✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Consulting
Breach intelligence, attack campaigns, and threat reports targeting the Consulting sector.
Explore Other Sectors
Consulting Threat Reports
Silver Fox's Tax-Themed Phishing Campaign Unveils New ABCDoor Malware
In December 2025, the China-backed threat group Silver Fox initiated a phishing campaign targeting organizations in India and Russia. The attackers sent emails impersonating tax authorities, prompting recipients to download archives purportedly containing lists of tax violations. These archives contained a modified Rust-based loader that deployed the known ValleyRAT backdoor and a previously undocumented Python-based backdoor named ABCDoor. Between early January and early February 2026, over 1,600 such malicious emails were recorded, affecting sectors including industrial, consulting, retail, and transportation. ([darkreading.com](https://www.darkreading.com/endpoint-security/silver-fox-tax-themed-attacks-india-russia?utm_source=openai)) This incident underscores the evolving tactics of APT groups, particularly their use of sophisticated social engineering techniques and novel malware to infiltrate organizations. The discovery of ABCDoor highlights the continuous development of custom tools by threat actors to evade detection and maintain persistence. ([darkreading.com](https://www.darkreading.com/endpoint-security/silver-fox-tax-themed-attacks-india-russia?utm_source=openai))
1 month ago
Kill Chain
TeamPCP's 'Mini Shai-Hulud' Attack: A Wake-Up Call for Software Supply Chain Security
In April 2026, the cybercriminal group TeamPCP executed a supply chain attack, compromising several SAP npm packages integral to SAP's Cloud Application Programming Model (CAP) and Cloud MTA Build Tool (MBT). The attackers injected malicious preinstall scripts into four packages: @cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48. These scripts, upon installation, deployed multistage payloads designed to harvest developer and CI/CD secrets across platforms like GitHub, npm, and major cloud providers, subsequently exfiltrating the data to attacker-controlled GitHub repositories. The malware also included code to propagate via compromised tokens. ([darkreading.com](https://www.darkreading.com/cloud-security/teampcp-sap-packages-mini-shai-hulud?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools and platforms. The 'Mini Shai-Hulud' campaign, as it was dubbed, highlights the necessity for organizations to implement stringent security measures within their software development pipelines to prevent unauthorized access and data exfiltration. ([darkreading.com](https://www.darkreading.com/cloud-security/teampcp-sap-packages-mini-shai-hulud?utm_source=openai))
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports