✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Mustang Panda’s 2025 Cyber Espionage: Updated COOLCLIENT Backdoor Hits Government
In late 2025, cyber espionage group Mustang Panda (also known as Earth Preta and Twill Typhoon) launched a series of targeted attacks against government entities, deploying an updated version of the COOLCLIENT backdoor. These intrusions leveraged spear-phishing and custom malware to establish persistent access, exfiltrate sensitive government data, and conduct surveillance. The campaign relied on advanced command-and-control infrastructure and encrypted traffic to evade detection, demonstrating the group’s evolving tactics and technical sophistication. The breach resulted in notable data theft and highlighted vulnerabilities in governmental East-West network security and policy enforcement. This incident underscores a rising trend of state-sponsored attackers continuously updating malware toolsets and intensifying operations against government organizations. The sophistication and stealth of these campaigns demand enhanced data protection, visibility, and zero trust network controls to meet regulatory and operational requirements.
6 months ago
Kill Chain
Critical vm2 Node.js Flaw Enables Sandbox Escape and Supply-Chain Exploit
In January 2026, a critical vulnerability (CVE-2026-22709, CVSS 9.8) was disclosed in the popular Node.js library vm2, enabling attackers to escape its JavaScript sandbox and execute arbitrary code on affected systems. The flaw, present in version 3.10.0, allowed exploitation via manipulation of Promise.prototype.then and Promise.prototype.catch, providing a direct path to remote code execution. Organizations relying on vm2 for untrusted code execution and sandboxing were at significant risk, with the vulnerability exposing underlying infrastructure to privilege escalation, data exfiltration, or supply-chain compromise. This incident highlights increased supply-chain risk in NPM ecosystems, where critical open-source dependencies like vm2 are often trusted by default. There is growing urgency as attackers increasingly target widely-used libraries to compromise downstream applications at scale, underscoring the need for stronger package vetting, runtime segmentation, and elastic incident response.
6 months ago
Kill Chain
Critical n8n Vulnerabilities Allow Authenticated Remote Code Execution (2026)
In January 2026, cybersecurity researchers uncovered two critical vulnerabilities in the n8n workflow automation platform, including a CVE-2026-1470 flaw (CVSS 9.9) which enables authenticated users to achieve remote code execution via eval injection. Discovered by the JFrog Security Research team, attackers exploiting these weaknesses could bypass the Expression system and execute arbitrary commands on affected servers. Successful exploitation could allow lateral movement and data exfiltration by leveraging internal automation integrations, putting sensitive business processes and connected services at significant risk. This incident underscores a rising trend of attackers targeting automation and orchestration platforms as high-value footholds in enterprise environments. With the increased adoption of low-code automation, vulnerabilities in such platforms can propagate risk across multiple systems, driving urgent need for software vendors and organizations to prioritize security reviews, patch management, and robust segmentation controls.
6 months ago
Kill Chain
Fake AI Coding Assistant Delivers Malware via VS Code Marketplace in 2026 Supply-Chain Attack
In January 2026, cybersecurity researchers discovered a malicious Visual Studio Code extension masquerading as "ClawdBot Agent - AI Coding Assistant" in the official VS Code Marketplace. The extension claimed to offer AI-assisted coding functionality but instead delivered a concealed malware payload to users who installed it. The attack leveraged the supply chain vector—abusing trust in a popular development marketplace—and could compromise the local development environment, providing the threat actor with unauthorized access and control over the affected system. This incident highlights the expanding risk of supply-chain attacks in developer ecosystems and raises concerns about the integrity of widely used software distribution platforms. This case underscores a rising trend of threat actors exploiting trusted software repositories to launch targeted malware campaigns. As AI coding assistants and marketplace extensions surge in popularity, organizations face mounting pressure to implement rigorous vetting and monitoring to protect software supply chains from increasingly sophisticated threats.
6 months ago
Kill Chain
SoundCloud’s 2024 Mega Breach: 29.8 Million User Records Exposed
In June 2024, SoundCloud suffered a major data breach compromising the personal and contact information of approximately 29.8 million user accounts. Attackers infiltrated the audio streaming platform's systems and exfiltrated sensitive customer records, including names, email addresses, and other profile data, which were subsequently advertised on cybercriminal forums. Initial investigations suggest the threat actors exploited a weakness in SoundCloud’s platform, though details on the exact attack vector remain under investigation. The breach not only poses reputational risks but could also lead to targeted phishing and identity theft for impacted users. This incident underscores the growing trend of large-scale credential and data theft affecting prominent digital platforms globally. Organizations are facing mounting pressure from regulators and customers to bolster cloud security, enforce rigorous access controls, and demonstrate proactive incident response capabilities in line with privacy frameworks.
6 months ago
Kill Chain
Over 6,000 SmarterMail Servers Hijacked via Critical Authentication Bypass (2026)
In January 2026, over 6,000 SmarterMail servers were found exposed online and vulnerable due to a critical authentication bypass vulnerability (CVE-2026-23760). This flaw in the password reset API allowed unauthenticated attackers to reset administrator passwords, granting them full administrative access and enabling remote code execution on affected servers. Reports of in-the-wild exploitation emerged within days of public disclosure, prompting both mass, automated hijacking attacks and urgent guidance from governmental agencies. The vulnerability impacted organizations globally, particularly across North America and Asia, and posed significant risk to business continuity, privacy, and service integrity. This incident underlines rapid attacker adoption of zero-day vulnerabilities and the risks of delayed patching for internet-exposed business systems. With threat actors leveraging automation and targeting widely-used administrative interfaces, organizations must adopt faster patch cycles and stronger access controls to reduce exposure to similar authentication bypass attacks.
6 months ago
Kill Chain
HoneyMyte 2025 Cyberespionage Hits: Updated CoolClient and Credential Theft Campaigns
Between 2024 and 2025, the advanced persistent threat group HoneyMyte (aka Mustang Panda, Bronze President) orchestrated advanced espionage campaigns targeting government entities across Southeast Asia, Mongolia, Malaysia, Myanmar, and Europe. Using updated CoolClient backdoors, custom browser credential stealers, and sophisticated prying scripts, HoneyMyte achieved persistent access, broad network infiltration, and the theft of sensitive documents, credentials, and operational intelligence. Attackers exploited signed DLL sideloading, launched post-exploitation scripts, and used public file-sharing services for covert exfiltration, successfully bypassing traditional defense layers and maintaining long-term surveillance on official targets. This incident highlights the evolving techniques of APT campaigns with growing reliance on multi-stage malware, encrypted traffic, and cloud-based exfiltration channels. The sophistication and persistence demonstrated by HoneyMyte reflect a broader rise in state-sponsored cyber espionage, posing continuing challenges for organizations' detection and regulatory compliance efforts in 2025.
6 months ago
Kill Chain
Cellbreak: Critical Grist-Core Vulnerability Enables Remote Code Execution
In January 2026, a critical vulnerability (CVE-2026-24002, codename Cellbreak, CVSS 9.1) was disclosed in Grist-Core, an open-source spreadsheet-database platform. The flaw enabled attackers to leverage malicious spreadsheet formulas for remote code execution (RCE) on self-hosted Grist-Core servers. This vulnerability could grant adversaries full foothold on affected systems, leading to potential data exfiltration, lateral movement, and operational disruption for organizations running vulnerable deployments. Security researchers at Cyera Research Labs made the discovery public after coordinated disclosure and a patch release by Grist developers. The incident is particularly relevant due to the sharp increase in attacks targeting spreadsheet and application logic vulnerabilities—especially in open-source business tools. As attackers pivot toward supply chain and SaaS entry points, control weaknesses involving user-supplied formulas and embedded code in collaborative apps persist as a high-risk vector.
6 months ago
Kill Chain
Pakistan-Linked APT Launches Gopher Strike & Sheet Attack Against Indian Government in 2025
In September 2025, cybersecurity researchers uncovered coordinated cyber campaigns—dubbed Gopher Strike and Sheet Attack—targeting Indian government entities. Attributed to a Pakistan-linked Advanced Persistent Threat (APT) group, the operations leveraged novel, undocumented tactics involving phishing and multi-stage malware to compromise government networks. Attackers exploited existing security gaps, conducted lateral movement, and exfiltrated sensitive data, threatening the confidentiality and integrity of official communications. The campaigns remained undetected for an extended period, highlighting the advanced tradecraft and persistent nature of the threat actor. These incidents underscore the growing risk posed by state-aligned actors employing increasingly sophisticated tactics to target critical government infrastructure. The discovery of new tools and techniques in these attacks signals an escalation in South Asian regional cyber conflict and emphasizes the need for updated security controls and rapid detection capabilities.
6 months ago
Kill Chain
CISA Flags Five Actively Exploited Vulnerabilities in 2026 KEV Catalog Update
In January 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added five high-risk vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. These include flaws in the Linux Kernel, SmarterTools SmarterMail, Microsoft Office, and GNU InetUtils. Threat actors exploited these vulnerabilities through methods such as authentication bypass, unrestricted file upload, security feature bypass, and argument injection, targeting both federal and private sector networks. Rapid exploitation can lead to unauthorized access, data exfiltration, or further compromise of organizational systems if not promptly remediated. This evolving threat landscape highlights an ongoing wave of opportunistic and targeted attacks leveraging widely used enterprise, email, and infrastructure software. The addition of these CVEs to the KEV Catalog underscores regulatory pressure and the increased urgency for organizations of all sizes to prioritize patch management and mitigate exposure to active threats.
6 months ago
Kill Chain
VMware vCenter RCE Flaw Actively Exploited: What Security Teams Need to Know
In January 2026, a critical vulnerability (CVE-2024-37079) in VMware vCenter Server was confirmed as actively exploited in the wild. This heap overflow flaw within the DCERPC protocol implementation enables unauthenticated remote attackers with network access to execute arbitrary code on vulnerable vCenter Server systems. The compromise does not require user interaction or elevated privileges, making attacks relatively low-effort and high-impact. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive mandating all federal agencies to remediate the issue within three weeks, underscoring its urgency and operational risk. No temporary mitigations exist, leaving patching as the sole defense for affected environments. This incident highlights a continued trend of attackers targeting management and orchestration layers in hybrid-cloud and virtualized infrastructures. The lack of workarounds, combined with rapid weaponization, points to increasing risks for organizations who delay patching and underlines regulatory pressure on timely remediation for critical zero-day vulnerabilities.
6 months ago
Kill Chain
NPM Supply Chain Bypass: PackageGate and Shai-Hulud Exploits Expose Open-Source Risks in 2026
In January 2026, critical vulnerabilities dubbed "PackageGate" were revealed in NPM and several popular JavaScript package managers, exposing gaps in defenses against supply chain attacks like last year's Shai-Hulud incidents. Despite previous security improvements, attackers could still bypass NPM's safeguard against malicious package scripts by leveraging Git dependencies and malicious .npmrc configuration files, leading to unauthorized code execution—even when script blocking features were enabled. The flaws, discovered by Koi Security researchers, allowed full code compromise and had potential for massive developer credential and secret exfiltration, threatening tens of thousands of projects and their downstream users. These findings highlight the persistent risks in open-source supply chains and the accelerating pace of software supply chain attacks. As threat actors become more adept at exploiting package management tools, organizations face renewed urgency to bolster visibility, enforce granular access controls, and adopt defense-in-depth measures to protect development workflows and critical assets.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports