✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Jaguar Land Rover's 2025 Ransomware Ordeal: A Wake-Up Call for the Automotive Industry
In early September 2025, Jaguar Land Rover (JLR) experienced a significant ransomware attack attributed to the cybercriminal group Scattered Lapsus$ Hunters. This attack led to a complete halt in vehicle production across JLR's global facilities, including those in the UK, Slovakia, China, India, and Brazil. Employees were instructed to stay home, and the company faced substantial operational disruptions. The attackers, a coalition of groups including Scattered Spider, LAPSUS$, and ShinyHunters, employed sophisticated social engineering tactics to infiltrate JLR's systems, resulting in the encryption of critical data and systems. The incident underscored the vulnerabilities in the automotive industry's cybersecurity defenses and highlighted the evolving threat landscape posed by organized cybercriminal alliances. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/jaguar-land-rover-shuts-down-production-due-to-ransomware-attack-scattered-lapsus-usd-hunters-takes-responsibility?utm_source=openai)) This attack is emblematic of a broader trend where cybercriminal groups are forming alliances to enhance their capabilities and impact. The collaboration between Scattered Spider, LAPSUS$, and ShinyHunters into the Scattered Lapsus$ Hunters collective signifies a shift towards more organized and aggressive cyber extortion strategies. Organizations across industries must recognize the increasing sophistication of these threats and bolster their cybersecurity measures accordingly. ([techradar.com](https://www.techradar.com/pro/security/three-of-the-biggest-cybercrime-gangs-around-appear-to-be-teaming-up-which-could-be-bad-news-for-all-of-us?utm_source=openai))
6 months ago
Kill Chain
ShinyHunters' Exploitation of Salesforce: A 2025 Data Breach Analysis
In mid-2025, the cybercriminal group ShinyHunters orchestrated a series of sophisticated attacks targeting Salesforce instances across multiple organizations. Utilizing voice phishing (vishing) techniques, attackers impersonated IT support staff to deceive employees into authorizing malicious connected applications within their Salesforce environments. This strategy granted the attackers unauthorized access to vast amounts of sensitive customer data, including personally identifiable information (PII) and corporate records. Notable victims included Google, Workday, and Qantas, with data breaches exposing millions of records. The stolen data was subsequently used for extortion, with threats to publicly release the information unless ransom demands were met. ([forbes.com](https://www.forbes.com/councils/forbestechcouncil/2025/12/03/shinyhunters-salesloft-drift-and-the-case-for-dynamic-saas-security/?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, highlighting the increasing reliance on social engineering methods to exploit human vulnerabilities within organizations. The collaboration between ShinyHunters and other threat actors, such as Scattered Spider, indicates a trend towards more coordinated and aggressive cyberattacks. Organizations are urged to enhance their security awareness programs, implement robust multi-factor authentication protocols, and scrutinize third-party integrations to mitigate the risk of similar breaches. ([cyberpress.org](https://cyberpress.org/shinyhunters-salesforce-hack/?utm_source=openai))
6 months ago
Kill Chain
Quest KACE Desktop Authority 2025: Addressing Insecure Named Pipe Permissions
In January 2026, a security vulnerability (CVE-2025-67813) was identified in Quest KACE Desktop Authority versions up to 11.3.1. The issue involved insecure permissions on named pipes used for inter-process communication, potentially allowing unauthorized local users to access these pipes, leading to unintended interactions or privilege escalation within the application context. Quest addressed this vulnerability by releasing version 11.3.2 on November 3, 2025, which rectified the insecure permissions. Organizations using affected versions are urged to upgrade to the latest release to mitigate this risk. ([support.quest.com](https://support.quest.com/kace-desktop-authority/kb/4381743/quest-kace-desktop-authority-insecure-named-pipe-permissions-cve-2025-67813?utm_source=openai)) This incident underscores the critical importance of securing inter-process communication channels and implementing proper access controls to prevent unauthorized access and potential privilege escalation.
6 months ago
Kill Chain
MongoDB's 2025 MongoBleed Vulnerability: A Wake-Up Call for Database Security
In December 2025, a critical vulnerability known as MongoBleed (CVE-2025-14847) was discovered in MongoDB servers, allowing unauthenticated attackers to extract sensitive data from server memory. This flaw, stemming from improper handling of compressed network packets, exposed credentials, API keys, and personal information. Despite the release of patches, over 87,000 MongoDB instances remained vulnerable, leading to active exploitation and data breaches. ([cyberinsider.com](https://cyberinsider.com/over-87000-mongodb-instances-remain-exposed-to-mongobleed-attacks/?utm_source=openai)) The rapid exploitation of MongoBleed underscores the persistent risks associated with unpatched software and misconfigured databases. Organizations must prioritize timely updates and robust security configurations to mitigate such vulnerabilities.
6 months ago
Kill Chain
ShinyHunters Exploit SSO Vulnerabilities in 2026 Vishing Attacks
In January 2026, the cybercriminal group ShinyHunters orchestrated a series of sophisticated voice phishing (vishing) attacks targeting single sign-on (SSO) credentials across multiple organizations. By impersonating IT support personnel, they deceived employees into providing their SSO credentials and multi-factor authentication (MFA) codes on counterfeit login portals. This enabled unauthorized access to various connected SaaS applications, including Salesforce, Microsoft 365, and Slack, leading to significant data breaches. Notable companies such as Panera Bread, Crunchbase, and Betterment confirmed unauthorized access and data exfiltration resulting from these attacks. ([zerofox.com](https://www.zerofox.com/intelligence/flash-report-shinyhunters-sso-phishing-campaign/?utm_source=openai)) This incident underscores the evolving threat landscape where attackers combine social engineering with advanced phishing techniques to bypass MFA protections. The widespread adoption of SSO systems amplifies the potential impact of such breaches, as compromising a single account can grant access to multiple platforms. Organizations must enhance their security awareness training and implement robust monitoring to detect and mitigate such sophisticated attacks.
6 months ago
Kill Chain
Cloud Storage Payment Scam 2026: A Global Phishing Threat
In late 2025 and early 2026, a widespread phishing campaign targeted users globally with fraudulent emails claiming their cloud storage subscriptions were at risk due to payment failures. These emails, often personalized with the recipient's name, warned of imminent data loss and urged immediate action. Victims who clicked on the provided links were redirected to phishing sites mimicking legitimate cloud service portals, where they were prompted to enter sensitive information or make payments. The attackers exploited users' fears of losing valuable data to steal personal and financial information. This incident underscores the increasing sophistication of phishing attacks, particularly those leveraging social engineering tactics to impersonate trusted services. The prevalence of such scams highlights the critical need for heightened vigilance and robust cybersecurity measures to protect against evolving threats.
6 months ago
Kill Chain
Google Engineer Convicted of AI Trade Secrets Theft to China
In January 2026, former Google software engineer Linwei Ding was convicted on multiple counts of economic espionage and theft of trade secrets. Between May 2022 and April 2023, Ding illicitly transferred over 2,000 pages of confidential AI-related documents from Google's network to his personal cloud account. These documents detailed Google's proprietary AI supercomputing infrastructure, including custom Tensor Processing Unit (TPU) and Graphics Processing Unit (GPU) technologies, orchestration software for large-scale AI workloads, and SmartNIC networking technology. Concurrently, Ding secretly affiliated with two China-based technology companies, assuming roles such as Chief Technology Officer and CEO, and aimed to replicate Google's AI supercomputing capabilities in China. ([justice.gov](https://www.justice.gov/opa/pr/former-google-engineer-found-guilty-economic-espionage-and-theft-confidential-ai-technology?utm_source=openai)) This incident underscores the persistent threat of insider espionage within the tech industry, particularly concerning advanced AI technologies. It highlights the critical need for robust internal security measures and vigilant monitoring to protect intellectual property from unauthorized access and exfiltration.
6 months ago
Kill Chain
ShinyHunters 2026 Vishing Attacks Breach SaaS Platforms
In January 2026, the financially motivated hacking group ShinyHunters orchestrated a series of sophisticated voice phishing (vishing) attacks targeting employees of various organizations. By impersonating IT staff, they directed victims to fraudulent credential harvesting sites, capturing Single Sign-On (SSO) credentials and Multi-Factor Authentication (MFA) codes. This access enabled them to infiltrate cloud-based Software-as-a-Service (SaaS) platforms, exfiltrating sensitive data and internal communications, which were subsequently used for extortion purposes. The campaign notably affected platforms such as Okta, Microsoft 365, and Google Workspace, compromising numerous organizations across multiple sectors. This incident underscores the evolving tactics of cybercriminals, highlighting the increasing sophistication of social engineering methods to bypass traditional security measures. The reliance on vishing and real-time phishing kits to exploit identity providers and SaaS platforms emphasizes the urgent need for organizations to adopt phishing-resistant MFA solutions and enhance employee training to recognize and respond to such threats.
6 months ago
Kill Chain
Moltbot AI Agent Security Breach: A Wake-Up Call for AI Security
In January 2026, the open-source AI assistant Moltbot, formerly known as Clawdbot, faced significant cybersecurity scrutiny due to its extensive access to user systems. Security researchers discovered hundreds of exposed or poorly secured Moltbot control panels accessible on the public internet, revealing private data such as API keys and allowing unauthorized command execution. Additionally, vulnerabilities like susceptibility to prompt injection attacks and AI hallucinations were identified, raising concerns about the potential for data breaches and system compromises. These findings underscore the critical need for robust security measures in the deployment of AI agents to prevent unauthorized access and data exposure. This incident highlights the growing risks associated with AI agents as they become more integrated into organizational processes. The ease of access and control they offer can inadvertently introduce significant security vulnerabilities if not properly managed. As AI technologies continue to evolve and see wider adoption, it is imperative for organizations to implement stringent security protocols and continuous monitoring to safeguard against emerging threats posed by AI agents.
6 months ago
Kill Chain
Critical LLM Vulnerability: System Prompt Extraction via Form Fields
In January 2026, security researchers identified a critical vulnerability in Large Language Models (LLMs) integrated into AI assistants. Despite implementing architectural constraints to restrict chatbots to templated responses, attackers exploited the models' ability to populate form fields, enabling the extraction of system prompts. This method allowed unauthorized access to sensitive information, bypassing traditional output restrictions. The incident underscores the evolving nature of prompt injection attacks and the necessity for comprehensive security measures in AI deployments. As AI integration becomes more prevalent, understanding and mitigating such vulnerabilities is crucial to maintaining data integrity and user trust.
6 months ago
Kill Chain
Meta AI's 2024 Chatbot Vulnerability Exposes User Data
In December 2024, a critical vulnerability was discovered in Meta AI's chatbot platform, allowing unauthorized users to access private prompts and AI-generated responses of other users. The flaw involved manipulating unique identifiers in the browser's network traffic, enabling access to others' chatbot interactions without proper permission checks. Meta was notified on December 26, 2024, and patched the vulnerability by January 24, 2025. There was no evidence of the flaw being exploited in the wild. This incident underscores the importance of securing AI chatbot platforms against unauthorized access, especially as they handle sensitive user data. Organizations must implement robust authorization mechanisms and regularly audit their systems to prevent similar vulnerabilities.
6 months ago
Kill Chain
Introducing Julius: Enhancing AI Security with LLM Service Fingerprinting
In January 2026, Praetorian released Julius, an open-source tool designed to identify and fingerprint Large Language Model (LLM) services across corporate networks. Julius enables security teams to detect various LLM services, such as Ollama, LiteLLM, and Open WebUI, by analyzing endpoints and extracting information about the models in use. This tool addresses the growing challenge of unmanaged and potentially insecure LLM deployments within organizations, which can be exploited by attackers for unauthorized access, data exfiltration, or lateral movement within networks. The release of Julius is particularly timely given the increasing integration of LLMs into enterprise environments and the associated security risks. Recent incidents have highlighted vulnerabilities in LLM applications, including prompt injection attacks and data leakage, underscoring the need for robust detection and monitoring tools like Julius to enhance organizational security postures.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports