✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Sicarii Ransomware: The 2024 False-Flag Attack with Unbreakable Encryption
In early 2024, a new ransomware variant dubbed 'Sicarii' surfaced, reportedly leveraging poorly designed, obfuscated code and incorporating Hebrew language elements that may serve as a false flag to mislead investigators about its origin. The ransomware, first detected in late 2023, compromises victim environments, encrypts files, and delivers notes demanding payment in cryptocurrency for data recovery. Although initial analysis indicates programming weaknesses, security researchers confirmed that its encryption implementation is resilient, making recovery without payment infeasible. The malware also exhibits unique lateral movement and persistence behaviors before exfiltrating data to attacker-controlled infrastructure. This incident is reflective of a broader increase in ransomware operations deploying deceptive attribution techniques and leveraging unconventional languages or scripts. The emergence of ‘Sicarii’ underscores the persistent threat and ever-evolving tactics used by ransomware groups to evade detection and complicate response efforts for organizations worldwide.
6 months ago
Kill Chain
Fortinet 2026 Breach: Authentication Bypass via FortiCloud SSO Drives Widespread Exploitation
In January 2026, Fortinet suffered a critical security incident when attackers exploited CVE-2026-24858, an authentication bypass vulnerability impacting FortiCloud SSO on key products like FortiOS, FortiManager, FortiWeb, FortiProxy, and FortiAnalyzer. Malicious actors with valid FortiCloud accounts could access devices registered to other users, enabling unauthorized firewall changes, new privileged account creation, and illicit VPN reconfiguration, even on systems patched for earlier SSO flaws. Fortinet responded by temporarily disabling and then remediating FortiCloud SSO, and CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. This incident underscores the risks of centralized identity platforms and SSO misconfigurations, as well as the persistent attacker interest in cloud-managed network appliances. Growing exploitation of authentication bypass vulnerabilities has regulatory and operational implications for organizations reliant on integrated cloud services.
6 months ago
Kill Chain
Fake Dating App Used to Deliver Android Spyware in Pakistan
In early 2024, an Android spyware campaign was uncovered by ESET researchers targeting users in Pakistan via a fraudulent dating app masquerading as a legitimate platform. The attackers lured victims using romance scam tactics, convincing users to download the malicious app outside of trusted marketplaces. Once installed, the spyware harvested sensitive data including call logs, messages, and device information, forwarding it to remote command-and-control servers linked to an ongoing espionage operation. The threat actors exhibited targeted behavior, indicating a capability for victim profiling and data exfiltration on mobile devices. This incident underscores a broader cybersecurity trend: growing use of socially engineered lures and repurposed surveillance tooling in region-specific espionage. Mobile attack vectors are increasingly leveraged for targeted intelligence gathering, amplifying urgency for robust defenses and heightened awareness of app distribution risks.
6 months ago
Kill Chain
Oracle WebLogic Faces Automated Exploit Attempts Targeting CVE-2026-21962
In January 2026, organizations running Oracle WebLogic servers were targeted by a suspicious HTTP exploit attempt leveraging CVE-2026-21962—a recently patched vulnerability with potential for remote code execution. A series of probing requests, traced to a Russian IP address, used manipulated HTTP headers and base64-encoded payloads aiming for potential command injection via WebLogic’s ProxyServlet endpoint. While analysis suggests some exploit attempts may have involved AI-generated slop or automated scanners, reputable sources including detection from security monitors confirmed that real threats actively pursued the vulnerability, making it a high-priority concern for unpatched WebLogic deployments. No widespread compromise has yet been reported, but exposure left unaddressed might allow threat actors illicit server access or lateral movement. This incident is significant as it highlights the rapid weaponization and opportunistic scanning of newly disclosed vulnerabilities, including the use of automated tools and potentially generative AI to accelerate exploit development. The event demonstrates the need for organizations to apply patches promptly and to monitor for unusual web request patterns immediately after vulnerability disclosures.
6 months ago
Kill Chain
WinRAR 2025: Nation-State & Cybercrime Groups Exploit Six-Month Software Flaw
In late July 2025, Google Threat Intelligence Group reported that both nation-state actors and financially motivated cybercriminals are actively exploiting a critical WinRAR path traversal vulnerability (CVE-2025-8088) that remained unpatched for over six months. The flaw was widely abused starting two weeks before RARLAB released a fix, allowing attackers to craft specially designed archive files. These malicious files executed code or dropped malware undetected onto victim systems, targeting government, military, and technology sectors—most notably Ukrainian entities—while criminal groups focused campaigns in Latin America, Indonesia, and Brazil. The widespread exploitation continues, leveraging malware and remote access tools for espionage and credential theft. The current landscape highlights accelerated adoption of public exploit tools by both advanced persistent threats and opportunistic criminals. The event underscores urgent industry challenges in rapid patching, software supply chain trust, and the escalating convergence of state and criminal cyber operations sharing technical tradecraft.
6 months ago
Kill Chain
Enterprise AI at Risk: Hackers Hijack Exposed LLM Endpoints in Bizarre Bazaar Operation
In early June 2024, security researchers revealed an active campaign—dubbed the Bizarre Bazaar operation—where threat actors systematically scanned for and exploited publicly exposed Large Language Model (LLM) service endpoints. Attackers hijacked these AI/ML endpoints by bypassing inadequate API controls and leveraging unsecured cloud configurations, enabling unauthorized access to advanced AI resources. Compromised infrastructure became part of an underground market offering illicit AI compute power, leading to business risks ranging from intellectual property leakage to tool misuse and service disruption for impacted organizations. This incident spotlights the growing exploitation of AI infrastructure, with attackers rapidly adopting novel tactics as organizations rush to deploy LLMs. Weak segmentation, lack of egress controls, and poor visibility have left many organizations vulnerable to sophisticated abuse, elevating urgency for robust enterprise AI security and compliance measures.
6 months ago
Kill Chain
SolarWinds Web Help Desk Flaws: Critical RCE and Authentication Bypass in 2024
In June 2024, SolarWinds disclosed and patched multiple critical vulnerabilities in its Web Help Desk software, including an authentication bypass (CVE-2024-28995) and a remote command execution (RCE) flaw. These security issues, if left unpatched, allow attackers to compromise systems with minimal or no authentication, granting them access to execute arbitrary commands and potentially control affected servers. SolarWinds urged its customers to update immediately and disclosed that no in-the-wild exploitation had been confirmed at the time of announcement, but the severity of the flaws warranted immediate action across enterprise environments. This incident is particularly relevant due to a surge in software supply chain and IT management platform attacks, where adversaries exploit widely used admin tools to gain privileged access. Critical RCE and authentication vulnerabilities present potent risks to organizations, intensifying regulatory scrutiny and heightening the importance of timely patch management and proactive security measures.
6 months ago
Kill Chain
New Sandbox Escape Flaws in n8n Expose Instances to Remote Code Execution
In January 2026, security researchers uncovered two critical sandbox escape vulnerabilities in the popular n8n workflow automation platform, identified as CVE-2026-1470 and CVE-2026-0863. The flaws allowed authenticated users to exploit weaknesses in JavaScript and Python sandboxing mechanisms, enabling remote code execution on affected self-hosted instances. Attackers with valid user credentials could abuse these vulnerabilities to gain control of underlying systems, access sensitive data, and potentially compromise integrated services. Despite requiring authentication, the ease of privilege escalation and potential for lateral movement made these vulnerabilities highly impactful. This incident is highly significant given the large number of exposed n8n instances and the growing reliance on workflow automation by organizations worldwide. The vulnerabilities underline persistent challenges in securely sandboxing dynamic scripting languages, a common risk in platforms that allow code-based automation or AI integrations. The slow patching pace also highlights the pressing need for improved vulnerability management across self-hosted cloud infrastructure.
6 months ago
Kill Chain
Fake PyPI Spellchecker Packages Delivered RAT in Supply Chain Attack (2026)
In early 2026, security researchers uncovered a supply chain attack involving two malicious packages—spellcheckerpy and spellcheckpy—distributed on the popular Python Package Index (PyPI). Masquerading as legitimate spellchecking tools, these packages were downloaded over 1,000 times before removal, each covertly containing a remote access trojan (RAT). When unsuspecting developers installed the packages, attackers could gain persistent access to compromised systems, enabling data exfiltration, lateral movement, and remote command execution. No specific organizational victims were named, but the risk extended globally to Python developers and projects that leveraged these components. This incident is emblematic of the growing trend of supply chain attacks targeting open source repositories, exploiting trust in widely used ecosystems like PyPI. As software supply chains become common attack vectors, organizations face heightened pressure to vet dependencies and implement controls to prevent compromise via upstream components.
6 months ago
Kill Chain
Exposed Interfaces & Supply Chain Risks: The 2026 Moltbot AI Assistant Breach
In January 2026, researchers uncovered widespread security vulnerabilities in Moltbot (formerly Clawdbot), an open-source AI assistant that achieved viral adoption among both consumers and employees in the enterprise sector. Due to prevalent misconfigurations—specifically, exposed admin interfaces and reverse proxy errors—hundreds of Moltbot instances were accessible online, allowing unauthenticated attackers to steal API keys, OAuth tokens, credentials, message histories, and even execute commands remotely with system-level permissions. Additional risks arose as malicious skills (modules) could be planted in the official registry, rapidly propagating supply-chain threats to unsuspecting enterprise and developer systems, further compounded by the assistant lacking sandboxing or privilege separation by default. This incident highlights a growing trend where AI/GenAI tools, easily adopted outside corporate IT control, create new vectors for credential theft, data leakage, and lateral movement. As attackers focus on AI-driven endpoints and shadow IT, failure to enforce zero trust, segmentation, and robust monitoring introduces significant business risk and regulatory exposure.
6 months ago
Kill Chain
Fortinet Authentication Bypass: CVE-2026-24858 (2026 Breach & Response)
In January 2026, Fortinet released emergency security patches to address a critical authentication bypass vulnerability (CVE-2026-24858, CVSS 9.4) actively exploited in the wild. Attackers leveraged the flaw in FortiOS's Single Sign-On (SSO) feature, bypassing authentication to gain unauthorized access to sensitive systems including FortiManager and FortiAnalyzer. The incident highlights the risks of unpatched perimeter defenses, with exploitation enabling potential lateral movement, privilege escalation, and access to business-critical data or control systems—potentially at scale for unremediated customers. This event is significant given the continued targeting of network infrastructure through novel bypass techniques. Escalating regulatory scrutiny and threat actor sophistication underscore the need for timely patching, robust segmentation, and ongoing monitoring of privileged identity solutions.
6 months ago
Kill Chain
Google Flags Ongoing Exploitation of WinRAR CVE-2025-8088 by Elite Threat Actors
In July 2025, a critical vulnerability (CVE-2025-8088) in RARLAB WinRAR was identified and subsequently patched, but not before multiple threat actors, including government-backed groups from Russia and China as well as financially motivated cybercriminals, actively exploited it. Attackers leveraged the flaw as an initial access vector, distributing diverse malicious payloads to compromise targeted systems. The exploitation campaign enabled unauthorized access to sensitive environments and facilitated follow-on activities such as lateral movement and data exfiltration, raising serious concerns for organizations and individuals relying on WinRAR for file management. This incident is significant as it highlights the speed and sophistication with which both nation-state and financially driven attackers weaponize zero-day vulnerabilities. The continued exploitation of unpatched systems following disclosure underscores the persistent risks organizations face from lagging patch cycles and evolving adversary tactics.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports