Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
WordPress Mass Exploitation 2024: The Risks of Outdated Plugin Vulnerabilities
In June 2024, a mass exploitation campaign targeted thousands of WordPress websites worldwide by abusing known critical vulnerabilities in the GutenKit and Hunk Companion plugins. Attackers leveraged outdated versions lacking essential security patches to achieve remote code execution (RCE), enabling full control over affected sites. The campaign's automated exploits installed malicious payloads, manipulated website content, and frequently enabled further lateral movement or data theft. Organizations relying on vulnerable plugins faced significant reputational and operational disruption, with site defacements, malware delivery, and potential customer data exposure as key impacts. The incident highlights the persistent security challenge posed by unpatched plugins in popular web platforms. Amid a surge in mass web exploitation and supply chain attacks against CMS ecosystems, adversaries are rapidly weaponizing public proof-of-concept exploits, putting organizations at immediate risk from even dated vulnerabilities.
8 months ago
Kill Chain
GlassWorm Worm Spreads via VS Code Extensions in Massive 2025 Supply Chain Attack
In October 2025, cybersecurity researchers uncovered a major supply chain attack involving a self-spreading worm dubbed 'GlassWorm' that compromised Visual Studio Code (VS Code) extensions distributed via the Open VSX Registry and Microsoft Extension Marketplace. The threat actors leveraged malicious extensions to automatically propagate the worm among developer environments, enabling it to execute unauthorized code, exfiltrate credentials, and embed backdoors in developer toolchains. This incident resulted in widespread risk to organizations whose software supply chains depend on the integrity of these popular extension repositories, forcing rapid incident response across the global developer community. The GlassWorm incident highlights the escalating targeting of developers and DevOps pipelines by sophisticated cyber adversaries. As attackers evolve to exploit trust relationships in software ecosystems, organizations must strengthen supply chain security controls and increase vigilance around third-party code dependencies.
8 months ago
Kill Chain
North Korea’s Lazarus Group Breaches Drone Developers in 2023 Cyber-Espionage Campaign
In March 2023, the Lazarus Group—an advanced persistent threat attributed to North Korea—successfully targeted three European companies in the defense sector involved in drone development. Leveraging Operation DreamJob, the attackers used social engineering tactics, including fraudulent job offers and a trojanized PDF reader, to gain initial access via phishing emails. The deployment of the ScoringMathTea remote access trojan enabled complete control over compromised systems, potentially allowing sensitive data exfiltration related to unmanned aerial vehicle (UAV) technology and manufacturing know-how. ESET researchers linked the attack to ongoing North Korean efforts to bolster domestic drone capabilities and noted the victims' support of military deployments in Ukraine. The incident exemplifies the persistent and adaptive nature of sophisticated state-linked cyber-espionage campaigns targeting high-value defense technologies. As strategic competition and armed conflicts persist, such tactics have become more prevalent against organizations with intellectual property critical to national security.
8 months ago
Kill Chain
Atlas & Comet AI Sidebar Spoofing: How Attackers Are Hijacking Trust in Browser AI
In early June 2024, security researchers identified a novel application security vulnerability affecting OpenAI’s Atlas and Perplexity’s Comet browsers. Attackers leveraged spoofed AI sidebars to present malicious, AI-generated instructions that duped users into actions compromising security, such as running unverified commands or visiting phishing sites. The attack method bypassed traditional endpoint defenses by exploiting inherent trust in AI-powered browser features. Though no widespread exploitation has been confirmed, proof-of-concept demonstrations exposed a significant risk of credential theft, data leakage, or lateral movement within enterprise environments. The rapid adoption of AI assistants made this vector both timely and dangerous. This incident highlights the growing trend of attackers targeting AI-powered productivity tools by manipulating contextual interfaces. Rising adoption of AI chatbots and browser plugins increases the threat surface, demanding urgent reevaluation of security controls and staff awareness. Regulatory scrutiny of AI and application security is expected to accelerate in response.
8 months ago
Kill Chain
North Korean APTs Breach UAV Defense Firms Using Fake Job Offers (2025)
In October 2025, multiple European defense contractors specializing in unmanned aerial vehicles (UAVs) were targeted by a sophisticated cyber-espionage campaign attributed to North Korean threat actors, commonly known as Lazarus Group. The attackers masqueraded as recruiters and leveraged convincing fake job offers to defense engineers using social networks and spear-phishing emails, ultimately delivering malicious payloads that provided remote access to corporate networks. The primary objective was to exfiltrate proprietary drone technology and sensitive internal communications, resulting in significant intellectual property theft and exposure of confidential project details. This incident illustrates a persistent trend where state-sponsored actors target the defense sector’s engineers with social engineering tactics, reflecting a broader escalation in advanced persistent threat (APT) campaigns leveraging human-centric attack vectors. Organizations face mounting regulatory scrutiny and must enhance security controls to combat these evolving social-engineering-enabled threats.
8 months ago
Kill Chain
It Only Takes 250 Documents to Poison Any Large Language Model – Security Implications for 2024
In 2024, cybersecurity researchers demonstrated that the integrity of large language models (LLMs) can be severely compromised with as few as 250 poisoned documents strategically inserted into their training data. By covertly introducing manipulated or malicious content into public data sources, attackers can alter a model’s understanding, bias its outputs, or degrade its reliability. This proof-of-concept highlights that ‘data poisoning’ attacks require minimal input yet pose substantial risk for AI reliability, potentially opening the door for misinformation, backdoors, or loss of operational trust across industries leveraging AI. Organizations relying on LLMs for critical tasks face a heightened threat of silent, hard-to-detect breaches affecting their core AI deployments. The urgency around AI/ML supply chain security has intensified, as threat actors and researchers increasingly explore the feasibility of data poisoning. Regulatory frameworks and industry best practices now emphasize the need for data provenance controls and continuous integrity monitoring of training pipelines.
8 months ago
Kill Chain
TARmageddon: Rust async-tar Supply Chain Flaw Leads to Critical RCE Risk
In June 2024, security researchers disclosed a critical vulnerability known as 'TARmageddon' in the abandoned Rust async-tar library and its forks. Attackers can exploit the flaw to achieve remote code execution (RCE) on systems using unpatched versions of the library, commonly found in developer tools and backend infrastructure. As async-tar remains unmaintained, organizations relying on affected forks or software inherit the vulnerability, potentially allowing initial compromise and lateral movement within supply chains. The flaw highlights the cascading risks of dependencies on abandoned open-source components, increasing the likelihood of stealthy supply-chain attacks bypassing traditional controls. This incident underscores a growing trend of adversaries targeting open-source software supply chains, particularly by exploiting abandoned or under-maintained libraries. The complexity and opacity of modern dependency trees, alongside escalations in software bill of materials (SBOM) scrutiny, make proactive vulnerability management and real-time supply-chain threat detection essential for reducing risk.
8 months ago
Kill Chain
Pwn2Own Ireland 2025: 56 Zero-Day Vulnerabilities Exposed in One Day
In May 2025, security researchers at the Pwn2Own Ireland contest successfully exploited 56 previously unknown zero-day vulnerabilities across a broad range of consumer and enterprise devices—including the latest Samsung Galaxy S25 smartphone—over the course of a single day, earning nearly $793,000 in rewards. Participants used advanced exploitation chains targeting device software, firmware, and novel attack surfaces to gain remote code execution and bypass layered security controls. The demonstration of these critical flaws underlined the sophistication of contemporary offensive security techniques and the persistent risk posed by undiscovered vulnerabilities in modern technology stacks. Vendors were immediately notified, but the affected products are widely used globally. This incident exemplifies the accelerating pace and scale at which new vulnerabilities are uncovered, often by highly skilled researchers using techniques similar to those seen in active threat landscapes. Organizations are facing increased regulatory pressure to address zero-day risks and are urged to respond rapidly to vendor advisories and emerging disclosures.
8 months ago
Kill Chain
TARmageddon: Remote Code Execution Risk in Popular Async-Tar Rust Library Uncovered (2025)
In late August 2025, researchers uncovered TARmageddon (CVE-2025-62518), a high-severity supply-chain vulnerability in the async-tar Rust library and its forks, including tokio-tar. This flaw could permit remote code execution (RCE) when processing maliciously-crafted tar archives, posing a significant risk to downstream applications and platforms relying on these libraries for file extraction and archive handling. Successful exploitation opens the door to system compromise, data loss, or service interruption for potentially thousands of applications leveraging async-tar in production workloads. This incident highlights the growing threat of software supply-chain vulnerabilities, especially within open-source dependencies widely adopted across cloud-native and DevSecOps environments. Organizations must closely monitor dependencies, establish strong vulnerability management pipelines, and rapidly respond to disclosures as attackers increasingly target the software supply chain.
8 months ago
Kill Chain
Fake Nethereum NuGet Package Exploited Homoglyph Trick in 2025 Supply Chain Attack
In October 2025, cybersecurity experts identified a sophisticated supply chain attack wherein a malicious NuGet package, imitating the popular Nethereum library using a homoglyph trick, was uploaded to compromise .NET developers. The attacker distributed a typosquatted package ('Netherеum.All') containing encoded command-and-control (C2) communication that secretly harvested and exfiltrated sensitive cryptocurrency wallet credentials—including private keys and mnemonic phrases—from unsuspecting developers’ systems. The campaign demonstrates a heightened level of precision in leveraging open-source repositories for credential theft, with potential widespread financial impacts for organizations developing blockchain solutions. This incident exemplifies the rapidly increasing risk posed by supply chain attacks exploiting trusted software ecosystems. It highlights both a surge in homoglyph-based typosquatting and a broader trend of targeting cryptocurrency assets via development toolchains—emphasizing the need for robust code provenance controls and package vetting.
8 months ago
Kill Chain
How a Vulnerable AI Plugin in Figma MCP Opened the Door for Remote Code Attacks
In early 2025, a critical vulnerability (CVE-2025-53967) was discovered in a third-party connector integrating agentic AI capabilities with Figma’s Multi-Cloud Platform (MCP) server. This supply-chain flaw enabled remote code execution (RCE), allowing attackers to exploit the connection to infiltrate organizational environments using the affected plugin. Threat actors leveraged the unsanctioned plugin to gain unauthorized access to internal systems, potentially exposing sensitive design data, intellectual property, and user information. The compromise highlighted risks associated with insufficient east-west security controls, lack of zero trust segmentation, and inadequate traffic visibility, ultimately impacting business continuity and trust in the collaboration platform. This incident exemplifies the growing threat of supply-chain vulnerabilities targeting enterprise SaaS applications, amid increasing adoption of AI integrations. Organizations are re-evaluating their third-party risk, agentic AI governance, and internal segmentation postures as regulatory scrutiny and attacker sophistication intensify.
8 months ago
Kill Chain
Red Hat Consulting Breach 2024: Crimson Collective Launches Major Supply Chain Attack
In April 2024, the Crimson Collective, in collaboration with elements of the Lapsus$ group, executed a supply chain attack targeting Red Hat Consulting by breaching its GitLab instance. The attackers gained unauthorized access through credential compromise and lateral movement across internal infrastructure, successfully exfiltrating sensitive source code and internal communications. The breach, which remained undetected for several days, raised concerns over east-west traffic security, lack of segmentation, and insufficient anomaly detection within Red Hat Consulting’s cloud development supply chain. This incident highlights the increasing prevalence of supply chain attacks leveraging lateral movement and sophisticated alliance between threat groups. Its relevance is underscored by renewed regulatory scrutiny, the growing risk posed by collaborative cybercriminal operations, and heightened demand for zero trust architecture and cloud-native threat mitigation strategies.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports