✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Unveiling the Wormable XMRig Campaign: A Deep Dive into BYOVD Exploits and Time-Based Logic Bombs
In February 2026, cybersecurity researchers uncovered a sophisticated cryptojacking campaign that utilized pirated software bundles to deploy a customized XMRig miner on compromised systems. The malware exhibited worm-like capabilities, spreading via external storage devices, and employed a 'Bring Your Own Vulnerable Driver' (BYOVD) technique to escalate privileges. Additionally, it incorporated a time-based logic bomb set to deactivate the malware after December 23, 2025, indicating a planned operational timeframe. This campaign underscores the evolving tactics of cybercriminals, combining social engineering, legitimate software exploitation, and advanced persistence mechanisms to maximize cryptocurrency mining output. The use of BYOVD exploits and logic bombs highlights the need for robust security measures to detect and mitigate such multifaceted threats.
5 months ago
Kill Chain
APT28's Operation MacroMaze: A New Wave of Cyber Espionage
Between September 2025 and January 2026, the Russian state-sponsored threat actor APT28 conducted Operation MacroMaze, targeting entities in Western and Central Europe. The campaign utilized spear-phishing emails containing malicious Word documents with embedded macros. These macros exploited legitimate services like webhook[.]site for command-and-control and data exfiltration, employing techniques such as headless browser execution and keyboard simulation to evade detection. ([thehackernews.com](https://thehackernews.com/2026/02/apt28-targeted-european-entities-using.html?utm_source=openai)) This incident underscores the evolving tactics of APT28, highlighting their ability to adapt and leverage basic tools in sophisticated ways. The use of legitimate services for malicious purposes poses significant challenges for detection and mitigation, emphasizing the need for robust cybersecurity measures and continuous monitoring.
5 months ago
Kill Chain
Unveiling the Malicious JPEG Infostealer Campaign of February 2026
In February 2026, a sophisticated malware campaign was identified, leveraging steganographic techniques to embed malicious code within JPEG image files. Unsuspecting users were tricked into downloading these seemingly benign images, which, upon execution, initiated a multi-stage infection process. The primary payload was an infostealer designed to extract sensitive data, including browser credentials and system information, while maintaining communication with a command-and-control server. This method allowed attackers to exfiltrate data stealthily, minimizing detection by traditional security measures. This incident underscores the evolving tactics of cybercriminals, who are increasingly employing advanced obfuscation methods like steganography to bypass security defenses. The use of common file formats, such as JPEGs, as carriers for malware highlights the need for enhanced vigilance and the adoption of comprehensive security solutions capable of detecting such covert threats.
5 months ago
Kill Chain
Critical Vulnerabilities in Major Password Managers Expose Millions
In February 2026, researchers from ETH Zurich and Università della Svizzera italiana identified 25 critical vulnerabilities across three major password managers: Bitwarden, LastPass, and Dashlane. These flaws, affecting over 60 million users, were categorized into key escrow mechanisms, item-level vault encryption, sharing features, and backward compatibility issues. Exploiting these vulnerabilities could allow attackers to bypass zero-knowledge encryption claims, leading to unauthorized access and modification of users' stored passwords and vault data. ([cybersecuritynews.com](https://cybersecuritynews.com/password-managers-vulnerability/?utm_source=openai)) The study underscores the ongoing challenges in balancing security and user convenience in password management solutions. While the affected companies have begun implementing fixes, the incident highlights the necessity for continuous evaluation and enhancement of security protocols to protect sensitive user information.
5 months ago
Kill Chain
Arkanix Stealer: A Brief Yet Impactful AI-Assisted Malware Campaign
In late 2025, the Arkanix Stealer emerged as an AI-assisted information-stealing malware, promoted on dark web forums and distributed through Discord channels. The malware targeted Windows systems, employing advanced evasion techniques to bypass security controls. It harvested sensitive data, including browser credentials, cryptocurrency wallets, VPN accounts, and system metadata, which was then exfiltrated to attacker-controlled infrastructure. The operation was short-lived, with the author dismantling the control panel and Discord server within two months, suggesting a quick financial gain motive. This incident underscores the growing trend of cybercriminals leveraging AI to rapidly develop and deploy sophisticated malware, reducing development time and costs. The swift emergence and disappearance of such threats pose significant challenges for detection and mitigation, highlighting the need for continuous vigilance and adaptive security measures.
5 months ago
Kill Chain
AI-Powered Cyberattack Compromises 600 Fortinet Firewalls in 2026
Between January 11 and February 18, 2026, a Russian-speaking threat actor utilized generative AI services to compromise over 600 FortiGate firewalls across 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking multi-factor authentication, without leveraging any known vulnerabilities. Once access was gained, AI-assisted tools were employed to automate reconnaissance, extract configurations, and facilitate lateral movement within the networks. This campaign underscores the evolving threat landscape where AI technologies are being harnessed to amplify the capabilities of less sophisticated attackers, enabling them to execute large-scale intrusions with increased efficiency. Organizations must prioritize fundamental security measures, including securing management interfaces, enforcing strong authentication protocols, and maintaining vigilant monitoring to mitigate such AI-augmented threats.
5 months ago
Kill Chain
CISA Highlights Critical Roundcube Vulnerabilities Amid Active Exploitation
In February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities affecting Roundcube webmail software to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. The first, CVE-2025-49113, is a deserialization flaw allowing remote code execution by authenticated users due to improper validation of the '_from' parameter in 'upload.php'. The second, CVE-2025-68461, is a cross-site scripting vulnerability via the 'animate' tag in SVG documents. Both vulnerabilities have been exploited by threat actors, including nation-state groups like APT28 and Winter Vivern, to steal login credentials and spy on sensitive communications. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent targeting of webmail platforms by sophisticated adversaries. Organizations using Roundcube are urged to apply the latest security patches promptly to mitigate potential risks. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai))
5 months ago
Kill Chain
Starkiller Phishing Kit: A New Era of MFA Bypass Attacks
In February 2026, cybersecurity researchers uncovered 'Starkiller,' a sophisticated phishing-as-a-service platform developed by the cybercrime group Jinkusu. Unlike traditional phishing kits that use static replicas of login pages, Starkiller employs a headless Chrome browser within a Docker container to proxy live login pages of targeted brands such as Microsoft, Google, and Apple. This method allows attackers to capture user credentials, including multi-factor authentication (MFA) codes, in real-time by acting as a man-in-the-middle between the victim and the legitimate site. The platform offers features like keylogging, session token theft, geo-tracking, and real-time session monitoring, all accessible through an intuitive dashboard that lowers the technical barrier for cybercriminals. ([krebsonsecurity.com](https://krebsonsecurity.com/2026/02/starkiller-phishing-service-proxies-real-login-pages-mfa/?utm_source=openai)) The emergence of Starkiller signifies a significant escalation in phishing tactics, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling. Its ability to bypass MFA protections and its user-friendly interface make it a potent tool for attackers, necessitating a shift in defensive strategies toward behavioral detection and identity-aware analysis to effectively counter such advanced threats. ([darkreading.com](https://www.darkreading.com/threat-intelligence/starkiller-phishing-kit-mfa?utm_source=openai))
5 months ago
Kill Chain
React2Shell Exploitation 2025: A Wake-Up Call for Web Security
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed in React Server Components, affecting versions 19.0 through 19.2.0. This flaw allowed unauthenticated remote code execution via crafted HTTP requests. Within hours of disclosure, state-sponsored threat actors, including Chinese groups Earth Lamia and Jackpot Panda, as well as North Korean operatives, began exploiting the vulnerability to deploy malware, establish persistent backdoors, and conduct cyber-espionage activities. The widespread use of React in web applications amplified the impact, leading to numerous system compromises across various sectors. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The rapid exploitation of React2Shell underscores the increasing speed at which threat actors weaponize newly disclosed vulnerabilities. Organizations are urged to prioritize timely patching and enhance monitoring to mitigate risks associated with such critical flaws.
5 months ago
Kill Chain
AI-Powered Cyberattack Compromises Hundreds of FortiGate Devices Globally
Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor leveraged commercial generative AI services to compromise over 600 FortiGate devices across more than 55 countries. The attackers exploited exposed management ports and weak, single-factor authentication credentials, without utilizing any known FortiGate vulnerabilities. This campaign enabled the threat actor to extract full device configurations, including credentials and network topology information, facilitating further post-exploitation activities such as Active Directory compromise and credential harvesting. ([aws.amazon.com](https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools lower the technical barrier for cybercriminals, allowing even those with limited skills to execute large-scale attacks. Organizations must prioritize fundamental security measures, including securing management interfaces, enforcing strong authentication protocols, and maintaining vigilant monitoring to detect and respond to such AI-augmented threats.
5 months ago
Kill Chain
North Korean IT Workers Exploit Remote Work to Infiltrate U.S. Companies in 2025
In 2025, U.S. authorities uncovered a sophisticated scheme where North Korean IT workers, using stolen or fabricated identities, secured remote positions within over 300 U.S. companies. These operatives, often based in China and Russia, infiltrated organizations by posing as legitimate American employees, thereby accessing sensitive corporate data and systems. The illicit earnings, estimated at over $88 million, were funneled back to North Korea to support its weapons programs. ([forbes.com](https://www.forbes.com/sites/alonzomartinez/2025/04/25/north-korean-hackers-pose-as-remote-workers-to-infiltrate-us-firms/?utm_source=openai)) This incident underscores the escalating threat of nation-state actors exploiting remote work vulnerabilities to bypass traditional security measures. The use of advanced tactics, including AI-generated profiles and deepfake technologies, highlights the need for enhanced identity verification processes and continuous monitoring of remote access points to safeguard organizational assets. ([fortune.com](https://fortune.com/2025/08/04/north-korean-it-worker-infiltrations-exploded/?utm_source=openai))
5 months ago
Kill Chain
UMMC Ransomware Attack Disrupts Healthcare Services in Mississippi
In February 2026, the University of Mississippi Medical Center (UMMC) experienced a significant ransomware attack that led to the closure of all its clinics statewide and the cancellation of elective procedures. The cyberattack compromised multiple IT systems, including the Epic electronic medical records platform, necessitating the implementation of downtime procedures to maintain patient care. Emergency services remained operational, but the disruption affected numerous outpatient services and appointments. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/university-of-mississippi-medical-center-closes-clinics-after-ransomware-attack/?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting healthcare institutions, highlighting the critical need for robust cybersecurity measures to protect sensitive patient data and ensure the continuity of medical services.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports