to prevent exploitation. This incident highlights the ongoing risk posed by deserialization vulnerabilities in widely deployed enterprise applications. As attackers accelerate exploitation of newly disclosed flaws, organizations must prioritize rapid patching, bolster application-layer controls, and monitor for lateral movement to mitigate the risk of business-critical system breaches.
6 months ago
Kill Chain
VS Code Extension Access Token Leak: A 2025 Supply Chain Wake-Up Call
In October 2025, a major supply chain risk was exposed when over 100 Visual Studio Code (VS Code) extensions were found to have leaked access tokens, allowing threat actors to publish malicious updates to widely used extensions. Attackers who obtained these tokens could have distributed compromised software versions to millions of developers globally, undermining trust in open-source ecosystems and introducing the risk of code tampering, credential theft, or insertion of backdoors into organizational environments. The vulnerability lay in the mishandling and inadvertent leakage of personal access tokens (PATs) for both the VSCode Marketplace and Open VSX, giving adversaries an insidious update path into developer workstations and CI/CD pipelines. This incident highlights the increasing frequency and sophistication of supply chain attacks targeting developer tools and open-source dependencies. As the software landscape grows more interconnected, private access tokens and code-signing credentials now represent high-value targets, requiring robust security controls and zero trust validation across the development lifecycle.
6 months ago
Kill Chain
Chinese APT 'Jewelbug' Compromises Russian IT Provider in Stealthy 2025 Attack
In early 2025, the Chinese state-linked threat group known as 'Jewelbug' stealthily infiltrated a prominent Russian IT service provider over a five-month period, according to findings from Symantec. The attackers gained initial access in January, likely leveraging supply chain or credential compromise vectors, and subsequently maintained persistent, undetected presence until May. Jewelbug is known for sophisticated tactics, including advanced lateral movement, encrypted traffic, and covert exfiltration. As a result, sensitive data and core IT systems within the provider’s infrastructure were at risk, potentially impacting downstream Russian clients who relied on its managed services. This incident highlights the expanding global reach of advanced persistent threats (APTs), with Jewelbug moving beyond historical targets in Southeast Asia and South America to now conduct espionage in Russia. The breach demonstrates increasing sophistication in supply chain and east-west attack techniques, underscoring urgent need for robust lateral movement prevention, segmentation, and cloud visibility controls.
6 months ago
Kill Chain
Adobe AEM 2025 Breach: CISA Flags Critical Application Flaw Under Active Attack
In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) raised alarms about a critical misconfiguration vulnerability (CVE-2025-54253) impacting Adobe Experience Manager (AEM). This flaw, assigned a CVSS score of 10.0, allows remote unauthenticated attackers to achieve arbitrary code execution on vulnerable AEM instances. Active exploitation was confirmed as attackers leveraged the bug to gain foothold, escalate privileges, and deploy malware on targeted organizations, potentially exposing sensitive data and compromising internal operations. The incident highlights the risks of unpatched enterprise software within digital supply chains and data-driven organizations. The AEM vulnerability is currently notable due to increased exploitation by multiple threat actors, coinciding with a larger trend of critical zero-day application flaws being used in advanced persistent attacks. Regulatory agencies and security experts underscore the urgency for patching exposed business applications given the frequency and sophistication of exploitation campaigns in 2025.
6 months ago
Kill Chain
Pwn2Own Ireland 2025: Security Researchers Expose 34 Zero-Day Vulnerabilities
On the first day of Pwn2Own Ireland 2025, security researchers successfully exploited 34 unique zero-day vulnerabilities across a range of enterprise technologies, earning $522,500 in awards. The event, renowned for responsible disclosure and sponsored by leading vendors, demonstrated both the speed and sophistication with which zero-day flaws can be discovered and exploited in widely used software and hardware platforms. While no criminal group was involved (these are sanctioned research efforts), the findings underscore prevailing vulnerabilities in enterprise defenses and often result in rapid product updates and critical security advisories. This incident highlights the ongoing arms race between researchers and vendors to identify and remediate unknown security gaps. The large number of zero-days found in a single day signals both the growing complexity of attack surfaces and the pressing need for automated detection and proactive patching mechanisms across the digital ecosystem.
6 months ago
Kill Chain
How UNC5142 Hijacked WordPress & Blockchain for Next-Gen Stealer Attacks (2025)
In October 2025, threat actor UNC5142 leveraged compromised WordPress sites to distribute a wave of information-stealing malware using an innovative attack method dubbed 'EtherHiding.' The adversaries abused blockchain-based smart contracts to conceal malicious code, enabling malware such as Atomic Stealer, Lumma, Rhadamanthys, and Vidar to infect both Windows and macOS endpoints. This technique allowed attackers to rapidly update payloads beyond the reach of static blocklists and frequently evade traditional security controls. Victims included a variety of enterprises and individuals, with attackers capitalizing on the popularity and trust of infected WordPress content management platforms. This incident highlights an emerging TTP where blockchain infrastructure is repurposed to enhance delivery persistence and obfuscation for criminal campaigns. The rapid uptake of such blockchain-based methods demonstrates the need for organizations to evolve threat detection and response strategies as attackers diversify beyond conventional web infrastructure.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports