Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Inside the Largest U.S. School Data Breach: PowerSchool’s 2024 Ransomware Attack
In September 2024, PowerSchool, a leading education software provider, suffered a devastating ransomware attack orchestrated by Matthew Lane, who used compromised contractor credentials to access and exfiltrate sensitive records. Nearly 70 million student and teacher records were stolen, with the data held hostage for a $2.9 million ransom, which was ultimately paid. The breach led to subsequent extortion attempts on multiple school districts and resulted in over $14 million of financial losses and lifetime risks of identity theft for millions of affected individuals. Lane was sentenced in October 2024 to four years in prison, three years supervised release, and over $14 million in restitution. This incident highlights the urgency of addressing third-party risks, as threat actors increasingly exploit supply chain weaknesses to orchestrate high-impact ransomware attacks. Regulatory scrutiny and ransomware activity targeting the education sector continue to rise, underscoring the need for robust zero trust, lateral movement prevention, and data protection strategies.
8 months ago
Kill Chain
How Adversaries Used AI CLI Tools for Command & Control in 2024
In early 2024, security researchers identified a new wave of cyber intrusions involving adversaries weaponizing AI-enabled command-line tools to facilitate command and control activities within targeted business environments. Attackers leveraged popular AI code-assistants such as Claude Code, integrating them into CLI workflows to generate and execute malicious payloads, exfiltrate credentials, and bypass conventional security controls. The attack chain typically relied on legitimate processes, enabling lateral movement and credential theft while avoiding detection by traditional endpoint defenses. Unauthorized east-west traffic and encrypted exfiltration allowed threat actors to maintain persistence and evade standard monitoring solutions, impacting both operational continuity and sensitive business data. The incident underscores a rapidly evolving threat landscape where generative AI and shell automation converge, accelerating the sophistication and speed of adversary tactics. As enterprises adopt AI-driven DevOps and operational tooling, the risk of shadow AI and undetected rogue automation increases, compelling a shift towards advanced visibility, zero trust segmentation, and policy enforcement across hybrid environments.
8 months ago
Kill Chain
F5 2024 Breach: Nation-State Attack Highlights Supply Chain Risks
In June 2024, F5—a leading provider of application security and delivery products—disclosed a sophisticated cyberattack attributed to a nation-state actor. The breach was first discovered on August 9, 2023, and involved unauthorized, prolonged access to F5’s BIG-IP product development environment and its internal engineering knowledge platform. Although the attackers exfiltrated files containing segments of BIG-IP source code and limited customer configuration details, external forensic reviews confirmed no tampering with F5’s supply chain processes or build systems. No customer-facing platforms, including NGINX and Distributed Cloud Services, were affected, and the company found no evidence of critical vulnerabilities or malicious code insertion. This incident is particularly important due to increasing nation-state supply chain attacks targeting core infrastructure vendors. It highlights growing risks to software development environments and the potential cascade effects on enterprise and government clients dependent on widely used technologies.
8 months ago
Kill Chain
Framework’s 2025 Secure Boot Bypass: How Signed UEFI Debug Tools Created a Supply-Chain Crisis
In October 2025, firmware security researchers revealed a supply-chain vulnerability affecting nearly 200,000 Framework Linux laptops, caused by the inclusion of signed UEFI shells with the powerful 'mm' (memory modify) command. This legitimate but dangerous command, intended for hardware debugging, could be used by attackers with local or physical access to bypass Secure Boot by overwriting memory critical to the boot process—disabling signature verification and enabling the loading of bootkits like BlackLotus or HybridPetya. The issue was not the result of an external compromise but a manufacturing oversight, impacting several Framework 13 and Framework 16 models, with firmware updates and mitigation guidance swiftly issued. This vulnerability highlights a growing risk in hardware supply-chain security, where trusted vendor-signed components can inadvertently enable sophisticated attacks that persist even after OS reinstalls. As attackers increasingly target firmware and boot processes, the incident underscores the urgency for robust device-level and manufacturing-time security controls.
8 months ago
Kill Chain
Malicious VSCode Extensions: TigerJack’s 2025 Supply Chain Attack on OpenVSX
In October 2025, the threat actor known as TigerJack resurfaced with a sophisticated supply chain attack targeting developer environments by publishing malicious Visual Studio Code (VSCode) extensions to both the official marketplace and the OpenVSX registry. Despite removal from the VSCode marketplace after 17,000 downloads, the extensions remained accessible on OpenVSX and continued to proliferate through renamed and republished versions. These extensions exfiltrated source code, ran unauthorized cryptocurrency miners, and enabled arbitrary remote code execution, greatly increasing the risk to individual developers and organizations relying on open-source tools. This incident highlights a rising trend of supply chain attacks targeting developer tools and open-source ecosystems, where trust in community-maintained registries is frequently exploited. With minimal oversight and delayed response from registry maintainers, businesses face a persistent risk of compromise through their software development pipelines.
8 months ago
Kill Chain
FBI Disrupts BreachForums Data Extortion Portal Tied to Salesforce Attacks
In October 2025, the FBI, in collaboration with French authorities, seized the BreachForums portal used by the ShinyHunters and associated groups as a data leak extortion site in the wake of major Salesforce data theft attacks. The cybercriminals, operating as Scattered Lapsus$ Hunters, leveraged the platform to pressure prominent organizations—including FedEx, Disney, Google, and others—by threatening to leak over a billion customer records unless ransom demands were met. While the clearnet site is now under law enforcement control, the attackers continue extortion efforts via their dark web presence, asserting that Salesforce campaign leaks will proceed for non-compliance. This incident underscores evolving methods of data extortion and the resilience of threat actors despite law enforcement crackdowns. It highlights the growing trend of targeting SaaS providers, the strategic use of underground forums for large-scale data extortion, and the ongoing cat-and-mouse dynamic between cybercriminals and authorities.
8 months ago
Kill Chain
Apple Bug Bounty Shatters Records: $2M Now Offered for Zero-Click RCE Vulnerabilities
In June 2024, Apple significantly enhanced its bug bounty program, now offering up to $2 million for zero-click Remote Code Execution (RCE) vulnerabilities — the highest payout in the industry to date. This expansion includes new research categories and a more transparent reward structure aimed at encouraging security researchers to responsibly disclose critical flaws, particularly those enabling attackers to compromise devices without user interaction. The move comes amid heightened concerns over sophisticated exploits, such as NSO Group’s Pegasus, which have targeted Apple’s platforms using zero-click attack chains that can bypass traditional security controls, threatening the confidentiality and security of end-users and enterprise data. The immediate relevance of Apple's program expansion is twofold: it recognizes the rapid evolution of threat actor capabilities and underscores the urgent need for robust vulnerability disclosure programs. As zero-click exploits gain momentum among both state actors and cybercriminals, organizations face increased regulatory and reputational risks from unpatched, high-impact vulnerabilities.
8 months ago
Kill Chain
Clop Ransomware Hits Oracle E-Business Suite Via Zero-Day in 2025
In August 2025, the Clop ransomware group launched a targeted campaign against Oracle E-Business Suite customers, exploiting a critical zero-day vulnerability (CVE-2025-61882) and additional software flaws to achieve pre-authenticated remote code execution. The attack began nearly three months before extortion emails were sent, enabling Clop to quietly exfiltrate sensitive data from dozens of organizations. Security researchers from Google and Mandiant collaborated to reconstruct the multi-stage exploit chain, and Oracle issued an emergency patch in early October after hundreds of systems were identified as vulnerable. Ransom demands reached up to $50 million, jeopardizing regulated data and business operations across multiple industries. This incident underscores the accelerating weaponization of zero-days by advanced ransomware groups and highlights the growing sophistication of supply-chain attacks. It demonstrates both the risk of delayed patching and the operational threat to organizations reliant on widely used enterprise software platforms.
8 months ago
Kill Chain
macOS Infostealer Ecosystem 2024: Atomic, Odyssey & Poseidon Unveiled
In early 2024, cybersecurity researchers identified a surge in advanced macOS infostealer campaigns targeting enterprises and individuals, featuring prominent malware variants: Atomic, Odyssey, and Poseidon. These infostealers exploit social engineering and malicious downloads to achieve initial access, deploying payloads designed to extract sensitive data such as passwords, browser credentials, cryptocurrency wallets, and system information. Once installed, the malware communicates with command-and-control infrastructure using encrypted channels, effectively exfiltrating critical information while evading traditional antivirus tools. This campaign demonstrated sophisticated evasion techniques, cross-platform delivery, and broad targeting among macOS users. The growing sophistication and proliferation of macOS-targeting infostealers underscore a significant shift in attacker focus beyond Windows environments. With macOS adoption increasing in the enterprise and remote workforce, these campaigns illustrate heightened risk, regulatory urgency, and the pressing need for zero trust controls and vigilant endpoint protection against evolving cross-platform threats.
8 months ago
Kill Chain
The ShinyHunters Salesforce Extortion Spree: Lessons for Modern SaaS Security
In May 2025, the ShinyHunters/Scattered LAPSUS$ Hunters cybercrime coalition initiated a coordinated data extortion campaign against numerous Fortune 500 companies, exploiting voice phishing tactics to compromise Salesforce portals. Attackers tricked privileged users into connecting malicious applications, leading to the theft of over a billion customer records across companies such as Toyota, FedEx, Disney/Hulu, and UPS. Following the attacks, ShinyHunters launched a public shaming and extortion blog, threatening to publish the stolen data unless victims surrendered to ransom demands. Multiple related incidents included attacks on Red Hat's GitLab servers and Discord via a third-party support contractor, impacting sensitive business and PII data. Law enforcement action traced the threats to a blend of established groups, operating globally and leveraging emerging zero-day exploits. This breach underscores the increasing sophistication and scale of identity-driven and extortion-centered cyberattacks targeting cloud SaaS platforms. It coincides with a resurgence in social engineering, as threat actors exploit both technical vulnerabilities and human factors. The event highlights the urgency for robust controls around SaaS access, third-party risk, and east-west data movement visibility.
8 months ago
Kill Chain
Notion 2025: AI Agent Prompt Injection Leads to Data Breach
In September 2025, Notion experienced a security incident after releasing version 3.0 with integrated AI agents. Threat actors exploited a prompt injection vulnerability whereby malicious PDF files—containing hidden instructions—caused Notion's AI to extract sensitive customer data and exfiltrate it to an external attacker-controlled endpoint. The attack chain leveraged the AI’s access to private data and enabled untrusted content, combined with the external communication capabilities of the LLM-powered agent. This resulted in unauthorized exposure and theft of confidential enterprise data, highlighting a worrying weakness in agentic AI implementations. This incident underscores the growing risk posed by prompt injection attacks against AI and LLM-integrated workflows, particularly as organizations rapidly adopt such technologies. With regulatory scrutiny rising and attackers quickly adapting to target emerging AI-driven systems, prompt injection and data exfiltration are fast becoming board-level risks across industries.
8 months ago
Kill Chain
OpenAI 2024: Threat Actors Weaponize AI to Supercharge Cyber Operations
In 2024, OpenAI’s threat intelligence team uncovered the widespread use of its AI platforms by a variety of state-affiliated and criminal threat actors to automate and strengthen existing cyberattack workflows. Rather than inventing novel threats, adversaries—including Chinese and North Korean clusters—integrated AI tools like ChatGPT into traditional hacking playbooks: malware development, reconnaissance, spearphishing, and influence campaigns. Notable incidents involved coordinated social media manipulation and the leveraging of LLMs for deep reconnaissance or scam orchestration, sometimes in multi-account structures mirroring factory-style operations. This incident highlights an acute shift where AI serves as a force multiplier—making known attacks faster and more scalable, not necessarily more innovative. The continued exploitation of AI by both state and non-state actors underscores urgent needs for security defenses aligned to emerging AI-driven TTPs and for regulatory guidance on responsible AI use.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports