✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Cloudflare Defeats Record 29.7 Tbps DDoS Attack Attributable to AISURU Botnet
In December 2025, Cloudflare successfully detected and mitigated the largest recorded distributed denial-of-service (DDoS) attack, peaking at 29.7 terabits per second. The attack was orchestrated by the AISURU botnet, leveraging up to four million infected hosts to launch a hyper-volumetric assault. The malicious traffic targeted Cloudflare’s infrastructure, testing the limits of web security and putting critical online services at risk of disruption during the 69-second onslaught. This incident illustrates the increasing scale and sophistication of botnet-driven DDoS attacks, forcing organizations to reassess their mitigation strategies. The AISURU attack underscores a troubling trend in the growth of for-hire botnets and record-breaking DDoS volumes seen in 2025. These evolving threats continue to challenge traditional perimeter defenses, making advanced detection, automated response, and robust network segmentation more critical than ever.
6 months ago
Kill Chain
How the yETH DeFi Platform Lost $9 Million in a Flash Loan Exploit (2025)
In December 2025, an unknown threat actor successfully exploited a critical vulnerability in the yETH DeFi platform's smart contract infrastructure, using advanced flash loan manipulation tactics to drain approximately $9 million in funds. The attack was executed within minutes, bypassing protocol controls and effectively emptying several liquidity pools. Investigators reveal that the breach exploited flawed logic in the contract that allowed multiple reentrancies and circumvented rate checks, leading to rapid unauthorized fund transfers. Remediation steps included pausing affected smart contracts and collaborating with exchanges to freeze stolen assets. This incident highlights the rapidly evolving threat landscape targeting decentralized finance (DeFi) ecosystems, where complex protocols and smart contract bugs can be weaponized for mass financial theft. Continued increases in such exploits have intensified regulatory and investor scrutiny while prompting the DeFi sector to emphasize real-time security visibility, automated incident response, and proactive contract auditing.
6 months ago
Kill Chain
Silver Fox Mimics Russian Tactics: Fake Teams Installer Pushes ValleyRAT in 2025 China Cyber Attack
In December 2025, the threat actor known as Silver Fox executed a targeted cyber campaign in China, distributing the ValleyRAT remote access trojan through a fake Microsoft Teams installer. By leveraging SEO-poisoned websites, attackers lured victims searching for legitimate collaboration apps into downloading malicious files disguised as authentic installers. Once executed, the malware provided the attackers with covert access and enabled data theft, surveillance, and potential lateral movement within targeted organizations. The campaign mimicked Russian threat actor behaviors as a false flag, complicating attribution and response. This incident highlights the increasing sophistication and frequency of social engineering attacks using trusted business tools as lures. The rise of targeted SEO poisoning, deceptive software installers, and identity obfuscation poses heightened risks for organizations handling sensitive data or operating in sensitive regions.
6 months ago
Kill Chain
Sunbird DCIM Vulnerabilities Expose Critical Infrastructure: 2025 Authentication Bypass & Credential Risks
In December 2025, security vulnerabilities were disclosed in Sunbird DCIM's dcTrack and Power IQ products, affecting all versions up to v9.2.0. Two significant flaws—an Authentication Bypass Using an Alternate Path or Channel (CVE-2025-66238) and the Use of Hard-coded Credentials (CVE-2025-66237)—could allow attackers to gain unauthorized access or escalate privileges within critical infrastructure environments. Threat actors abusing these vulnerabilities could redirect network traffic, access restricted services, or take control of host machines, exposing organizations to severe operational and reputational risks. This incident highlights the ongoing challenges organizations face in securing infrastructure management tools. Authentication and credential weaknesses remain a leading vector for cyberattacks amid increasing regulatory oversight and the proliferation of critical systems connected globally. Prompt patching and improved credential handling are now essential across industries facing similar risks.
6 months ago
Kill Chain
Advantech iView 2025 SQL Injection Flaw: Immediate Risks for OT Environments
In December 2025, Advantech disclosed a critical SQL injection vulnerability (CVE-2025-13373) affecting its iView network management product (version 5.7.05.7057 and earlier). Security researchers found that attackers could send specially-crafted SNMP v1 trap requests that were not properly sanitized, enabling remote exploitation without authentication. If exploited, the flaw could allow threat actors to access, modify, or delete sensitive information, posing significant operational and business risks to industrial control systems globally. Although no known public exploitation has been reported, the vulnerability exposes organizations across critical manufacturing and information technology sectors to serious threats. This incident underscores the persistent risk of unpatched input validation flaws in widely-deployed operational technology (OT) products. The increasing convergence of IT and OT systems—as well as the expanding attack surfaces in critical infrastructure—make immediate patching, network isolation, and robust segmentation essential in mitigating future high-impact vulnerabilities.
6 months ago
Kill Chain
Authorization Bypass in SolisCloud API Exposes Global Energy Data
In December 2025, the SolisCloud Monitoring Platform, widely used across the global energy sector, was found to have a critical API vulnerability that allowed authorization bypass via a user-controlled key. This flaw, tracked as CVE-2025-13932, permitted any authenticated user to manipulate API requests and access detailed plant data belonging to other customers by altering the plant_id parameter. The vulnerability, present in both API v1 and v2, exposed sensitive operational information and highlighted a significant risk of data leakage in cloud-hosted critical infrastructure platforms. No mitigation had been released by SolisCloud at the time of public disclosure. This incident underscores the heightened threat of insecure APIs in industrial control systems, coinciding with a broader increase in supply chain risks and attacks targeting energy infrastructure. Regulatory bodies are likely to intensify scrutiny, given the global deployment and criticality of such platforms in the energy sector.
6 months ago
Kill Chain
Critical React Flaw Puts Cloud Supply Chains at Immediate Risk
In June 2024, multiple severe vulnerabilities (CVSS 10.0) were discovered in the React JavaScript library, widely used by more than a third of cloud service providers. The flaws, which have been assigned two CVEs, could enable supply-chain attacks by allowing attackers to execute unauthorized code through compromised package updates or dependencies. If exploited, these vulnerabilities may lead to credential theft, lateral movement, and unauthorized access to sensitive cloud workloads, severely impacting the confidentiality and integrity of customer data. Cloud providers were urged to apply emergency patches and audit their environments for suspicious activity. This incident exemplifies the increasing risk posed by software supply-chain vulnerabilities, particularly as critical open-source components underpin cloud and enterprise infrastructures. The speed and scale of exploitation have raised concerns with regulators and CISOs, highlighting escalating threats to core cloud services and compliance programs.
6 months ago
Kill Chain
Millions Exposed: ShadyPanda’s 2024 Browser Supply Chain Attack
In early 2024, the ShadyPanda cyber-threat group, linked to China, orchestrated a large-scale malware campaign by exploiting browser extensions on the Google Chrome and Microsoft Edge marketplaces. The attackers embedded malicious code into seemingly innocuous browser add-ons, silently weaponizing millions of user browsers worldwide. Once installed, these extensions enabled covert surveillance, data exfiltration, and potentially even lateral movement within corporate environments, posing severe risks to both individual privacy and enterprise security. The incident highlights the vulnerabilities in browser supply chains, with organizations scrambling to assess exposure and patch endpoints. This breach underscores a rising trend of sophisticated supply chain and browser-based attacks, where adversaries blend into daily workflows to evade detection. Security leaders must quickly reassess extension controls, threat detection strategies, and regulatory compliance amid growing regulatory scrutiny and persistent attacker innovation.
6 months ago
Kill Chain
How MuddyWater Used a Snake Game to Breach Israeli Networks in 2024
In early 2024, Iranian state-sponsored APT MuddyWater launched a series of cyberattacks against Israeli organizations using a novel evasion method involving a modified version of the classic Snake mobile game. Attackers embedded malicious code within the game to establish a covert communication channel and facilitate lateral movement within compromised networks. Initial access was likely achieved through phishing emails, followed by deployment of specially crafted files to disguise data exfiltration activities. The campaign resulted in unauthorized access to sensitive data and disruption of critical business operations for targeted Israeli entities. This incident highlights a growing trend of threat actors leveraging benign-looking applications and creative techniques to bypass traditional security controls. The use of retro games as a decoy demonstrates that sophisticated attackers are continually adapting, raising the bar for detection and forensic analysis across industries.
6 months ago
Kill Chain
Student Breach: Compromised Gov't and University Access Sold to Chinese Actors (2024)
In early 2024, cyber investigators uncovered a scheme in which a student was selling fully compromised access to high-value government and university websites, predominantly to Chinese threat actors. The access, peddled through underground forums for several hundred dollars apiece, enabled buyers to exploit web server vulnerabilities, deploy malware, and potentially exfiltrate sensitive institutional and personal data. These breaches highlighted significant weaknesses in internal access controls and malware detection at academic and government institutions, risking the integrity of core systems, sensitive research, and regulated personal information. The incident underscores ongoing operational and reputational risks for public sector organizations, particularly where student employees or contractors bypass internal protections. This breach is emblematic of an emerging trend—threat actors leveraging insiders or poorly vetted contractors to facilitate lateral movement targeting valuable educational and governmental data. As ransomware groups and state-sponsored adversaries shift toward supply chain and identity-driven compromise, robust zero trust controls and network segmentation are becoming essential to preempt similar attacks.
6 months ago
Kill Chain
How a 2025 SSH Trojan Attack Leveraged a Government IP and Masquerading Tactics
In November 2025, a sophisticated cyberattack was observed when an adversary used SSH brute-force tactics to infiltrate a honeypot system, exploiting default 'root' credentials. Once inside, the attacker uploaded a malicious ELF binary, masquerading as the legitimate OpenSSH daemon ('sshd'), designed for persistence and stealth. The operation originated from a government-owned IP address, but evidence suggests the IP was likely compromised and misused, underscoring the complexity of attributing attacks. No commands were executed post-login, highlighting advanced attacker tradecraft focused on evasion and long-term foothold. This incident exemplifies modern threats leveraging credential reuse, sophisticated masquerading, and the abuse of trusted system binaries. Such attacks signal the growing use of covert techniques, presenting heightened risks to organizations and reinforcing the need for proactive defense, improved authentication practices, and advanced monitoring.
6 months ago
Kill Chain
PRC State Actors Compromise Public Sector with BRICKSTORM Malware
In late 2025, PRC state-sponsored cyber actors launched a sophisticated espionage campaign using the BRICKSTORM malware, targeting government and information technology sectors. The threat actors gained initial access via a compromised web server in victim DMZs, progressed laterally to internal VMware vCenter servers, and deployed BRICKSTORM to maintain deep persistence in both VMware vSphere and Windows environments. Leveraging advanced encrypted communication channels, stolen credentials, and techniques such as DNS-over-HTTPS and rogue virtual machines, the actors exfiltrated sensitive data while evading detection for extended periods. This incident underscores the evolving tactics of nation-state adversaries, who now frequently employ modular, stealthy malware to attack critical infrastructure. The widespread use of cloud and virtualization platforms in public sector IT environments makes these organizations particularly vulnerable to such persistent threats.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports