✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
FBI Alert: UNC6040 & UNC6395 Target Salesforce Customers with Cloud Attacks (2024)
In early 2024, the FBI’s Internet Crime Complaint Center (IC3) issued an alert detailing active campaigns by threat groups UNC6040 and UNC6395 targeting Salesforce customer environments. The attackers leveraged phishing and social engineering to obtain valid Salesforce credentials, subsequently exploiting misconfigurations and inadequate security controls in customer cloud instances. This enabled unauthorized access to sensitive data, including customer information and corporate records, leading to multiple data theft and extortion attempts. Salesforce itself was not breached, but its customers suffered direct operational impacts due to data compromise and disruption. This incident underscores a rising trend of advanced threat actors targeting supply chain and SaaS ecosystems, exploiting both human and technical gaps in cloud security. As cloud adoption accelerates, enterprises must address credential hygiene, proper configuration, and real-time anomaly detection to thwart similar attacks.
6 months ago
Kill Chain
KillSec Ransomware Campaign Targets Brazilian Healthcare Supply Chain
In April 2024, the KillSec ransomware group orchestrated a cyberattack against a major Brazilian healthcare software provider, targeting a core element of the nation’s healthcare technology supply chain. According to cybersecurity researchers, the attackers leveraged sophisticated ransomware tactics to breach the provider’s environment, exfiltrate sensitive patient data, and subsequently encrypt vital systems, disrupting normal operations. The breach involved the theft of confidential healthcare records, potentially exposing personally identifiable information (PII) as well as critical medical data, raising alarms across Brazil’s healthcare sector. As a result, provider services experienced significant operational delays and financial impact, and the wider ecosystem faces cascading risks from the exposed data. This incident is particularly noteworthy due to the healthcare sector’s growing vulnerability to ransomware attacks, with supply chain vectors increasingly exploited by threat actors like KillSec. The event reflects a concerning trend of ransomware groups shifting toward critical infrastructure and service-provider targets, amplifying regulatory, compliance, and patient safety pressures.
6 months ago
Kill Chain
The FileFix Phishing Campaign: Obfuscation, Steganography, and Multilingual Threats Hit Globally
In early 2024, security researchers identified a sophisticated, widescale phishing campaign leveraging a malicious tool called FileFix. The campaign utilized advanced code obfuscation, steganography, and localization in at least 16 languages to distribute phishing payloads globally. Attackers delivered FileFix through deceptive emails and malicious attachments, successfully bypassing traditional security filters. Once executed, the malware embedded within attachments enabled remote access, data theft, and credential harvesting, affecting organizations in multiple sectors and exposing sensitive business data to potential fraud and operational disruption. FileFix highlights a new wave of phishing threats combining obfuscation, multilingual lures, and novel payload delivery. Its rapid evolution and global reach underscore the increasing sophistication of social engineering attacks, making robust detection and segmentation capabilities essential for all enterprises.
6 months ago
Kill Chain
Shai-Hulud Worm: Self-Propagating Malware Hits 180+ NPM Packages in Major Supply Chain Breach
In September 2025, a novel self-replicating worm, dubbed 'Shai-Hulud,' targeted the JavaScript NPM ecosystem by infecting over 180 code packages. The malware exploited developer authentication tokens found on Linux and macOS devices, replicating itself into the top 20 packages accessible to the compromised account and rapidly publishing malicious package versions. Stolen credentials were published in new, public GitHub repositories, compounding the supply chain risk. Though the initial infection included several packages managed by CrowdStrike, the company quickly removed the compromised code and rotated secrets, preventing wider impact to its flagship products. This incident highlights the increasing sophistication and automation of supply chain compromise, especially in open-source software development. The self-propagating nature of Shai-Hulud, combined with credential harvesting and public exposure, represents a growing risk trend for organizations relying on software registries.
6 months ago
Kill Chain
2024 Shai-hulud Worm: Major Supply Chain Attack Strikes NPM
In September 2024, a self-replicating malware dubbed "Shai-hulud" infiltrated the open source ecosystem by targeting hundreds of NPM (Node Package Manager) packages. The worm initiates its campaign by compromising a single software component, and automatically harvests secrets, tokens, and credentials present in affected developers' environments. By leveraging compromised NPM accounts, Shai-hulud spreads itself through subsequent package uploads, injecting malicious payloads into new releases and perpetuating a chain reaction across software supply chains. Impacted parties range from individual developers to prominent tech companies and security vendors. This incident highlights a concerning escalation in supply chain threats, demonstrating advanced automation in malware propagation and the weaponization of interconnected open source dependencies. The attack underscores the rising prevalence of highly automated, lateral-moving malware and the systemic risks posed by compromised development ecosystems.
6 months ago
Kill Chain
Raven Stealer Uses Telegram to Pilfer Chromium Data in 2024
In early 2024, security researchers identified a new infostealer variant, Raven Stealer, being distributed via underground forums and cracked software packages. The malware targets Windows systems and focuses on stealthy extraction of browser data, particularly from Chromium-based browsers such as Google Chrome. Once installed, Raven Stealer harvests credentials, cookies, browser histories, and cryptocurrency wallets before exfiltrating the data through encrypted Telegram channels. The attack exploits unmonitored endpoints and capitalizes on users’ download of pirated or repackaged software, resulting in widespread compromise of sensitive authentication data across multiple organizations. This incident underscores the ongoing evolution of commodity malware and demonstrates the sophistication with which even low-cost infostealers are leveraging encrypted communications and social engineering. As attackers continue to innovate with new TTPs and delivery vectors, organizations must strengthen endpoint monitoring and policy enforcement to reduce exposure to similar threats.
6 months ago
Kill Chain
K2 Think AI Model Jailbroken Within Hours of 2024 Release
On September 9, 2024, the UAE-backed 'K2 Think' large language model (LLM) was released with the goal of industry-leading transparent reasoning. Within hours, however, cybersecurity researchers discovered a critical vulnerability known as Partial Prompt Leakage. This flaw allowed adversaries to observe the model's internal logic in plain text, making it easier to methodically bypass safeguards and jailbreak the AI system. The exploit was demonstrated by researcher Alex Polyakov, who publicly documented how attackers could uncover and iterate against the model’s defenses, enabling harmful behaviors such as malware generation. The breach did not result in immediate large-scale misuse, but it revealed a key tradeoff between transparency and security in modern LLM development. This incident is emblematic of new AI security risks emerging as open, auditable models grow in popularity. It underscores the urgency for vendors to balance transparency with robust protection, as attackers quickly adapt to and exploit unique model features. With increased regulatory scrutiny and rising enthusiasm for open-source AI, safeguarding model reasoning is now a critical surface organizations cannot ignore.
6 months ago
Kill Chain
Lies-in-the-Loop: When AI Coding Agents Become Supply Chain Threats
In June 2024, researchers at Checkmarx Zero demonstrated a novel supply chain attack called 'Lies-in-the-Loop' (LITL) targeting AI-assisted coding agents, specifically Anthropic's Claude Code. By leveraging prompt injection, attackers manipulated the AI into concealing malicious code execution behind benign prompts, effectively tricking human operators into approving dangerous actions. The attack exploited trust in the 'human-in-the-loop' workflow, showing that malicious context within public resources like GitHub issues could hide remote code execution triggers. Successful exploitation enabled attackers to deploy arbitrary commands and potentially introduce malicious packages into software repositories, increasing the risk of downstream supply chain compromise. This incident highlights a concerning trend: as AI coding agents are rapidly adopted, their interfaces become a ripe target for adversaries using social engineering and prompt manipulation. The attack underscores the evolving sophistication of supply chain threats, especially those that blur the lines between human fallibility and machine autonomy in development environments.
6 months ago
Kill Chain
Critical Chaos Mesh Vulnerabilities Enable Kubernetes Cluster Takeover (2024)
In early June 2024, multiple critical vulnerabilities known collectively as "Chaotic Deputy" were disclosed in Chaos Mesh, a widely used open-source chaos engineering platform for Kubernetes. These bugs, including authentication bypass and privilege escalation flaws, allowed unauthorized attackers to obtain elevated access within Kubernetes clusters. Exploitation could lead to total cluster takeover, lateral movement, and the compromise of sensitive resources and data across affected environments. The disclosure prompted rapid patches from maintainers and advisories from security organizations and cloud providers due to the severe risk and broad adoption of Chaos Mesh in enterprise deployments. This incident highlights the increasing focus of attackers and researchers on the Kubernetes and supply chain ecosystem. With Kubernetes now foundational to cloud-native infrastructure, vulnerabilities in operational tools like Chaos Mesh underline the need for robust segmentation, continuous security monitoring, and timely patch management to protect against emerging threats to hybrid and multi-cloud environments.
6 months ago
Kill Chain
SXVM Ransomware PoC Reveals Next-Gen DLL Unhooking to Bypass EDR
In September 2024, a novel ransomware proof-of-concept dubbed 'SXVM' showcased advanced defensive evasion capabilities through DLL unhooking, enabling it to bypass traditional endpoint detection and response (EDR) tools. The threat leverages in-memory manipulation to restore .text sections of key system DLLs—effectively undoing any hooks or software breakpoints set by debuggers and security products. This approach allows ransomware operators to conceal malicious actions and access powerful Windows APIs unchecked. While initial analysis points to a low detection rate and proof-of-concept status, the technique underscores an escalating trend in ransomware sophistication and anti-forensic tactics. This incident is especially relevant as ransomware variants increasingly adopt anti-debugging and anti-EDR methods. The widespread use of DLL unhooking signals a maturing threat landscape, where attackers are continuously innovating to defeat security controls and leverage memory-based evasion techniques.
6 months ago
Kill Chain
Code Assistant LLM Vulnerabilities Expose New AI Supply Chain Risks (2024)
In early 2024, multiple leading code assistant platforms powered by Large Language Models (LLMs) were found to be vulnerable to security threats such as indirect prompt injection, model misuse, and code suggestion manipulation. Attackers exploited weaknesses in prompt handling and insufficient contextual isolation, allowing harmful code or misleading content to be surfaced to end users and potentially exposing enterprise environments to supply chain risks. These risks highlight the growing attack surface in organizations leveraging AI-driven development tools, where impaired oversight can lead to deceptive or insecure code entering production systems. This incident underscores the urgency for enterprises to evaluate the deployment and integration practices for generative AI tools, particularly given the rapid rise in adoption and regulatory focus on AI safety. Attacker tactics are evolving quickly, and threat actors are increasingly targeting AI models and their usage contexts as a new cyber frontier.
6 months ago
Kill Chain
2025 Salesforce Data Breach: Supply Chain Extortion Hits Retail Sector
In mid-2025, a coordinated cybercriminal campaign led by UNC6395 and affiliates of Muddled Libra targeted Salesforce tenants via a multi-stage supply chain attack stemming from infiltrated third-party integrations such as Salesloft and Drift. Attackers used advanced social engineering and process exploitation rather than technological vulnerabilities to gain access to Salesforce customer data—including sensitive records like accounts, contacts, and opportunities. The operation highlighted the growing focus on data theft extortion tactics and the use of encrypted communications, with threat actors actively marketing stolen data through Telegram channels under monikers like "Scattered LAPSUS$ Hunters." The impact has been significant for retailers and digital platform users, driving urgent defensive and policy changes at Salesforce and affected enterprises. This incident underscores an accelerating threat shift in 2025: attackers are increasingly leveraging social engineering and the SaaS supply chain to circumvent traditional defenses, monetizing access through extortion rather than ransomware. The event has intensified industry efforts to tighten access controls and enforce encryption, amid persistent regulatory and law enforcement actions.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports