✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Construction
Breach intelligence, attack campaigns, and threat reports targeting the Construction sector.
Explore Other Sectors
Construction Threat Reports
React2Shell Exploitation Delivers Crypto Miners and Advanced Malware Across Multiple Sectors
In December 2025, a sophisticated multi-vector cyber campaign exploited a critical vulnerability (CVE-2025-55182) in React Server Components, enabling unauthenticated remote code execution across more than 50 organizations in industries including construction, entertainment, finance, and government. Attackers orchestrated automated scans to identify vulnerable Next.js deployments and delivered a suite of malware, notably the PeerBlight backdoor, CowTunnel reverse proxy, ZinFoq implant, and various cryptominers. The campaign leveraged both Linux and Windows endpoints, indicating indiscriminate targeting. Highly persistent payloads established robust command-and-control connections, enabled lateral movement, and facilitated data exfiltration while evading detection using masquerading and decentralized C2 mechanisms. This incident underscores the urgency of prompt patching for popular web frameworks and highlights the growing sophistication and prevalence of automated exploitation tools. Security teams face amplified risk as threat actors now combine opportunistic cryptomining with advanced post-exploitation techniques across geographic regions and sectors, outpacing conventional defenses and incident response speeds.
6 months ago
Kill Chain
RomCom Exploits SocGholish Loader in U.S. Civil Engineering Breach
In June 2025, a U.S.-based civil engineering firm was targeted by the RomCom cybercriminal group leveraging the SocGholish JavaScript loader to deliver the advanced Mythic Agent malware. This marked the first known instance of RomCom using SocGholish for payload distribution. Attackers gained initial access through fake browser update lures hosted on compromised websites, allowing them to deploy the remote access trojan (RAT) and establish persistent control within the victim’s network. The attack resulted in exposure of sensitive engineering data and raised concerns regarding lateral movement and potential data exfiltration. This incident illustrates the ongoing trend of converging threat actor tactics, with attackers combining phishing, living-off-the-land tools, and stealthy malware loaders to increase their reach. As cybercriminal organizations diversify their infection vectors, organizations must swiftly adapt their detection and response strategies.
6 months ago
Kill Chain
Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025
In November 2025, Automated Logic disclosed critical vulnerabilities impacting multiple legacy versions of its WebCTRL Premium Server and related Carrier i-Vu and SiteScan Web products. Reported by researchers Jaryl Low, Thuy D. Nguyen, and Cynthia E. Irvine, the flaws—CVE-2024-8527 (Open Redirect) and CVE-2024-8528 (Cross-site Scripting)—could allow remote attackers to deceive users into navigating to malicious sites or executing attacker-controlled scripts. These vulnerabilities affect industrial control solutions deployed globally within the Critical Manufacturing sector, potentially enabling credential theft, phishing, or unauthorized access to sensitive building automation environments. This incident underscores the urgent need for timely patching and secure software development in critical infrastructure industries. As web application attacks increase and threat actors target supply chain and operational technology, coordinated disclosures and swift remediation remain vital to reduce risk and comply with tightening regulatory frameworks.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports