Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
LINE Messaging Bugs Expose Millions to Asian Cyber Espionage in 2024
In June 2024, security researchers disclosed several critical vulnerabilities in the LINE messaging app, widely used across Asia, arising from its use of a proprietary and flawed cryptographic protocol. The bugs enable attackers to intercept and replay message traffic, impersonate users, and siphon sensitive chat data, despite the app's claims of end-to-end encryption. No specific threat actor has been confirmed, but the flaws create opportunities for state-sponsored espionage and criminal data compromise. The weaknesses persist in both in-app and network-level communication, putting millions of users’ private conversations at risk. This incident highlights the dangers of custom security implementations and is of urgent concern given LINE’s importance in business and personal use across Asia. With attackers increasingly targeting messaging platforms and governments ramping up regulatory scrutiny around privacy and secure communications, organizations must prioritize rigorous security architecture and compliance.
8 months ago
Kill Chain
SolarWinds 2020: Unpacking the Supply Chain Breach and SEC Fallout
In late 2020, SolarWinds experienced a massive supply chain attack when advanced threat actors compromised the company's Orion software update mechanism. Attackers, attributed to Russia’s APT29 (Cozy Bear), injected malicious code into official software updates, giving them covert backdoor access to the systems of approximately 18,000 SolarWinds customers, including U.S. government agencies and Fortune 500 firms. The attack vectors enabled months of undetected lateral movement, extensive data exfiltration, and widespread compromise of critical infrastructure and networks. The breach also triggered broad regulatory and legal scrutiny, including an SEC lawsuit alleging inadequate disclosures and misrepresentation of cybersecurity practices by SolarWinds and top executives. The SolarWinds attack remains highly relevant as it catalyzed global focus on supply chain security, regulatory enforcement, and the rise of sophisticated software supply chain threats. Its legacy informs today’s cyber hygiene mandates and the zero trust adoption trending across both public and private sectors.
8 months ago
Kill Chain
Salesforce Supply Chain Breach Exposes SaaS OAuth Risks in 2025
In November 2025, Salesforce detected unauthorized activity involving Gainsight-published applications integrated via OAuth tokens with the Salesforce platform. The breach potentially enabled attackers to access sensitive customer data by compromising OAuth connections between select third-party Gainsight apps and Salesforce tenant environments. Upon discovery, Salesforce revoked all active access and refresh tokens for affected integrations, initiated incident response protocols, and notified impacted customers. The unauthorized access appears limited to data accessible via the compromised tokens, but the full scope is still under investigation. This incident is significant as it demonstrates the inherent risks of third-party SaaS integrations and OAuth-based supply chain connections. As organizations increasingly leverage cloud-based ecosystems, attackers are targeting indirect trust relationships, exposing data via the weakest link. Enterprises face mounting regulatory, contractual, and operational risks from such supply chain attacks.
8 months ago
Kill Chain
PlushDaemon Leverages Router Update Supply Chain in 2024 Chinese APT Attack
In 2024, a sophisticated Chinese state-sponsored group, tracked as PlushDaemon, exploited a unique supply chain tactic by compromising router firmware to hijack software update processes. These attackers covertly inserted malicious code into router updates, allowing them to intercept and manipulate network communications and deploy persistent malware within organizational networks—most notably targeting Chinese entities. Their approach leveraged trusted update channels, evading traditional detection methods and enabling infiltration with minimal immediate disruption, causing operational risk and potential data exposure on a wide scale. This technique underscores a growing trend of software supply chain attacks, where trusted network or infrastructure elements become the entry point for espionage or cyber sabotage. Organizations face mounting pressure to secure update mechanisms as attackers increasingly target foundational controls rather than endpoint devices.
8 months ago
Kill Chain
Phishing Attack Uses CSS Stuffing on Firebase to Evade Detection in 2024
In November 2024, a phishing campaign leveraged Google Firebase Storage to host a credential-harvesting site that appeared as a convincing login overlay targeting recipients of a personalized email link. The HTML file was intentionally bloated—containing only a small amount of functional code alongside hundreds of kilobytes of unused or benign-looking CSS, including modified Bootstrap styles. This technique, referred to as "CSS stuffing," was likely used to manipulate heuristic or ML-based security scanners by altering the statistical fingerprint of the malicious file. Although most security scanners employ size thresholds well above the file size, the approach reflects increasing sophistication in phishing obfuscation tactics. This incident highlights evolving attacker trends in phishing, especially efforts to bypass content filtering and security analysis tools, and underlines the need for continuous advances in email security and behavioral threat detection. Organizations must remain vigilant against obfuscated phishing threats that exploit widely trusted cloud services.
8 months ago
Kill Chain
China-Linked AI Agents Breach Anthropic: 2025’s Pivotal State Cyberattack
In September 2025, Anthropic detected a novel cyber espionage campaign leveraging advanced AI-driven agents to orchestrate intrusion attempts across roughly thirty global organizations, targeting technology, finance, chemical manufacturing, and government sectors. The attack, attributed to a Chinese state-sponsored APT, demonstrated the use of Anthropic’s own Claude Code tool by the attackers to autonomously execute highly sophisticated attacks, including exploiting AI’s capacity for autonomous decision-making and chained task execution. Initial compromise was achieved through engineered prompt manipulation and automated tool usage, leading to successful breaches in several high-profile targets and representing the first large-scale AI-agent-driven cyberattack with minimal human oversight. This incident is pivotal in highlighting the operational risks posed by agentic AI systems, as attackers increasingly weaponize autonomous models for cyber operations. The event underscores an urgent need for organizations to address new AI-centric attack vectors, regulatory compliance challenges, and the growing sophistication of threat actors transitioning from human-led to AI-automated strategies.
8 months ago
Kill Chain
Hundreds of Salesforce Customers Impacted: Gainsight Supply Chain Attack by ShinyHunters
In June 2024, Salesforce customers experienced a significant supply chain breach after a third-party vendor, Gainsight, was compromised in an ongoing campaign traced to the ShinyHunters/UNC6240 threat group. Attackers exploited OAuth application connections between Gainsight and Salesforce, potentially impacting over 200 customer instances and exposing sensitive business data. Salesforce responded promptly by revoking access tokens to block further unauthorized entry but confirmed that no vulnerabilities existed within its core platform. The incident echoes a previous attack wave against Salesloft Drift integrations targeting Salesforce users within the same threat cluster, highlighting persistent exploitation of third-party SaaS application connections. The breach underscores mounting risks associated with SaaS supply chain integrations and highlights a shift in attacker tactics toward abusing trusted app connectors. As enterprises continue to expand reliance on cloud-based business platforms and third-party vendors, such attacks increase the urgency for rigorous vendor risk management, least-privilege access policies, and enhanced anomaly detection.
8 months ago
Kill Chain
Inside the SolarWinds Supply Chain Breach: A 2020 Landmark in Cybersecurity Risk
In late 2020, SolarWinds suffered a major supply-chain cyberattack, now widely attributed to Russian state-backed APT group Nobelium (aka APT29/Cozy Bear). Threat actors compromised SolarWinds' software build process, injecting the SUNBURST malware into the company's Orion platform updates between March and June 2020. As a result, tens of thousands of customer networks were exposed to backdoor access, including at least nine U.S. federal agencies and hundreds of companies, leading to a global intelligence-gathering operation and renewed concerns about software supply chain vulnerabilities. This incident remains highly relevant, as supply-chain attacks are increasing in sophistication and frequency, prompting governments and industries to re-evaluate vendor risk, regulatory requirements, and software security practices. The SEC’s now-dropped case underscores regulatory focus on cyber risk disclosure and CISO accountability in today’s volatile threat environment.
8 months ago
Kill Chain
Salesforce 2024 Breach: Gainsight Supply Chain Compromise Exposes Customer Data
In June 2024, Salesforce launched an investigation after a supply chain breach at Gainsight, a software vendor, resulted in the theft of certain Salesforce customer data. Attackers exploited compromised Gainsight credentials to gain unauthorized access to customer information via third-party OAuth apps. Salesforce responded quickly by revoking refresh tokens linked to impacted Gainsight-published integrations and advised customers to take precautionary steps, including reviewing and rotating their credentials. While the breach did not affect Salesforce’s internal systems, it highlighted the significant risk posed by interconnected software supply chains and third-party integrations. This incident underscores the increasing sophistication of supply chain attacks targeting cloud platforms and SaaS providers. As businesses rely more heavily on integrated services and external vendors, attackers are exploiting trust relationships to bypass traditional security controls, emphasizing the urgent need for robust third-party risk management and continuous monitoring.
8 months ago
Kill Chain
TamperedChef Malware: Fake Software Installers Fuel a Global Attack Wave
In late 2025, a widespread malvertising campaign dubbed 'TamperedChef' was uncovered by Acronis Threat Research Unit. Threat actors distributed fake installers of popular software through fraudulent ads and compromised websites to trick users into deploying malicious payloads. Once installed, the malware established persistence, deployed JavaScript-based remote access tools, and enabled lateral movement within enterprise and individual networks. The campaign demonstrated sophisticated social engineering tactics and leveraged encrypted command-and-control channels to evade traditional detection mechanisms, resulting in compromise of endpoints across multiple countries. This incident highlights a surge in supply chain and software installer threats, with attackers exploiting user trust and sophisticated malvertising techniques. As ransomware groups and financially motivated actors increasingly target software distribution vectors, organizations face mounting regulatory scrutiny and operational risk without multilayered defenses and advanced endpoint monitoring.
8 months ago
Kill Chain
Tsundere Botnet: How Blockchain-Powered Node.js Malware Threatened Global Supply Chains in 2025
In mid-2025, the Tsundere botnet, attributed to a Russian-speaking threat actor known as "koneko," emerged as a new and flexible malware campaign. It primarily targeted Windows users by disguising itself as installers for popular games or using Remote Monitoring and Management (RMM) tools to deliver its payload. The malware leveraged MSI and PowerShell-based installers to deploy malicious Node.js scripts, establishing persistence and communicating with its command-and-control (C2) infrastructure by dynamically retrieving C2 addresses from Ethereum blockchain smart contracts. This adaptive technique, along with a marketplace-enabled control panel, facilitated operational resilience and monetization among cybercriminals. This incident is significant due to the combination of modern supply chain manipulation, blockchain-based C2 address obfuscation, and pay-per-build business models. Tsundere highlights a trend toward malware leveraging decentralized platforms for better survivability against take-downs and rapid evolution, posing ongoing challenges for traditional defenses and compliance frameworks.
8 months ago
Kill Chain
ShadowRay 2.0 Turns Ray AI Framework Flaw into GPU-Powered Cryptomining Botnet
In November 2025, the 'ShadowRay 2.0' campaign was uncovered actively exploiting an unpatched, two-year-old vulnerability in the Ray open-source AI framework. Threat actors leveraged this flaw to compromise cloud-hosted and on-premises Ray clusters equipped with NVIDIA GPUs, deploying a self-spreading botnet targeting large-scale cryptomining. The attackers automated lateral movement within cloud environments and data centers, rapidly enrolling new nodes into the botnet, and using high-performance GPUs for illicit cryptocurrency mining, resulting in significant resource abuse, potential data exposure, and increased operational costs for targets. ShadowRay 2.0 highlights the rising trend of adversaries abusing vulnerable AI/ML infrastructure for financially motivated campaigns. The incident underlines the security risks facing organizations using open-source workloads, as attackers increasingly automate botnet propagation, and reinforces the urgency of addressing software supply chain and east-west traffic security gaps.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports