Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
UNC5221 Breach: BRICKSTORM Backdoor Hits U.S. Legal & Tech Sectors (2025)
In September 2025, a sophisticated cyber espionage operation targeting U.S.-based legal services, SaaS providers, BPOs, and technology firms was attributed to UNC5221, a suspected China-nexus threat actor. The attackers leveraged the BRICKSTORM backdoor as their primary access mechanism, gaining initial entry through spear-phishing campaigns and exploiting software vulnerabilities. Once inside, they focused on lateral movement, data gathering, and exfiltration, leveraging encrypted channels to avoid detection. The incident resulted in exposure of sensitive legal documents, business data, and intellectual property, highlighting the advanced TTPs of nation-state actors targeting critical professional sectors. This breach exemplifies the growing prevalence of targeted espionage campaigns against high-value service and technology industries. It underscores the urgency for organizations to adopt advanced threat detection, zero trust segmentation, and strong encrypted communication controls in the face of persistent, well-resourced adversaries and heightened regulatory scrutiny.
8 months ago
Kill Chain
Steganography Strikes: npm Supply Chain Breach Hides Malware in JavaScript Package (2024)
In June 2024, a malicious npm JavaScript package was discovered masquerading as a utility library while covertly deploying a credential-stealing malware. Attackers cleverly embedded the malicious payload using steganography by hiding harmful code within QR code images bundled in the package. Once installed by developers, the malware extracted sensitive credentials and communicated with attacker-controlled infrastructure, posing a significant risk to any organization that unknowingly integrated the tainted dependency in its software supply chain. This incident underscores the mounting threat posed by highly obfuscated, supply chain attacks leveraging trusted open-source platforms. The attack highlights the emergence of sophisticated malware delivery via unconventional vectors such as steganographic encoding within common file formats. With broad software ecosystem dependencies and rapid code adoption, organizations face increasing urgency to vet third-party packages and enforce robust supply chain security controls.
8 months ago
Kill Chain
Cloud Misconfiguration: How Exposed Docker Daemons Fueled a 2024 DDoS Botnet
In early 2024, cybersecurity researchers uncovered a widespread campaign exploiting misconfigured Docker daemons in cloud environments. Attackers leveraged openly accessible Docker APIs to deploy malicious containers and enlist compromised servers into a large-scale DDoS (Distributed Denial of Service) botnet. Using legitimate, cloud-native tools made detection and remediation more challenging for security teams. The incident resulted in increased infrastructure costs, service disruptions, and heightened risk of lateral movement and data exfiltration within affected organizations. This attack is illustrative of a growing trend where adversaries abuse cloud-native technologies and misconfigurations to orchestrate large-scale, persistent threat activity. As organizations accelerate cloud adoption, gaps in cloud security posture and lack of network segmentation are creating new attack surfaces, stressing the need for enhanced visibility, zero trust controls, and real-time anomaly detection.
8 months ago
Kill Chain
GitHub’s NPM Supply Chain Attack Shows Urgent Need for Token Security in 2024
In early 2024, GitHub took action to secure the NPM supply chain following a surge of sophisticated attacks exploiting weak authentication protocols and overly permissive access tokens. Adversaries—most notably those deploying the Shai-Hulud malware—compromised developer or maintainer accounts, then published malicious NPM packages, creating a vector for large-scale supply chain infection. The breaches risked both open-source and enterprise users, potentially allowing attackers access to downstream projects, credential leakage, and further lateral movement in corporate ecosystems. This incident is a critical reminder that software supply chains are increasingly targeted by cybercriminals using stolen credentials and token abuse. It highlights how even trusted platforms can expose organizations to risk when security controls such as MFA and token lifecycles are insufficiently enforced.
8 months ago
Kill Chain
How North Korean IT Workers Exposed the Next Insider Threat: Lessons from the 2025 Breach
In 2025, organizations across multiple industries discovered they had inadvertently hired North Korean IT workers—an emerging form of insider threat tied to sophisticated fraud and sanctions evasion tactics. These workers, embedded via remote roles and often identified through HR anomalies, funneled their earnings back to the North Korean regime, potentially exposing companies and their payment processors to strict sanctions liability. Initial detections stemmed from mismatched credentials or suspicious onboarding behaviors, with security and legal teams realizing the scope only after covert employment periods. Business impact included urgent compliance, forensic device recovery, and reputational risk, with legal exposure for both inadvertent payments and regulatory reporting lapses. This incident highlights an evolving threat landscape: state-sponsored employment fraud now overlaps with insider threat and compliance failures. Increased scrutiny from regulators, combined with ongoing geopolitical and cyber risk, is driving rapid change in how companies monitor, vet, and respond to workforce-related security incidents.
8 months ago
Kill Chain
NPM Package 'Fezbox' Abused QR Codes in Sophisticated 2025 Supply Chain Attack
In September 2025, a malicious npm package named 'fezbox' was discovered utilizing QR codes as a novel delivery mechanism for cookie-stealing malware. Masquerading as a legitimate utility library on npmjs.com, the package was downloaded at least 327 times before its removal. The attack involved the package embedding a reversed URL to evade detection, which, once decoded, retrieved a dense QR code image containing obfuscated, second-stage payload code. The malware specifically targeted credentials by harvesting cookies and sending harvested credentials to a command-and-control server via HTTPS POST, only proceeding if valid username and password data were detected. This incident highlights the increasing creativity of supply-chain attackers, leveraging steganography within QR codes to bypass traditional static security tools. As QR codes become more commonplace and attackers innovate their use beyond social engineering, organizations must strengthen package vetting, threat detection, and response for open-source dependencies within their development ecosystems.
8 months ago
Kill Chain
GitHub npm 2025: Major Supply Chain Attacks Drive Aggressive Security Overhaul
In August and September 2025, GitHub's npm ecosystem suffered a series of coordinated supply chain attacks involving high-impact campaigns such as "s1ngularity," "GhostAction," and worm-style "Shai-Hulud." Threat actors infiltrated GitHub repositories and npm packages via credential compromise and weaknesses in access controls, ultimately compromising thousands of developer accounts and private repositories. These attacks resulted in theft of sensitive code and data, disruption across open-source ecosystems, and considerable remediation costs for affected organizations. In response, GitHub has announced the rapid rollout of mandatory two-factor authentication, granular access tokens, and removal of insecure authentication methods for npm publishing, aiming to prevent recurrence and empower developers to proactively enhance their security posture. This wave of supply chain attacks underscores the growing risk of software dependency manipulation at scale. The incident highlights the urgency of hardening access controls, enforcing stronger authentication, and shifting developer communities toward zero trust principles to counteract increasingly sophisticated threats facing software ecosystems.
8 months ago
Kill Chain
SolarWinds Hit by Yet Another Web Help Desk RCE Patch Bypass in 2025
In September 2025, SolarWinds disclosed a critical security vulnerability (CVE-2025-26399) in its Web Help Desk (WHD) software, affecting version 12.8.7 and prior. This flaw—stemming from unsafe deserialization in the AjaxProxy component—permits unauthenticated attackers to achieve remote code execution (RCE) on affected servers. The issue represents a patch bypass for earlier vulnerabilities (CVE-2024-28986, CVE-2024-28988), demonstrating persistent weaknesses in the remediation process. While there are no documented exploitations as of publication, previous flaws in this component were added to CISA’s Known Exploited Vulnerabilities catalog, underscoring risk to organizations reliant on WHD for ticketing and IT asset management. This incident underscores the enduring challenge of patch bypasses, where subsequent hotfixes fail to fully resolve underlying flaws, leading to repeated exposures. Weaknesses in serialization logic and high-value IT management software are a favored target for attackers seeking lateral movement, privilege escalation, or supply chain compromise.
8 months ago
Kill Chain
BadIIS Malware Spreads via SEO Poisoning in Operation Rewrite
In September 2025, cybersecurity analysts uncovered a targeted campaign in East and Southeast Asia, particularly Vietnam, orchestrated by a Chinese-speaking threat actor dubbed CL-UNK-1037. Using a custom malware named BadIIS, the group launched "Operation Rewrite" by employing SEO poisoning to direct unsuspecting users to compromised websites. These sites served as a launch point for deploying BadIIS, which stealthily redirected traffic, established persistent web shells, and enabled lateral movement within infected infrastructure. The attacks leveraged trusted search results to compromise both organizations and individuals, aiming to establish long-term footholds and facilitate future malicious operations. This incident highlights the increasing sophistication of adversaries leveraging advanced social engineering and technical tactics like SEO poisoning. The blending of supply chain and web application compromise with persistent malware demonstrates evolving TTPs that bypass conventional detection, emphasizing the urgent need for multilayered security and continuous vigilance for all organizations.
8 months ago
Kill Chain
ShadowV2 Botnet Weaponizes AWS Docker Misconfigurations for DDoS-for-Hire Attacks
In September 2025, researchers uncovered that the ShadowV2 botnet exploited misconfigured Docker containers deployed on Amazon Web Services (AWS) instances. Attackers leveraged these open containers to install Go-based malware, transforming vulnerable cloud servers into nodes for distributed denial-of-service (DDoS) attacks available for hire. The botnet operators were able to saturate targets’ networks and disrupt organizational operations using cloud-scale resources, highlighting a sophisticated abuse of both infrastructure-as-a-service offerings and container orchestration weaknesses. The campaign predominantly impacted organizations with unmanaged or lax security practices around containerized workloads and cloud network borders. This attack underscores the growing trend of threat actors targeting cloud misconfigurations and using them as platforms for broader cybercriminal infrastructure. The incident reflects both the increasing commoditization of DDoS-as-a-service and the urgency of securing cloud-native deployments against well-known attack patterns.
8 months ago
Kill Chain
GitHub Mandates 2FA and Short-Lived Tokens After npm Supply Chain Attack
In September 2025, GitHub responded to a series of sophisticated supply chain attacks targeting the npm package ecosystem, most notably the Shai-Hulud compromise. Adversaries exploited weak authentication mechanisms and abused publishing tokens to inject self-replicating malware into widely used npm libraries. These malicious packages were automatically distributed downstream to thousands of unsuspecting development workflows, putting the integrity of software supply chains at risk. The attacks prompted GitHub to mandate two-factor authentication (2FA) for all npm publishers and to introduce short-lived authentication tokens to substantially reduce exposure to token theft. This incident underscores the growing trend of attackers targeting developer ecosystems as entry points for widespread compromise. The enhanced security controls by GitHub reflect a broader industry movement to harden software supply chains amid intensifying regulatory scrutiny and increasingly sophisticated attack methods.
8 months ago
Kill Chain
Fake GitHub Pages Used to Deliver Atomic Stealer to Mac Users in 2024
In early 2024, cybercriminals launched a large-scale campaign targeting macOS users by leveraging SEO poisoning, fraudulent GitHub repositories, and fake GitHub Pages to distribute the Atomic (AMOS) infostealer malware. Attackers lured users searching for popular software with malicious websites that mimicked legitimate download portals, redirecting victims to GitHub-hosted payloads. Once executed, the malware exfiltrated critical information such as credentials, browser data, cryptocurrency wallets, and system details, putting both individuals and organizations at serious risk. The campaign’s scope and reliance on open-source infrastructure enabled the threat actors to infect a wide swathe of Mac users with relative ease. This incident is particularly relevant due to the increasing prevalence of infostealer malware targeting macOS, the cunning use of SEO manipulation for initial access, and the abuse of trusted development platforms like GitHub. Security teams must be vigilant as these multi-vector attacks blend social engineering, supply chain compromise, and cloud service misuse to evade traditional defenses.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports