✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Drift Protocol's $280M Loss: A Case Study in Advanced Social Engineering
In April 2026, Drift Protocol, a decentralized finance platform on the Solana blockchain, suffered a sophisticated cyberattack resulting in the theft of approximately $280 million in digital assets. The attackers, identified as the North Korean state-sponsored group UNC4736, infiltrated the organization over a six-month period by posing as a legitimate quantitative trading firm. They engaged with Drift contributors at multiple industry conferences, building trust through in-person meetings and continued communication via Telegram. This prolonged social engineering campaign allowed them to gain unauthorized access to Drift's Security Council administrative powers, leading to the rapid exfiltration of funds. This incident underscores the evolving tactics of state-sponsored cyber actors, who are increasingly leveraging extended social engineering strategies to compromise high-value targets. The attack highlights the critical need for organizations to implement robust security protocols, including stringent verification processes and continuous monitoring, to defend against such sophisticated infiltration methods.
3 months ago
Kill Chain
Storm-1175's Rapid Exploitation of Zero-Day Vulnerabilities in Medusa Ransomware Attacks
In April 2026, Microsoft identified Storm-1175, a China-based cybercriminal group, exploiting zero-day vulnerabilities to deploy Medusa ransomware. The group rapidly transitioned from initial access to data exfiltration and ransomware deployment, often within 24 hours. They targeted sectors including healthcare, education, professional services, and finance across the U.S., U.K., and Australia. Storm-1175 utilized tools like PowerShell, PsExec, and remote monitoring software to establish persistence, conduct reconnaissance, and move laterally within networks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks/?utm_source=openai)) This incident underscores the increasing sophistication and speed of ransomware attacks, highlighting the critical need for organizations to promptly patch vulnerabilities and enhance their cybersecurity defenses to mitigate such rapidly evolving threats.
3 months ago
Kill Chain
TeamPCP's 2026 Supply Chain Attack on LiteLLM: A Wake-Up Call for Open-Source Security
In March 2026, the threat group TeamPCP executed a sophisticated supply chain attack targeting LiteLLM, a widely used Python package facilitating unified access to various large language models. By compromising LiteLLM's PyPI repository credentials—initially obtained through a prior breach of the Trivy security scanner—TeamPCP published malicious versions 1.82.7 and 1.82.8. These versions contained malware designed to harvest sensitive credentials, including SSH keys, cloud access tokens, and Kubernetes secrets, and to establish persistent backdoors within affected systems. The compromised packages were available for approximately three hours before removal, during which they were downloaded extensively, potentially impacting thousands of systems. This incident underscores the escalating threat posed by supply chain attacks, particularly those targeting widely adopted open-source tools integral to AI and cloud infrastructures. The rapid propagation and depth of access achieved by TeamPCP highlight the critical need for organizations to implement stringent security measures within their software development pipelines and to maintain vigilant monitoring of third-party dependencies.
3 months ago
Kill Chain
North Korean Hackers Leverage GitHub for Command-and-Control in South Korean Cyberattacks
In April 2026, cybersecurity researchers identified a sophisticated cyberattack campaign attributed to North Korean state-sponsored actors targeting organizations in South Korea. The attackers employed obfuscated Windows shortcut (LNK) files distributed via phishing emails to initiate the infection chain. Upon execution, these LNK files deployed decoy PDF documents to distract victims while simultaneously executing malicious PowerShell scripts in the background. These scripts performed environment checks to evade analysis tools and established persistence through scheduled tasks. Notably, the attackers utilized GitHub as command-and-control (C2) infrastructure, exfiltrating system information and retrieving additional payloads from private repositories, thereby blending malicious traffic with legitimate network activity. ([thehackernews.com](https://thehackernews.com/2026/04/dprk-linked-hackers-use-github-as-c2-in.html?utm_source=openai)) This incident underscores a growing trend among threat actors to exploit trusted platforms like GitHub for C2 operations, enhancing their ability to evade detection. The use of native Windows tools and legitimate services in these attacks highlights the necessity for organizations to implement robust monitoring and anomaly detection systems to identify and mitigate such sophisticated threats.
3 months ago
Kill Chain
UAT-10608's Exploitation of React2Shell: A Wake-Up Call for Cybersecurity
In early April 2026, a threat cluster identified as UAT-10608 launched a global credential theft campaign targeting public-facing Next.js applications vulnerable to the React2Shell flaw (CVE-2025-55182). Exploiting this pre-authentication remote code execution vulnerability, attackers deployed an automated tool named 'NEXUS Listener' to exfiltrate credentials, SSH keys, cloud tokens, and environment secrets from compromised systems. This campaign resulted in the compromise of at least 766 hosts across multiple industries and geographic regions. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/automated-credential-harvesting-campaign-react2shell?utm_source=openai)) The React2Shell vulnerability, disclosed in December 2025, allows unauthenticated attackers to execute arbitrary code on servers running vulnerable versions of React Server Components. Despite the availability of patches, many organizations have yet to update their systems, leaving them susceptible to such attacks. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/?msockid=3159dd8396d16eca0085cb7697616f99&utm_source=openai))
3 months ago
Kill Chain
Phishing Campaigns Exploit Open Redirects in 2026
In early 2026, multiple phishing campaigns exploited open redirect vulnerabilities in trusted domains to deceive users into visiting malicious websites. Attackers crafted URLs that appeared legitimate by leveraging open redirects in services like Google Meet and Microsoft OAuth, effectively bypassing traditional email and browser security measures. This technique led to increased instances of credential theft and malware distribution, particularly targeting government and public-sector organizations. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/02/oauth-redirection-abuse-enables-phishing-malware-delivery/?utm_source=openai)) The prevalence of these attacks underscores the critical need for organizations to identify and remediate open redirect vulnerabilities within their web applications. As threat actors continue to refine their methods, maintaining robust security protocols and user awareness is essential to mitigate the risks associated with such sophisticated phishing tactics.
3 months ago
Kill Chain
React2Shell 2025: Credential Theft Campaign Exploiting CVE-2025-55182
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed, affecting React Server Components in versions 19.0.0 through 19.2.0. This flaw allowed unauthenticated remote code execution, enabling attackers to execute arbitrary JavaScript code on vulnerable servers. Exploiting this vulnerability, threat actors initiated a large-scale campaign targeting Next.js applications, compromising at least 766 hosts across various cloud providers. The attackers utilized an automated framework named NEXUS Listener to harvest sensitive data, including database credentials, SSH private keys, API keys, cloud tokens, and environment secrets. The operation was attributed to a threat cluster tracked as UAT-10608. ([articles.uvnetware.com](https://articles.uvnetware.com/news/react2shell-cve-2025-55182/?utm_source=openai)) The React2Shell incident underscores the critical importance of promptly addressing server-side vulnerabilities in widely used frameworks. The rapid exploitation by sophisticated threat actors highlights the need for organizations to implement robust security measures, including timely patching, comprehensive monitoring, and adherence to secure coding practices to mitigate the risk of similar attacks.
3 months ago
Kill Chain
36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants
In April 2026, cybersecurity researchers identified 36 malicious npm packages masquerading as Strapi CMS plugins. These packages exploited Redis and PostgreSQL databases to deploy reverse shells, harvest credentials, and establish persistent implants. The malicious code was embedded within the postinstall script hook, executing upon installation without user interaction, thereby compromising systems with root access in CI/CD environments and Docker containers. The attackers utilized various payloads, including remote code execution via Redis, Docker container escapes, and credential harvesting, indicating a sophisticated and evolving threat. This incident underscores the escalating risks associated with software supply chain attacks, particularly within open-source ecosystems. The attackers' ability to infiltrate widely-used package repositories highlights the urgent need for enhanced security measures in software development pipelines. Organizations are advised to audit their dependencies, implement strict access controls, and monitor for anomalous activities to mitigate such threats.
3 months ago
Kill Chain
Drift Protocol's $285 Million Loss: A Wake-Up Call for Crypto Security
On April 1, 2026, Drift Protocol, a Solana-based decentralized exchange, suffered a significant security breach resulting in the theft of approximately $285 million in various cryptocurrencies. The attackers employed a sophisticated social engineering campaign over six months, culminating in the compromise of administrative controls through the exploitation of durable nonces. This allowed them to manipulate governance mechanisms and execute unauthorized transactions, leading to substantial financial losses and operational disruption for Drift Protocol. This incident underscores the escalating threat posed by state-sponsored cyber actors, particularly those from the Democratic People's Republic of Korea (DPRK), who have increasingly targeted the cryptocurrency sector to fund national programs. The attack highlights the critical need for robust operational security measures, including stringent access controls and vigilant monitoring of administrative activities, to mitigate the risks associated with social engineering and insider threats.
3 months ago
Kill Chain
LinkedIn's 2026 Browser Extension Scanning: A Privacy Wake-Up Call
In April 2026, reports emerged that LinkedIn was injecting hidden JavaScript into user sessions to scan for over 6,000 installed Chrome extensions and collect detailed device data. This practice, termed 'BrowserGate,' raised significant privacy concerns as it linked extension data to identifiable user profiles, potentially exposing sensitive personal and corporate information. LinkedIn acknowledged the scanning but stated it was intended to detect extensions that violate their terms of service by scraping data without consent. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/linkedin-secretly-scans-for-6-000-plus-chrome-extensions-collects-data/?utm_source=openai)) This incident underscores the growing scrutiny over corporate data collection practices and the balance between platform security and user privacy. It highlights the need for transparency in how user data is gathered and utilized, especially as similar fingerprinting techniques have been employed by other companies in the past. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/linkedin-secretly-scans-for-6-000-plus-chrome-extensions-collects-data/?utm_source=openai))
3 months ago
Kill Chain
Drift Protocol's $280 Million Loss: A Case Study in Advanced Cyber Attacks
In April 2026, Drift Protocol, a decentralized finance platform on the Solana blockchain, suffered a significant security breach resulting in the loss of approximately $280 million. The attackers employed a sophisticated strategy involving durable nonce accounts and pre-signed transactions to gain unauthorized administrative control over Drift's Security Council. This method allowed them to execute malicious transactions at a predetermined time, effectively transferring control and draining funds from the platform. Notably, the breach did not exploit any vulnerabilities in Drift's smart contracts or programs, and no seed phrases were compromised. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/drift-loses-280-million-north-korean-hackers-seize-security-council-powers/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals targeting the cryptocurrency sector, particularly the use of social engineering and advanced transaction manipulation techniques. The attribution to North Korean state-sponsored actors highlights the persistent threat posed by nation-state cyber operations in the digital asset space. Organizations must remain vigilant and enhance their security protocols to mitigate such sophisticated attacks.
3 months ago
Kill Chain
European Commission's 2026 Supply-Chain Breach: A Wake-Up Call for Cybersecurity
In March 2026, the European Commission's cloud infrastructure hosting the Europa.eu platform was compromised through a supply-chain attack orchestrated by the cybercriminal group TeamPCP. The attackers exploited a vulnerability in the Trivy security tool to gain unauthorized access to the Commission's Amazon Web Services (AWS) environment. This breach led to the exfiltration of approximately 92 GB of compressed data, including personal information such as names, email addresses, and email content. Subsequently, the data extortion group ShinyHunters published the stolen data on their dark web leak site. The incident affected not only the European Commission but also at least 29 other Union entities utilizing the Europa.eu web hosting service. ([cert.europa.eu](https://cert.europa.eu/blog/european-commission-cloud-breach-trivy-supply-chain?utm_source=openai)) This breach underscores the escalating threat posed by supply-chain attacks, where vulnerabilities in third-party tools can serve as entry points for malicious actors. Organizations must enhance their cybersecurity measures, particularly in monitoring and securing their software supply chains, to mitigate such risks.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports