Computer Software/Engineering
Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.
Explore Other Sectors
Computer Software/Engineering Threat Reports
Operation Rewrite: Chinese SEO Poisoning Surges in 2024, Compromising Trusted Web Servers
In early 2024, security researchers identified 'Operation Rewrite,' a sophisticated SEO poisoning campaign linked to a suspected Chinese threat actor. The attackers compromised numerous legitimate web servers, injecting malicious content designed to boost the search ranking of infected sites for financial gain. Unsuspecting users were redirected from popular search results to websites hosting malware or phishing content. The campaign leveraged legitimate server infrastructure to evade traditional detection, complicating mitigation and exposing visitors to potential credential theft, malware infections, and broader data compromise. The attackers’ tactics allowed them to rapidly spread harmful payloads while remaining concealed among normal web traffic. This incident underscores a sharp increase in SEO poisoning and supply chain abuse, as adversaries prioritize techniques that abuse trust in widely visited websites and search engines. With web browsing essential to daily business operations, organizations face mounting risks from threats that bypass perimeter defenses by posing as reputable content.
8 months ago
Kill Chain
Operation Rewrite: 2025 Chinese-Speaking Threat Actor Turns BadIIS Modules into Weaponized SEO Poisons
In March 2025, cybersecurity researchers uncovered Operation Rewrite, a large-scale search engine optimization (SEO) poisoning campaign attributed to a Chinese-speaking threat actor tracked as CL-UNK-1037, with links to Group 9 and DragonRank. Attackers compromised web and application servers, deploying malicious native IIS modules dubbed "BadIIS" to intercept, modify, and proxy web traffic. By injecting SEO content and redirecting legitimate visitors, the attackers increased rankings for illicit sites, harvested sensitive data, and exfiltrated web application source code. Multiple server types—web servers, domain controllers, and high-value hosts—were compromised, indicating substantial operational impact and risk to affected organizations and individuals.
8 months ago
Kill Chain
2025's Multichannel Phishing Campaigns: The End of Email-Only Defense
In September 2025, organizations experienced a surge of sophisticated credential harvesting attacks that moved beyond traditional email phishing, utilizing instant messaging, social media, and malicious advertising channels. Attackers deployed advanced Attacker-in-the-Middle (AiTM) phishing kits and leveraged compromised accounts, cloned login pages, and rapid domain rotation to evade both detection and remediation. Case studies included targeted spear-phishing via LinkedIn and malvertising on Google Search, resulting in high-value session theft and lateral account compromise. These attacks not only bypassed email security but exploited any channel where business users could be reached, often leading to the breach of core cloud platforms and widespread internal access. This campaign marks a critical evolution in attacker tactics, underlining that perimeter-focused and email-only defenses are insufficient. The surge in non-email phishing brings new urgency for organizations to secure east-west traffic, implement zero trust segmentation, and enhance visibility across all cloud and SaaS environments.
8 months ago
Kill Chain
Fake Password Managers Spread AMOS Malware on Mac: The 2025 LastPass Incident
In September 2025, LastPass reported an ongoing malware campaign targeting macOS users with fake password managers distributed through fraudulent GitHub repositories and deceptive SEO-optimized links. The attackers impersonated over 100 popular software products—including LastPass, 1Password, Dropbox, and others—using build-your-own repositories that redirected victims to install scripts containing the Atomic (AMOS) infostealer malware. Victims were instructed to run shell commands that downloaded backdoored payloads, risking credential theft, data exfiltration, and sustained system compromise. The campaign employed automated methods for rapid replication and evasive takedown resistance. This incident underscores a surge in supply chain and social engineering attacks using open platforms and SEO abuse, highlighting the persistent vulnerabilities in software distribution channels for macOS. It demonstrates attackers' growing sophistication in exploiting user trust and platform discoverability to deploy credential-stealing malware at scale.
8 months ago
Kill Chain
Stellantis 2024 Salesforce Supplier Breach: Lessons on Third-Party SaaS Risk
In June 2024, automaker Stellantis confirmed that a cybersecurity incident impacted some of its North American customers after attackers compromised a third-party service provider’s platform integrated with their Salesforce infrastructure. The breach exposed sensitive customer data, though financial and highly confidential information reportedly remained secure. The attackers exploited weaknesses in the external vendor’s environment to gain unauthorized access, demonstrating the risks inherent in today's interconnected supply chains. Stellantis responded by notifying affected customers, engaging security experts, and working closely with the vendor to contain and investigate the incident. This breach highlights the ongoing surge of supply chain and third-party risks as enterprises rely on hosted platforms like Salesforce for mission-critical operations. The event underscores the increasing sophistication of attackers targeting SaaS ecosystems and underscores the need for robust supplier security controls and monitoring.
8 months ago
Kill Chain
Airport Check-In Disruption: 2024 Supply-Chain Breach at Heathrow
In June 2024, a major disruption struck multiple European airports, including London Heathrow, after a cyberattack targeted a third-party provider responsible for check-in kiosk software. The supply-chain attack led to widespread check-in outages, flight delays, and cancellations, impacting thousands of travelers over the weekend. Initial investigation suggests that attackers compromised the software vendor’s infrastructure—potentially with ransomware or through lateral movement via third-party access—causing operational downtime for airlines and airport operators relying on their services. The incident highlights growing dependency risks stemming from the use of specialized external IT vendors in critical national infrastructure, especially in aviation. This event underscores the accelerating trend of supply-chain attacks, where threat actors exploit weaker links outside direct company control. With aviation systems under heightened scrutiny and ransomware groups often targeting critical operations, organizations across sectors must reevaluate third-party security, segmentation, and visibility to mitigate cascading impacts from vendor compromises.
8 months ago
Kill Chain
DPRK Leverages ClickFix Job Scams to Infest Crypto Firms with BeaverTail Infostealer
In September 2025, threat actors linked to North Korea (DPRK) orchestrated a targeted phishing campaign leveraging ClickFix-style lures against employees in the cryptocurrency and retail sectors. Masquerading as legitimate job opportunities for marketing and trader roles, attackers distributed malicious files leading to infection with BeaverTail and InvisibleFerret malware. This allowed adversaries to employ infostealing techniques, facilitating lateral movement and potential data exfiltration, while avoiding traditional security controls. The campaign highlights DPRK’s continued focus on crypto-enabled theft, using sophisticated social engineering, custom tooling, and industry-specific targeting. This incident underscores a recent surge in state-sponsored campaigns prioritizing non-technical roles and leveraging advanced lure techniques. Organizations in high-value verticals like crypto are increasingly attractive to financially motivated adversaries, elevating the urgency for zero trust defenses and robust internal traffic security controls.
8 months ago
Kill Chain
MalTerminal: GPT-4-Powered Malware Signals New Era of AI Cyberattacks
In September 2025, SentinelOne’s SentinelLABS revealed the existence of 'MalTerminal,' the first documented malware leveraging GPT-4-powered Large Language Model (LLM) capabilities. Demonstrated at LABScon 2025, MalTerminal introduces LLM-driven automation within the malware lifecycle—enabling it to generate ransomware payloads, establish reverse shells, and craft social engineering content in real time. The attack method shows that malware authors are blending AI models directly into code to rapidly escalate privilege, automate lateral movement, and obfuscate command-and-control traffic. Business impact includes advanced, adaptive attacks that defeat legacy detection, heightening risks of data exfiltration, extended dwell time, and operational disruption. MalTerminal’s emergence is a bellwether for the rapid weaponization of generative AI technology by threat actors. This incident highlights the urgent need for organizations to re-evaluate traditional controls and accelerate adoption of cognitive security, visibility, and real-time policy enforcement frameworks to keep pace with evolving adversary techniques.
8 months ago
Kill Chain
LastPass Exposes macOS Atomic Infostealer Attack via Fake GitHub Repositories
In mid-2025, LastPass identified and warned users about a sophisticated information-stealing campaign targeting Apple macOS users. Attackers set up fraudulent GitHub repositories impersonating reputable projects, including LastPass, to distribute versions of the 'Atomic' infostealer malware. Unsuspecting users downloading these fake tools had their credentials, browser data, and sensitive files compromised. The campaign leveraged social engineering, search poisoning, and open-source developer trust to infiltrate victims’ systems, posing significant risk to both individual and enterprise security. The incident highlights continued abuse of trusted development platforms to target the software supply chain. This breach is noteworthy as it reflects the growing trend of attacker focus on macOS endpoints and the exploitation of open-source ecosystems. With supply chain attacks and infostealer campaigns rising sharply in 2025, organizations face increasing pressure to enhance their controls for code provenance, user awareness, and endpoint defense.
8 months ago
Kill Chain
Shai-Hulud Worm Breach: npm Supply Chain Attack in 2023
In November 2023, the self-replicating 'Shai-Hulud' worm orchestrated a large-scale supply chain attack targeting the npm ecosystem. The threat actor compromised hundreds of npm packages, inserting malicious code that enabled lateral propagation and potential backdoor access for anyone who installed the affected libraries. The attack illustrates how deeply embedded dependencies and trusted registries can be manipulated to impact thousands of downstream projects and potentially expose sensitive systems. Swift action from npm and security researchers helped mitigate the spread, but several organizations experienced heightened risk before remediation. This incident underscores the growing threat and frequency of software supply chain compromises, particularly targeting open-source registries. With adversaries leveraging automation and worm-like propagation, the security of development pipelines and third-party code ingestion remains an urgent focus for digital businesses.
8 months ago
Kill Chain
Salesloft Drift Salesforce Breach 2025: OAuth Supply Chain Attack Exposes 1.5 Billion Records
In September 2025, the ShinyHunters extortion group, in collaboration with affiliates Scattered Spider and Lapsus$, claimed responsibility for a massive data breach targeting Salesforce via compromised OAuth tokens from Salesloft Drift integrations. By exploiting the tokens exposed in Salesloft's breached GitHub repository, the attackers accessed and exfiltrated approximately 1.5 billion records from 760 organizations, including sensitive CRM, support, and user data. The incident demonstrated sophisticated use of social engineering, malicious OAuth apps, and credential-harvesting across major cloud platforms, with the attackers leveraging the stolen information for extortion and potential lateral movement. This breach is emblematic of the growing threat from identity-based attacks and supply chain compromise targeting SaaS ecosystems. Attackers leveraging OAuth abuse, stolen developer secrets, and interconnected cloud services create highly scalable data theft risks, driving regulatory focus and pushing organizations to revisit zero trust and access management frameworks.
8 months ago
Kill Chain
How Social Engineering Enabled the 2024 Insight Partners Ransomware Breach
In October 2024, Insight Partners, a leading New York-based venture capital and private equity firm, suffered a significant cybersecurity incident when a threat actor used sophisticated social engineering techniques to gain network access. Following initial infiltration, attackers spent months exfiltrating sensitive information, including banking, tax, employee, and investor data, before launching ransomware on January 16, 2025 to encrypt company servers. The breach ultimately impacted approximately 12,657 individuals, with Insight Partners notifying those affected and providing credit monitoring services in accordance with regulatory requirements. This incident highlights the increasing effectiveness of social engineering in enabling multi-stage ransomware attacks that combine stealthy exfiltration with disruptive encryption. As the financial sector faces growing regulatory scrutiny and cybercriminals refine identity-driven attack vectors, organizations must address both technical vulnerabilities and human factors to maintain resilience against evolving ransomware threats.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports