✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Defense/Space
Breach intelligence, attack campaigns, and threat reports targeting the Defense/Space sector.
Explore Other Sectors
Defense/Space Threat Reports
Anthropic's AI Models Disabled Amid National Security Concerns
In June 2026, the U.S. government ordered Anthropic to suspend foreign access to its advanced AI models, Fable 5 and Mythos 5, citing national security concerns over potential 'jailbreaking' vulnerabilities that could bypass safety restrictions. This directive led Anthropic to disable these models entirely to comply with export controls, affecting both foreign nationals and certain employees. The incident underscores the challenges in balancing AI innovation with security, as similar capabilities exist in other publicly accessible models. The government's stringent response highlights the growing scrutiny over AI technologies and their potential misuse, emphasizing the need for robust security measures and regulatory frameworks in the rapidly evolving AI landscape.
1 month ago
Kill Chain
Anthropic Halts AI Models Fable 5 and Mythos 5 Following U.S. Government Directive
In June 2026, the U.S. government issued an export control directive requiring Anthropic to suspend access to its advanced AI models, Fable 5 and Mythos 5, for all foreign nationals, including those within the United States. This directive, citing national security concerns, led Anthropic to disable these models globally to ensure compliance. The order also affected foreign national employees of Anthropic, highlighting the broad scope of the government's action. ([tomshardware.com](https://www.tomshardware.com/tech-industry/artificial-intelligence/us-export-control-order-forces-anthropic-to-disable-claude-fable-5-and-mythos-5-worldwide?utm_source=openai)) This incident underscores the increasing regulatory scrutiny over advanced AI technologies and their potential implications for national security. Organizations developing or utilizing such technologies must stay vigilant to evolving compliance requirements and assess the impact of governmental directives on their operations and international collaborations.
1 month ago
Kill Chain
Miasma Worm's 2026 Attack on Microsoft GitHub: A Wake-Up Call for Developers
In June 2026, Microsoft faced a significant supply chain attack when the Miasma worm infiltrated 73 of its GitHub repositories, including those under Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The attackers utilized previously compromised contributor credentials to push malicious commits, introducing configuration files that executed credential-harvesting payloads upon opening in AI coding tools or IDEs. This breach led to the temporary disabling of the affected repositories, disrupting critical workflows and CI/CD pipelines. ([computing.co.uk](https://www.computing.co.uk/news/2026/security/microsoft-s-github-repositories-taken-offline-amid-miasma-supply-chain-attack?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting trusted development environments. The Miasma worm's ability to exploit AI coding tools highlights the need for enhanced security measures in software development processes to prevent similar breaches in the future.
1 month ago
Kill Chain
Russian National Charged in Connection with Void Blizzard Espionage Campaign
In June 2026, U.S. federal prosecutors charged Denis Nikolayevich Obrezko, a Russian national, with conspiracy to commit unauthorized computer access. Obrezko is accused of facilitating cyber-espionage operations for the Russia-aligned threat group Void Blizzard by procuring virtual private servers and domain names used in attacks targeting businesses, educational institutions, and other organizations. The FBI's investigation revealed that Void Blizzard primarily relied on stolen session tokens to authenticate to victim accounts without triggering re-authentication requirements, and used U.S.-based commercial proxy services to mask the connection's location. The group targeted at least 11 U.S. companies, with the actual number of victims likely being higher. ([cyberscoop.com](https://cyberscoop.com/russian-national-charged-void-blizzard-cyber-espionage/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber-espionage groups like Void Blizzard, which have been active since at least April 2024, targeting critical sectors across NATO member states and Ukraine. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/?utm_source=openai)) The group's methods, while not technically advanced, have proven effective, highlighting the need for organizations to implement robust cybersecurity measures to protect against such threats.
1 month ago
Kill Chain
Critical Vulnerabilities in Ivanti Sentry: CVE-2026-10520 and CVE-2026-10523
In June 2026, Ivanti disclosed two critical vulnerabilities in its Sentry secure mobile gateway: CVE-2026-10520, an OS command injection flaw allowing unauthenticated remote code execution with root privileges, and CVE-2026-10523, an authentication bypass enabling attackers to create administrative accounts. Both vulnerabilities were patched in Sentry versions R10.5.2, R10.6.2, and R10.7.1. These vulnerabilities underscore the persistent targeting of Ivanti products by threat actors, highlighting the necessity for organizations to promptly apply security patches to mitigate potential exploitation risks.
1 month ago
Kill Chain
China-Linked JDY Botnet Intensifies Focus on U.S. Military Networks
In June 2026, cybersecurity researchers identified a significant expansion of the JDY botnet, a network linked to Chinese state-sponsored actors such as Volt Typhoon. The botnet, which has grown from approximately 650 active bots in January 2024 to over 1,500 compromised small office/home office (SOHO) and Internet of Things (IoT) devices, primarily targets U.S. military and associated networks. JDY functions as a distributed scanning and fingerprinting network, rapidly identifying vulnerable infrastructure shortly after public vulnerability disclosures, thereby facilitating swift exploitation by advanced persistent threat (APT) actors. This development underscores the escalating sophistication and persistence of state-sponsored cyber threats, particularly those emanating from China. The rapid operationalization of reconnaissance data by APT groups highlights the critical need for organizations, especially within the defense sector, to enhance their cybersecurity posture, promptly apply patches, and implement robust monitoring to detect and mitigate such threats.
1 month ago
Kill Chain
CISA Mandates Immediate Patching of Check Point VPN Vulnerability Exploited by Qilin Ransomware
In early May 2026, a critical vulnerability (CVE-2026-50751) in Check Point's Remote Access VPN and Mobile Access products was exploited by Qilin ransomware affiliates. This flaw allowed unauthenticated remote attackers to bypass authentication and establish VPN connections on systems configured with the deprecated IKEv1 protocol. The attacks led to breaches in several organizations worldwide, prompting Check Point to release security updates on June 8, 2026. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/?utm_source=openai)) The exploitation of this vulnerability underscores the persistent threat posed by ransomware groups targeting outdated protocols. Organizations are urged to apply patches promptly and review their VPN configurations to mitigate similar risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-check-point-flaw-exploited-by-ransomware-gangs/?utm_source=openai))
1 month ago
Kill Chain
Russian Hackers Exploit WinRAR Vulnerability CVE-2025-8088
In mid-2025, Russian state-sponsored threat groups, including RomCom (also known as Storm-0978), exploited a critical vulnerability in WinRAR (CVE-2025-8088) to target Ukrainian military and government organizations. The flaw, a path traversal vulnerability, allowed attackers to execute arbitrary code by delivering specially crafted RAR archives via spear-phishing emails. These campaigns led to unauthorized access, data theft, and potential disruption of critical operations within the targeted entities. Despite the release of WinRAR version 7.13 in July 2025, which addressed this vulnerability, many systems remained unpatched due to the software's lack of an automatic update mechanism. This oversight has enabled continued exploitation by various threat actors, underscoring the importance of timely software updates and robust cybersecurity practices to mitigate such risks.
1 month ago
Kill Chain
Russian-Aligned Groups Exploit WinRAR Vulnerability to Target Ukrainian Organizations
In June 2026, cybersecurity researchers identified that Russian-aligned groups, Earth Dahu (Gamaredon) and SHADOW-EARTH-066 (UAC-0226), continued exploiting a critical vulnerability in WinRAR (CVE-2025-8088) to target Ukrainian organizations. This path traversal flaw allows attackers to execute arbitrary code by crafting malicious archive files. Despite a patch being released in July 2025, the absence of automatic updates in WinRAR has left many systems vulnerable. The attackers utilized this exploit to deploy information-stealing malware, such as GIFTEDCROOK, which harvests sensitive data from infected systems. The persistent exploitation of CVE-2025-8088 underscores the critical importance of timely software updates and the risks associated with unpatched vulnerabilities. Organizations are urged to manually update WinRAR to version 7.13 or later to mitigate this threat. ([windowscentral.com](https://www.windowscentral.com/software-apps/new-winrar-zero-day-pc-vulnerability-exploited-by-hackers-what-you-need-to-know?utm_source=openai))
1 month ago
Kill Chain
U.S. Military's Covert Use of GPS for Encrypted Key Distribution Unveiled
In June 2026, security researcher Steven Murdoch uncovered that the U.S. military has been utilizing public GPS signals to broadcast encrypted cryptographic keys for nearly two decades. This method effectively transformed GPS satellites into global 'numbers stations,' enabling the Over-the-Air Distribution (OTAD) and Over-the-Air Rekeying (OTAR) systems to remotely update cryptographic keys for military GPS receivers worldwide. The discovery highlights the military's innovative approach to secure key distribution without relying on physical couriers. ([404media.co](https://www.404media.co/the-u-s-military-quietly-turned-gps-into-a-global-numbers-station-evidence-suggests/?utm_source=openai)) This revelation underscores the critical importance of secure key management in military operations and the potential for leveraging existing infrastructure for covert communications. It also raises questions about the transparency of such methods and their implications for both military and civilian users of GPS technology.
1 month ago
Kill Chain
VerdantBamboo's Prolonged Cyber Espionage via BRICKSTORM Backdoor
In September 2025, cybersecurity firm Volexity identified a prolonged cyber espionage campaign by the Chinese state-sponsored group VerdantBamboo, also known as UNC5221. The attackers exploited a local privilege escalation vulnerability in an Egnyte Storage Sync appliance to deploy a BSD variant of the BRICKSTORM backdoor, maintaining undetected access for at least 18 months. This access facilitated further infiltration into the victim's Microsoft 365 environment and the deployment of additional malware, including PLENET and AGENTPSD, on various network appliances. The campaign underscores the increasing targeting of network appliances and storage systems by sophisticated threat actors, exploiting their lack of endpoint detection capabilities to establish long-term persistence. Organizations are urged to enhance monitoring and security measures for such devices to mitigate similar threats.
1 month ago
Kill Chain
Asin Spyware: A New Threat to Arabic-Speaking Android Users
In early 2025, a sophisticated cyber espionage campaign emerged targeting Arabic-speaking Android users. The threat actor, identified as Arid Viper (also known as APT-C-23, Desert Falcon, or TAG-63), distributed a new spyware variant named Asin through deceptive applications. These malicious apps masqueraded as legitimate utilities, war-related updates, and government news sources, enticing users to download them. Once installed, Asin granted attackers extensive access to victims' devices, enabling the collection of sensitive information such as contacts, messages, and location data. The campaign's strategic use of culturally relevant themes and trusted app appearances significantly increased its effectiveness, leading to widespread data exfiltration and potential national security implications. This incident underscores a growing trend in cyber threats where attackers exploit regional conflicts and cultural contexts to enhance the credibility of their malicious campaigns. The use of sophisticated social engineering tactics, combined with the targeting of specific linguistic and cultural groups, highlights the evolving nature of cyber espionage. Organizations and individuals must remain vigilant, especially in regions experiencing geopolitical tensions, as such environments are increasingly exploited by threat actors to conduct targeted attacks.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports