The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Computer Software/Engineering

Breach intelligence, attack campaigns, and threat reports targeting the Computer Software/Engineering sector.

2488 threat reports
Page 196 of 208
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Computer Software/Engineering Threat Reports

Showing 2341–2352 / 2488 reports
NPM Supply Chain: Shai-Hulud Attack Compromises 700+ Packages
Computer Software/Engineering9 months ago

NPM Supply Chain: Shai-Hulud Attack Compromises 700+ Packages

In September 2024, researchers identified a large-scale supply chain attack leveraging malicious NPM packages weaponized with the "Shai-Hulud" malware. Attackers trojanized over 700 NPM packages—including popular and widely-used ones such as CrowdStrike's—compromising developer systems and creating persistent, unauthorized GitHub Actions workflows in code repositories. The attack targeted both Windows and Linux environments, harvesting developer credentials, CI/CD tokens, and secrets, then exfiltrating the data via webhooks to attacker-controlled servers. The worm-like propagation enabled ongoing data theft and espionage, raising substantial risks for any organization dependent on NPM or continuous integration workflows. This incident underscores growing risks in software supply chains, as modern attacks increasingly target developer tools and automation infrastructure. Self-propagating, persistent attacks such as Shai-Hulud highlight the need for stronger code provenance controls, real-time threat detection, and updated development pipeline security to counter evolving adversary tactics.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Google Gemini Hit by Unfixed ASCII Smuggling AI Attack in 2025
Computer Software/Engineering9 months ago

Google Gemini Hit by Unfixed ASCII Smuggling AI Attack in 2025

In October 2025, a newly disclosed ASCII smuggling attack targeting Google’s Gemini AI assistant exposed a significant security vulnerability stemming from the model's processing of hidden Unicode payloads. Security researcher Viktor Markopoulos demonstrated that attackers could leverage invisible Unicode characters in Calendar invites or emails, prompting Gemini to execute unseen instructions and alter its behavior without user awareness. Notably, the exploit could automate data extraction or spoof identities within Google Workspace integrations, increasing risk for both users and enterprises. Despite the demonstrated risks, Google chose not to address the vulnerability, citing its overlap with social engineering tactics. This incident underscores the heightened threat posed by AI/ML attacks against widely integrated platforms. As LLMs increasingly automate workflows and access sensitive data, adversarial prompt manipulation and Unicode character abuse are becoming urgent areas for organizational security reviews and regulatory scrutiny.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Salesforce 2025 Supply Chain Data Breach: An Executive Overview
Computer Software/Engineering9 months ago

Salesforce 2025 Supply Chain Data Breach: An Executive Overview

In 2025, Salesforce and hundreds of its customers were targeted in two coordinated data theft campaigns by the threat group "Scattered Lapsus$ Hunters," leveraging both social engineering and stolen OAuth tokens. Attackers tricked employees into connecting malicious OAuth applications or exploited compromised Salesloft Drift tokens, gaining unauthorized access to sensitive CRM data, support tickets, credentials, and authentication tokens. The attackers subsequently attempted to extort 39 major organizations, threatening to leak up to 1.5 billion records via a dark web leak site unless sizable ransom demands were met. Salesforce publicly refused to negotiate or pay any ransom, and law enforcement actions appeared to subsequently seize the extortion domain. This incident underscores the growing sophistication of supply-chain attacks using identity-based and OAuth token compromise, highlighting the rising risk to SaaS ecosystems. The event triggered significant concerns across industries that increasingly rely on interconnected third-party platforms and further emphasizes urgent gaps in SaaS security, zero trust application governing, and lateral movement prevention.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Ransomware Breach at London’s Kido Nursery: Child Data Leaked by Radiant Group
Primary/Secondary Education9 months ago

Ransomware Breach at London’s Kido Nursery: Child Data Leaked by Radiant Group

In September 2025, the Kido International nursery chain, operating in several countries and serving over 15,000 families, suffered a ransomware attack orchestrated by the Radiant Group. Attackers accessed sensitive data and photographs of more than 1,000 children, their families, and nursery employees. Some stolen data, including children's pictures and residential addresses, were leaked on a dark web site to pressure Kido into paying a ransom. When extortion attempts failed, the attackers removed the leaked files, but only after making threatening calls to parents, intensifying the distress of the incident. This event underscores the alarming targeting of childcare and educational institutions by cybercriminals, reflecting a broader trend of ransomware attacks exploiting organizations that handle sensitive personal data. The swift arrests by London police of suspects involved demonstrate growing law enforcement action, yet also highlight increased risks for sectors entrusted with children's safety and privacy.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Hackers Exploit Auth Bypass in Service Finder WordPress Theme (CVE-2025-5947)
Computer Software/Engineering9 months ago

Hackers Exploit Auth Bypass in Service Finder WordPress Theme (CVE-2025-5947)

In the autumn of 2025, a critical authentication bypass vulnerability (CVE-2025-5947) was discovered and actively exploited in the Service Finder WordPress theme, affecting versions 6.0 and older. Attackers leveraged improper validation in the 'service_finder_switch_back()' function, allowing them to impersonate any user—including administrators—simply by sending HTTP requests with a crafted cookie or query parameter. The flaw enabled threat actors to gain full administrative control over thousands of websites, with over 13,800 exploitation attempts recorded by Wordfence since August 1. Attackers could then create or modify site content, add malicious code, or export sensitive data undetected, putting site owners and users at risk. This breach is particularly relevant as it illustrates the continued targeting of WordPress ecosystems with privilege escalation exploits, highlighting growing risks from vulnerable third-party themes and plugins. It underscores the urgency of rapid patching, improved logging, and continuous monitoring to defend against evolving web application threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Crimson Collective’s 2025 AWS Cloud Data Breach: Tactics, Impacts, and Security Lessons
Computer Software/Engineering9 months ago

Crimson Collective’s 2025 AWS Cloud Data Breach: Tactics, Impacts, and Security Lessons

In October 2025, the Crimson Collective threat group executed a sophisticated attack targeting Amazon Web Services (AWS) cloud instances belonging to multiple organizations, most notably Red Hat. Utilizing exposed AWS credentials discovered via open-source reconnaissance tools, the attackers escalated their privileges by creating new IAM users with administrative rights. They then enumerated and accessed sensitive resources, including databases and storage volumes, exfiltrating approximately 570 GB of data from private GitLab repositories. The Crimson Collective followed up with extortion demands, leveraging AWS's internal and external email services to apply pressure on victims and collaborating with the Scattered Lapsus$ Hunters to intensify threats. This incident underscores an escalating trend of cloud-focused threat actors exploiting credential exposures to breach critical infrastructure, bypass perimeter controls, and apply multifaceted extortion tactics. Organizations face increasing regulatory and business risk as attackers target cloud identity and API misconfigurations, requiring immediate attention to zero trust controls, egress restrictions, and anomaly detection in multi-cloud environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Brazilian Military Breach: Zimbra Zero-Day Exploited via Libyan Navy Impersonation
Defense/Space9 months ago

Brazilian Military Breach: Zimbra Zero-Day Exploited via Libyan Navy Impersonation

In early 2024, cyber attackers posing as representatives of the Libyan Navy’s Office of Protocol targeted the Brazilian military using a sophisticated spear-phishing campaign. By leveraging a previously unknown zero-day vulnerability in Zimbra Collaboration Suite and delivering malicious emails through compromised inter-country secure communications channels (ICS), the threat actors successfully bypassed traditional perimeter defenses. The attackers' advanced persistent techniques enabled them to gain unauthorized access, exploit sensitive data, and risk critical communications infrastructure for the Brazilian defense sector, with potential exposure of mission-critical information. This incident highlights the escalating risks posed by zero-day vulnerabilities and state-linked or impersonation-driven threat actors, particularly against government and defense organizations. The unusual attack vector via ICS demonstrates evolving tactics beyond routine phishing, reinforcing the necessity for layered security, real-time threat detection, and robust segmentation controls.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
EU Chat Control Law Threatens Privacy and Encryption in 2024
Computer Software/Engineering9 months ago

EU Chat Control Law Threatens Privacy and Encryption in 2024

In 2024, the European Union considered sweeping legislation called Chat Control, aimed at mandating providers of end-to-end encrypted messaging apps to implement client-side scanning of user content for illegal material, notably child sexual abuse material (CSAM). Major privacy advocates and technology leaders, including Signal's CEO, highlighted that such a regulation would undermine privacy by requiring access to sensitive content before encryption. Technical experts warned that creating lawful access inherently weakens the entire encrypted ecosystem, exposing all users—including journalists, activists, and vulnerable groups—to potential surveillance or exploitation, and might force some encrypted messaging services to exit the EU market entirely. This proposed law has sparked an urgent debate on digital privacy, as its adoption could set a global precedent for government-mandated encryption backdoors. The current climate of rising concerns over lawful and extrajudicial surveillance, combined with persistent cyber threats, amplifies the pertinence and risks associated with such regulatory initiatives.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unity Game Engine Vulnerability 2025: Millions Exposed to Supply Chain Attacks
Computer Games9 months ago

Unity Game Engine Vulnerability 2025: Millions Exposed to Supply Chain Attacks

In October 2025, a significant supply chain vulnerability (CVE-2025-59489) was discovered in the Unity game engine, impacting applications built since version 2017.1 and endangering millions of global end-users. The flaw, identified by security researcher RyotaK, enables attackers to achieve arbitrary code execution or information disclosure by exploiting unsafe file loading mechanisms in the Unity Runtime component. Affected games include widely popular titles like Hearthstone, Fallout Shelter, and Doom (2019). Valve and Microsoft responded quickly, recommending users uninstall vulnerable games and developers patch or rebuild applications, while Unity issued updates and fixes for supported engine versions. This incident underscores the growing risks of supply chain vulnerabilities in modern software ecosystems, particularly as game engines and third-party frameworks become foundational across industries. The rapid coordinated response highlights heightened industry attention to upstream code security, as adversaries increasingly target widely deployed runtime components for maximum impact.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Redis 2025 Critical RCE: How CVE-2025-49844 Threatens Cloud Data Security
Financial Services9 months ago

Redis 2025 Critical RCE: How CVE-2025-49844 Threatens Cloud Data Security

In October 2025, Redis disclosed a critical remote code execution vulnerability (CVE-2025-49844), stemming from a 13-year-old use-after-free bug in the Lua interpreter, impacting all major Redis releases. Exploitable via authenticated Lua scripts—enabled by default—the flaw allows attackers to escape the script sandbox, execute arbitrary code, establish persistent access via reverse shell, and ultimately gain full control of the host system. Security researchers revealed that over 330,000 Redis instances were exposed online, some requiring no authentication, enabling credential theft, data exfiltration, lateral movement, and malware deployment at scale. This incident highlights persistent risks from legacy code, cloud-exposed databases, and default insecure configurations, accelerating regulatory and industry emphasis on proactive patching, network segmentation, and least privilege controls. The vulnerability’s sheer scope and ease of exploitation underline the urgency for organizations to remediate and harden public-facing infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Zeroday Cloud 2025: Cloud and AI Security in the Spotlight
Computer Software/Engineering9 months ago

Zeroday Cloud 2025: Cloud and AI Security in the Spotlight

In December 2025, the inaugural Zeroday Cloud hacking contest was announced, offering $4.5 million in bug bounties for security researchers able to compromise open-source cloud and AI technologies. Organized by cloud security firm Wiz with major cloud providers Google Cloud, AWS, and Microsoft, the event is set to coincide with Black Hat Europe in London. Categories span AI platforms, Kubernetes, virtualization, web servers, databases, and DevOps tools, with cash rewards reaching as high as $300,000 for critical exploits that achieve remote code execution or full container escapes. The competition’s rules encourage demonstration of high-impact vulnerabilities in default configurations, drawing attention from the research and bug bounty community worldwide. This contest stands out as the largest ever focused exclusively on cloud-native and AI environments. It highlights industry-wide concerns about tooling security as organizations accelerate public cloud and AI adoption. The timing reflects both the proliferation of adversaries targeting these attack surfaces and coordinated industry efforts to crowdsource vulnerability discovery in critical platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How Kaspersky’s 2025 ML Models Raised the Bar for DLL Hijacking Detection
Financial Services9 months ago

How Kaspersky’s 2025 ML Models Raised the Bar for DLL Hijacking Detection

In 2025, Kaspersky advanced their detection capabilities against DLL hijacking attacks by developing and deploying machine learning (ML) models. DLL hijacking, used by both organized malware developers (such as those behind Lumma stealer) and advanced persistent threat (APT) groups, involves loading malicious DLLs in place of genuine libraries. Attackers exploited trusted processes to evade detection and complicate incident response. Kaspersky’s internal telemetry revealed a sharp uptick in these attacks across diverse regions and sectors, prompting an iterative ML-driven approach. By refining training datasets, extracting relevant behavioral features, and evolving their models through analyst feedback, Kaspersky achieved higher true positive rates and reduced false positives, integrating the solution into SIEM and MDR offerings to surface live threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports