The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Defense/Space
Breach intelligence, attack campaigns, and threat reports targeting the Defense/Space sector.
Explore Other Sectors
Defense/Space Threat Reports
Critical LabVIEW 2025 Vulnerabilities Expose Industrial Control Systems to Code Execution Risk
In December 2025, multiple critical vulnerabilities (CVE-2025-64461 through CVE-2025-64469) were disclosed in National Instruments LabVIEW, a widely used industrial control software. The flaws, which include out-of-bounds write, out-of-bounds read, use-after-free, and stack-based buffer overflow, enable attackers to execute arbitrary code or exfiltrate information when a user opens a specially crafted VI file. Impacted versions span from LabVIEW 2021 up to 2025 Q3, affecting sectors such as critical manufacturing, defense, IT, and transportation globally. National Instruments released patches addressing these flaws, with older versions receiving limited or no support. Though there have been no reports of active exploitation, this incident highlights the persistent risk of supply chain and software vulnerabilities in critical ICS environments. Recent trends show a rise in sophisticated attacks leveraging user interaction and file-based exploits, emphasizing the growing need for robust patch management and secure software usage.
8 months ago
Kill Chain
Cisco 2025 AsyncOS Zero-Day: UAT-9686 Exploitation of Email Gateway Appliances
In late November 2025, Cisco discovered a major cybersecurity incident involving active exploitation of an unpatched zero-day vulnerability (CVE-2025-20393) in its AsyncOS operating system, impacting Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances. The flaw, leveraged exclusively on internet-facing appliances with non-standard configurations, enables remote code execution as root when the Spam Quarantine feature is exposed. Attribution points to UAT-9686, a Chinese-nexus advanced persistent threat actor, utilizing malware such as AquaShell, AquaTunnel, Chisel, and AquaPurge for backdoor access, lateral movement, and log deletion. The campaign has resulted in persistent compromise, requiring full appliance rebuilds for remediation. This incident underscores the persisting risk that unpatched zero-days pose to enterprise infrastructure, particularly from advanced threat actors using sophisticated malware implant chains. It illustrates a broader industry trend of increasingly swift exploitation of newly discovered vulnerabilities and public toolkits by nation-state actors.
8 months ago
Kill Chain
APT28 Targeted Ukrainian UKR.net Users in Sophisticated Credential Phishing Campaign (2024–2025)
Between June 2024 and April 2025, the Russian state-sponsored group APT28 orchestrated a prolonged credential harvesting operation targeting users of UKR.net, one of Ukraine’s most popular webmail and news platforms. Threat intelligence from Recorded Future’s Insikt Group indicates that the attackers leveraged spear-phishing emails, cleverly masquerading as legitimate UKR.net communications, to deceive victims into disclosing their login details on malicious lookalike sites. This campaign continued APT28’s longstanding focus on geopolitical and military targets associated with Ukraine, and raises serious concerns about national security and the exposure of sensitive communications during a period of heightened regional conflict. The incident spotlights a surge in state-sponsored credential theft using advanced social engineering, capitalization on trusted local brands, and persistent, evolving methodologies. As phishing techniques become more adept at bypassing basic controls, organizations are under pressure to bolster identity protection, phishing awareness, and multifactor authentication while aligning closely with regulatory guidance for detection and response.
8 months ago
Kill Chain
How BlueDelta (APT28) Targeted UKR.NET with Persistent Credential Harvesting (2024-2025)
Between June 2024 and April 2025, Russian state-sponsored threat group BlueDelta (APT28) orchestrated a persistent credential-harvesting campaign targeting users of UKR.NET, a leading Ukrainian webmail and news service. The threat actor employed convincing UKR.NET-lookalike login portals hosted on free services like Mocky, DNS EXIT, ngrok, and Serveo to steal usernames, passwords, and two-factor authentication codes. Phishing lures, primarily PDF attachments embedded with malicious links, were distributed to evade email scanning and sandboxing. Attackers continuously evolved their infrastructure—moving from compromised routers to anonymized tunneling platforms and adding new operational layers—reflecting increasing sophistication and resilience in support of GRU intelligence goals. This campaign exemplifies ongoing adaptations by nation-state actors to Western infrastructure takedowns and detection mechanisms, highlighting escalating risks to critical digital identities. Its advanced evasion techniques, modular infrastructure, and creative abuse of free online services signal a new phase in credential theft, underscoring the urgent need for organizations to reassess their defenses, particularly in the face of targeted phishing and lateral movement threats.
8 months ago
Kill Chain
AI Deepfake Geospatial Maps Incident Exposes New Security Frontier (2025)
In December 2025, a high-profile security research initiative revealed significant risks in the unchecked proliferation of AI-generated deepfake satellite maps. Sparked by the personal experience of a deepfake attack, a 17-year-old cybersecurity researcher demonstrated how adversaries could blend or fabricate satellite imagery using advanced GANs and diffusion models. These manipulations, undetectable to the naked eye, could mislead governments and emergency responders, mask critical infrastructure weaknesses, or facilitate large-scale misinformation campaigns with potentially catastrophic consequences on national security and public trust. The incident highlights a rising threat: geospatial deepfakes are evolving rapidly, outpacing current detection solutions and exposing new vulnerabilities in organizations' data and decision pipelines. Growing reliance on AI-generated imagery and the lack of robust verification frameworks make this an urgent issue for security leaders and risk managers in both public and private sectors.
8 months ago
Kill Chain
Güralp Systems 2025: Unauthenticated DoS Threat Hits Critical OT Devices
In December 2025, Güralp Systems disclosed a vulnerability affecting its Fortimus, Minimus, and Certimus Series devices, widely deployed in critical manufacturing and infrastructure sectors globally. The flaw (CVE-2025-14466) in the devices' web interface allows unauthenticated attackers on the network to send specially crafted HTTP requests, forcing the web service to restart and causing a temporary denial-of-service (DoS) condition. While the process automatically recovers, repeated exploitation could severely impact system availability for organizations relying on these seismic monitoring instruments. This type of DoS vulnerability is increasingly significant as threat actors increasingly target industrial control devices and operational technology (OT) with low-complexity attacks from unauthenticated vectors. Regulatory scrutiny of ICS network hygiene and cross-industry best practices is intensifying, pushing organizations to proactively address resource allocation and network exposure.
8 months ago
Kill Chain
CISA Orders Feds to Patch Active GeoServer XXE Vulnerability Exploitation
In June 2024, U.S. federal agencies were ordered by CISA to immediately patch a critical vulnerability in GeoServer, an open-source geospatial server widely deployed across government networks. Threat actors were observed actively exploiting an XML External Entity (XXE) injection flaw that allows attackers to access sensitive files, exfiltrate data, and potentially pivot within federal environments. The exploitation, which was discovered in the wild, underscores how quickly attackers can weaponize unpatched vulnerabilities to compromise mission-critical public sector infrastructure, putting sensitive government information at risk. This incident highlights a recent spike in the exploitation of internet-facing open-source software by both cybercriminal and nation-state groups. With regulatory pressure mounting around software supply chain risks and zero-day response times, such vulnerabilities remain a primary vehicle for initial access in sophisticated cyberattacks.
8 months ago
Kill Chain
How Salt Typhoon Infiltrated US Telecoms: Lessons from the 2024 Nation-State Attack
In early 2024, multiple major US telecommunications providers were targeted in a sophisticated nation-state attack attributed to Salt Typhoon, a Chinese-affiliated APT group. The attackers exploited unencrypted and east-west traffic flows within provider networks, bypassing conventional perimeter defenses to gain persistent access to sensitive infrastructure and intercept data in transit. Salt Typhoon leveraged advanced lateral movement and covert exfiltration techniques, enabling them to collect confidential communications and network architecture details. The incident led to significant operational risks, regulatory scrutiny, and concern within the telecom and national security sectors. This breach highlights a surge in highly targeted attacks on critical infrastructure, as nation-state actors exploit unencrypted traffic and insufficient internal segmentation. Current attacks reflect a broader strategic trend, with organizations facing pressure to modernize controls to address evolving threat vectors and international cyber-risk dynamics.
8 months ago
Kill Chain
NANOREMOTE: Google Drive-Enabled APT Breach Targets Global Sectors in 2025
In late 2025, security researchers discovered a sophisticated cyber-espionage campaign leveraging a new Windows backdoor known as NANOREMOTE. This malware, attributed to the Chinese-linked threat cluster REF7707 (also called Jewelbug), exploited the Google Drive API for covert command-and-control and data exfiltration. Driven by a loader mimicking legitimate security software, the attack targeted government, defense, telecommunications, education, and aviation organizations across Southeast Asia and South America. NANOREMOTE's powerful features supported reconnaissance, file operations, and encrypted communications, enabling stealthy operations and persistent access for attackers. The initial infection vector remains unknown, but the malware's modular task management and file transfer facilities allowed efficient data theft and staged payload delivery undetected by many security controls. This incident exemplifies emerging threat trends where advanced persistent threat actors abuse benign, widely trusted cloud APIs to hide their operations. As similar tradecraft spreads, organizations face heightened risks of deep lateral movement, multifaceted data breaches, and regulatory scrutiny. Continuous improvements in east-west security and traffic visibility are critical as attackers innovate with cloud-native exfiltration channels.
8 months ago
Kill Chain
CISA Adds OSGeo GeoServer CVE-2025-58360 to Known Exploited Vulnerabilities List
In December 2025, CISA added CVE-2025-58360, an Improper Restriction of XML External Entity Reference vulnerability in OSGeo GeoServer, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming evidence of active exploitation in the wild. The vulnerability allows remote attackers to exploit XML parsing weaknesses to access sensitive data or execute arbitrary code by submitting malicious crafted XML to the GeoServer platform, which is widely used for geospatial data services. Malicious actors leveraging this flaw can bypass security controls, potentially leading to significant data breaches or operational disruption across organizations dependent on GeoServer. This incident highlights the increasing urgency of remediating software supply chain and core infrastructure vulnerabilities exploited in real-world attacks. The active exploitation of such high-impact flaws is driving regulatory entities and private organizations to re-examine patch management, incident response, and zero trust controls for critical applications.
8 months ago
Kill Chain
Critical Siemens 2025 IAM Client TLS Flaw Exposes Industrial Environments
In December 2025, Siemens disclosed a critical vulnerability (CVE-2025-40800) in the IAM Client component used across key products such as COMOS, NX, Simcenter, and Solid Edge. The flaw stemmed from improper validation of server certificates during TLS sessions, exposing organizations to potential Man-in-the-Middle (MitM) attacks by unauthenticated remote attackers. Impacting deployments globally within the critical manufacturing sector, the vulnerability received a CVSS v4 base score of 9.1, reflecting its high risk. While patches are available for most products, a fix for COMOS V10.6 was unavailable at disclosure. This incident highlights ongoing risks from certificate handling errors, which remain common initial access vectors. As industrial networks become more interconnected, failures in basic cryptographic hygiene, especially in authentication mechanisms, are increasingly targeted by sophisticated attackers leveraging supply chain or network-layer attacks.
8 months ago
Kill Chain
Multi-APT Exploitation of WinRAR CVE-2025-6218: A Recurring Supply Chain Risk
In mid to late 2025, a critical vulnerability in WinRAR (CVE-2025-6218), enabling path traversal and arbitrary code execution on Windows systems, was exploited by multiple sophisticated threat groups. Notably, GOFFEE, Bitter APT (APT-C-08), and the Russian state-linked Gamaredon leveraged spear-phishing emails with booby-trapped RAR archives to compromise targets, including Ukrainian government, South Asian organizations, and others. Attackers used malicious archives to persistently install remote access malware, capable of keylogging, data exfiltration, and credential theft, while some incidents involved destructive attacks deploying wiper malware. The vulnerability was patched in June 2025, but active exploitation continued through the year, forcing urgent defensive measures across critical sectors. This incident highlights the rapid weaponization of newly disclosed vulnerabilities by nation-state and criminal groups, as well as the challenges organizations face in managing unstructured file transfer risks. The coordinated exploitation across regions and APTs underscores an upward trend in supply chain and endpoint software attacks, increasing regulatory and operational urgency to close patching and phishing resilience gaps.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports