Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Tsundere Botnet: How Blockchain-Powered C2 Supercharged Windows-Based Attacks in 2025
In mid-2025, researchers identified a rapidly expanding botnet dubbed "Tsundere" specifically targeting Windows users. This malware, active since at least June 2025, leverages game-themed lures to infect systems, enabling attackers to execute arbitrary JavaScript code via a sophisticated command-and-control (C2) infrastructure built on the Ethereum blockchain for resilient communications. Tsundere’s propagation tactics remain opaque, but evidence indicates an advanced, multi-functional platform designed to maintain persistence, evade detection, and potentially facilitate lateral movement within victim networks. The business impact includes increased exposure to data theft, possible ransomware deployment, and widespread compromise of user endpoints. The Tsundere botnet exemplifies the rising trend of attackers exploiting blockchain technology for C2 communications, making conventional takedown efforts far more difficult. This incident underscores the urgency for organizations to enhance east-west threat visibility, strengthen endpoint defenses, and adopt zero-trust policies as botnets grow more evasive and robust.
8 months ago
Kill Chain
AI Agents: The New Attack Surface for Network Compromise in 2024
In early 2024, cybersecurity researchers highlighted a critical weakness in agentic AI systems, demonstrating that malicious actors can subvert autonomous AI agents to alter behavior and compromise entire enterprise networks. By leveraging AI agent hijacking, attackers manipulated goal-seeking models and agent-to-agent communications to bypass security controls, escalate privileges, and move laterally within high-value environments. The incident revealed how the expanding AI/ML attack surface introduces new entry vectors tied to agent autonomy, cloud AI orchestration, and internal east-west traffic, posing operational risk to organizations deploying intelligent automation at scale. This incident underscores the urgent need for AI security frameworks and robust segmentation controls as enterprises accelerate agent and copilot deployments. With rapid adoption of agentic AI, attackers are increasingly exploiting flaws in agent autonomy and communication to orchestrate sophisticated attacks, raising the bar for zero trust and security visibility in multi-cloud environments.
8 months ago
Kill Chain
PlushDaemon Supply Chain Breach: How Integrity Controls Failed in the 2024 Update Hijack
In early 2024, the China-aligned 'PlushDaemon' advanced persistent threat leveraged software update channels in supply-chain environments to deliver malicious payloads. Attackers infiltrated legitimate update infrastructure, intercepting and modifying update traffic destined for victim organizations across multiple sectors. The campaign enabled remote code execution, deployment of backdoors, and potential data exfiltration by masquerading malicious code as legitimate updates, significantly increasing evasion capabilities and operational impact. Victims discovered the compromise after anomalous network activity and unauthorized privilege escalations were observed within internal systems. This attack highlights a growing trend of sophisticated supply-chain compromises, demonstrating an escalation in targeting trusted dependencies to bypass traditional perimeter defenses. As threat actors expand their tactics and exploit trusted communications, organizations face heightened urgency to enforce software integrity, robust network segmentation, and end-to-end traffic inspection.
8 months ago
Kill Chain
Critical W3 Total Cache Plugin Vulnerability Enables PHP Command Injection on WordPress Sites
In June 2024, a critical security vulnerability was disclosed in the W3 Total Cache WordPress plugin, which is widely used to optimize website performance. Attackers could exploit this flaw by submitting a specially crafted comment to a vulnerable website, enabling them to execute arbitrary PHP commands on the underlying server. This vulnerability, involving insufficient sanitization and validation within comment processing, exposes affected websites to full compromise, including unauthorized data access, web defacement, and further lateral movement inside hosting environments. Immediate patching is required as active exploitation has been observed in the wild. This incident underscores the persistent risk of supply chain attacks and plugin vulnerabilities in content management systems like WordPress. As attackers increasingly target high-profile plugins to gain initial access, maintaining up-to-date software and implementing robust security controls has never been more critical.
8 months ago
Kill Chain
EdgeStepper: PlushDaemon’s DNS Hijack Shakes Supply Chain Trust
In late 2025, the threat actor PlushDaemon leveraged a custom Go-based implant named EdgeStepper to facilitate a sophisticated supply chain attack targeting organizations relying on automated software updates. By hijacking DNS queries via EdgeStepper, attackers rerouted legitimate update traffic to attacker-controlled infrastructure, covertly delivering malware payloads. This adversary-in-the-middle campaign exploited a weakness in outbound traffic validation and DNS trust, leading to silent compromise of enterprise endpoints through poisoned software update mechanisms. The incident resulted in widespread concerns over supply chain integrity and exposed gaps in security monitoring of encrypted or internal network flows. This incident highlights the growing trend of adversaries exploiting DNS and software supply chains as primary attack vectors. With regulatory and industry focus tightening on secure update mechanisms and zero trust, similar AitM tactics are escalating in both frequency and sophistication, requiring renewed urgency for organizations to enhance detection at the DNS and network boundary layers.
8 months ago
Kill Chain
Unicode: The Hidden Security Threat Fueling 2024's Obfuscated Code Attacks
In late 2024, security researchers highlighted a series of application security vulnerabilities caused by improper handling of the Unicode character set, impacting numerous platforms and development environments. Attackers exploited Unicode features such as confusable characters, variant selectors, and bidirectional text markers, enabling impersonation, injection, and severe obfuscation of code in public repositories. Notably, a self-propagating worm known as "Glass Worm" leveraged invisible Unicode code points to disguise malicious code in Visual Studio Code extensions, bypassing manual code review and automated security checks. These techniques led to increased risk of code injection, credential spoofing, and long-term compromise of software supply chains. Unicode-driven attack techniques continue to gain prominence due to their effectiveness at evading human and automated detection. The recent spike in attacks demonstrates a broader trend towards supply chain risk and advanced code obfuscation, demanding urgent attention to Unicode normalization, secure coding practices, and robust detection mechanisms in compliance-driven industries.
8 months ago
Kill Chain
Malicious NPM Packages Exploit Adspect in 2024 Supply Chain Breach
In June 2024, security researchers uncovered a supply chain attack involving seven malicious packages on the NPM registry that abused the Adspect cloud-based service. Attackers used these packages to redirect users through Adspect, circumventing many security sandboxes and researcher analysis tools. This sophisticated evasion allowed threat actors to selectively route potential victims to malicious payloads while deflecting scrutiny from security firms. The malicious packages were rapidly removed from NPM, but not before posing a significant risk to open-source software supply chains. This incident highlights the increasing exploitation of trusted third-party platforms and infrastructure in software supply chain attacks. With adversaries leveraging evasive redirects and advanced obfuscation tactics, organizations face a growing need for robust dependency management, automated threat detection, and enhanced monitoring of public code repositories.
8 months ago
Kill Chain
Hackers Exploit Ray AI to Launch Global Cryptojacking Botnet (2024)
In late 2024, malicious actors exploited an unauthenticated remote code execution vulnerability (CVE-2023-48022) in the open-source Ray AI framework, transforming exposed development environments into a globally distributed cryptojacking operation. Attackers leveraged Ray's scheduling and orchestration APIs to gain unauthorized access and deploy cryptomining payloads, particularly targeting environments with premium NVIDIA A100 GPUs. The campaign, identified by Oligo Security, unfolded in multiple phases: after initial malware delivery via GitLab infrastructure was disrupted, attackers quickly shifted to hosting on GitHub to sustain their operation. Over 200,000 exposed Ray clusters worldwide were at risk, significantly impacting cloud AI operations, startups, and research environments. This incident marks a major evolution in threat actor adaptation: rather than exploiting traditional network vulnerabilities, adversaries weaponized trusted automation features to evade detection and maximize illicit gain. The campaign illustrates mounting risks to cloud-hosted AI workloads, the dangers of insecure API exposure, and the urgent need for stringent internal network controls to defend against cryptojacking and abuse of compute resources.
8 months ago
Kill Chain
ShadowRay 2.0: How Ray Cluster Flaws Fueled a Cryptomining Botnet
In June 2024, cybersecurity researchers identified a coordinated global attack campaign dubbed ShadowRay 2.0 targeting exposed Ray clusters—open-source distributed computing environments widely used in AI and machine learning workloads. Attackers exploited an unpatched remote code execution vulnerability in Ray's dashboard service, gaining unauthorized access to cloud and on-premises clusters. Once inside, adversaries deployed self-spreading cryptomining malware, turning infected clusters into part of a large-scale botnet that harnessed high-performance compute resources for illicit cryptocurrency mining, causing potential performance degradation, elevated cloud bills, and risk of further lateral movement. This campaign demonstrates the growing threat surface posed by AI and data infrastructure, as adversaries increasingly automate the exploitation of software supply chain and configuration weaknesses. The incident highlights the urgency of securing east-west traffic, enforcing least privilege, and maintaining continuous vulnerability management in distributed and cloud-native environments.
8 months ago
Kill Chain
npm Supply-Chain Threat: Seven Malicious Packages Cloak Crypto Scams in 2025
In late 2025, cybersecurity researchers uncovered a supply-chain attack involving seven malicious npm packages uploaded by the threat actor 'dino_reborn.' These packages leveraged Adspect cloaking technology to detect if visitors were victims or security researchers. Unsuspecting users were redirected to fraudulent cryptocurrency-themed websites, exposing them to potential scams or malware. The packages were published between September and November 2025 and remained available until detection, highlighting the challenges in securing open-source ecosystems. This incident is part of a growing trend involving supply-chain attacks targeting widely used software repositories. As more attackers adopt advanced evasion measures like traffic cloaking and nuanced social engineering, the risk and complexity of defending modern development pipelines are rapidly increasing.
8 months ago
Kill Chain
Malicious npm Packages Leverage Adspect Cloaking to Fuel Crypto Supply Chain Scam (2024)
In early 2024, a sophisticated supply chain attack was uncovered involving a wave of malicious npm packages that abused Adspect cloaking techniques to avoid detection. Attackers published seemingly benign JavaScript libraries to the official npm registry. Once installed, these packages deployed malware via fake cryptocurrency-related sites, using cloaking to distinguish between legitimate victims and security researchers. The campaign allowed threat actors to evade automated scans, maximize the longevity of their malicious payloads, and target developers and end users with credential theft and crypto scams. This incident highlights the evolving threat landscape around open-source software supply chains. The use of advanced traffic cloaking and victim filtering marks a new escalation in attacker TTPs, forcing organizations to revisit how they vet third-party dependencies and monitor developer ecosystems for hidden threats.
8 months ago
Kill Chain
Dutch Police Dismantle Bulletproof Hosting Platform Backing Global Cybercrime in 2024
In May 2024, Dutch police executed a large-scale operation seizing approximately 250 servers linked to a notorious bulletproof hosting provider, long used by cybercriminals to anonymously deploy malware, phishing sites, and command-and-control infrastructure. With coordinated assistance from international partners, Dutch law enforcement dismantled the physical hosting environment and arrested several individuals believed to be operators of the service. This action disrupted ongoing criminal campaigns, significantly hindering multiple ransomware groups, credential theft operations, and other cybercrime syndicates that relied on the provider’s infrastructure to evade detection and takedown efforts worldwide. This takedown comes amid increased law enforcement focus on infrastructure-level cybercriminal enablers, highlighting a shift from targeting individual attackers to undermining the technical ecosystems that fuel large-scale cyber threats. The collapse of this hosting service may cause short-term disruption to criminal activity, but also signals growing regulatory and legal scrutiny on infrastructure managed for malicious purposes.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports