✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
APT24’s BADAUDIO: Multi-Year Espionage Hits Taiwan and 1,000+ Domains
In late 2025, a Chinese state-linked threat actor identified as APT24 orchestrated a protracted cyber espionage campaign targeting over 1,000 organizations across Taiwan and neighboring regions. Utilizing a newly discovered malware strain dubbed BADAUDIO, APT24 gained undetected remote access by exploiting vulnerabilities in key infrastructure and moving laterally within networks, leveraging encrypted east-west and outbound traffic. The threat actors pivoted from broad web compromises to highly targeted tactics, establishing persistent footholds and exfiltrating sensitive data over nearly three years. The incident underscored the advanced methods and patience employed by APT groups against critical sectors. This campaign highlights a growing trend toward sustained, stealthy cyber operations by nation-state actors, using modular malware and cloud-oriented infrastructure to evade traditional security tools. The breach is prompting urgent reviews of segmentation, traffic encryption, and real-time detection capabilities across industries facing heightened geopolitical cyber risk.
6 months ago
Kill Chain
Major Grafana SCIM Security Flaw Exposes Enterprises to Privilege Escalation Attacks
In June 2025, Grafana disclosed a critical application vulnerability (CVE-2025-41115, CVSS 10.0) affecting its System for Cross-domain Identity Management (SCIM) component. Exploitable under certain configurations, this flaw allowed unauthenticated attackers to impersonate users and escalate privileges across affected Grafana instances. The issue stemmed from improper validation within the SCIM API, which enabled threat actors to provision accounts and assign administrative rights remotely. Grafana promptly released security patches and urged customers to update immediately as exploitation could lead to full compromise of monitoring infrastructure and sensitive business data. This incident underscores the ongoing threat of privilege escalation via identity management flaws, especially as identity-driven attacks and supply chain risks escalate. The rise in zero-day exploits targeting management interfaces highlights the urgent need for continuous application security assessments and rapid patch management.
6 months ago
Kill Chain
Critical Oracle Fusion Middleware Vulnerability (CVE-2025-61757) Actively Exploited
In November 2025, CISA added CVE-2025-61757—a critical authentication bypass in Oracle Fusion Middleware—to its Known Exploited Vulnerabilities (KEV) Catalog after confirmed evidence of active exploitation. The flaw permits remote, unauthenticated attackers to access critical functions in affected Oracle Fusion Middleware environments, enabling privilege escalation, lateral movement, and potential data exfiltration. The vulnerability represents a significant threat to both public and private organizations relying on Oracle’s middleware technologies, particularly within the federal enterprise, as attackers rapidly weaponize such exposures before widespread patching can occur. This incident highlights an ongoing trend of attackers swiftly exploiting newly published vulnerabilities, emphasizing the necessity for organizations to prioritize timely patching and robust vulnerability management. With regulatory mandates and threat actor innovation intersecting, the urgency to remediate critical middleware exposures has never been greater.
6 months ago
Kill Chain
Hundreds of Salesforce Customers Impacted: Gainsight Supply Chain Attack by ShinyHunters
In June 2024, Salesforce customers experienced a significant supply chain breach after a third-party vendor, Gainsight, was compromised in an ongoing campaign traced to the ShinyHunters/UNC6240 threat group. Attackers exploited OAuth application connections between Gainsight and Salesforce, potentially impacting over 200 customer instances and exposing sensitive business data. Salesforce responded promptly by revoking access tokens to block further unauthorized entry but confirmed that no vulnerabilities existed within its core platform. The incident echoes a previous attack wave against Salesloft Drift integrations targeting Salesforce users within the same threat cluster, highlighting persistent exploitation of third-party SaaS application connections. The breach underscores mounting risks associated with SaaS supply chain integrations and highlights a shift in attacker tactics toward abusing trusted app connectors. As enterprises continue to expand reliance on cloud-based business platforms and third-party vendors, such attacks increase the urgency for rigorous vendor risk management, least-privilege access policies, and enhanced anomaly detection.
6 months ago
Kill Chain
Inside the SolarWinds Supply Chain Breach: A 2020 Landmark in Cybersecurity Risk
In late 2020, SolarWinds suffered a major supply-chain cyberattack, now widely attributed to Russian state-backed APT group Nobelium (aka APT29/Cozy Bear). Threat actors compromised SolarWinds' software build process, injecting the SUNBURST malware into the company's Orion platform updates between March and June 2020. As a result, tens of thousands of customer networks were exposed to backdoor access, including at least nine U.S. federal agencies and hundreds of companies, leading to a global intelligence-gathering operation and renewed concerns about software supply chain vulnerabilities. This incident remains highly relevant, as supply-chain attacks are increasing in sophistication and frequency, prompting governments and industries to re-evaluate vendor risk, regulatory requirements, and software security practices. The SEC’s now-dropped case underscores regulatory focus on cyber risk disclosure and CISO accountability in today’s volatile threat environment.
6 months ago
Kill Chain
D-Link DIR-878 End-of-Life Routers Hit by Critical 2024 RCE Flaws
In June 2024, D-Link issued an urgent advisory regarding three critical remote command execution (RCE) vulnerabilities affecting all models and hardware revisions of its end-of-life DIR-878 wireless routers. These flaws, discovered by cybersecurity researchers, allow unauthenticated remote attackers to execute arbitrary commands on the device, effectively gaining full control. Although D-Link had ended firmware support in 2021, the routers remain in widespread use, especially in emerging markets, increasing the exposure of organizations and individuals who have not decommissioned the devices. The attackers can exploit these weaknesses for lateral movement, network reconnaissance, or as a foothold into larger networks. This incident underscores the dangers posed by unsupported legacy hardware and the importance of proactive lifecycle management. Given the vulnerabilities enable full device compromise with no user interaction, similar RCE attacks targeting end-of-life networking equipment are likely to rise as threat actors pivot toward unpatched infrastructure.
6 months ago
Kill Chain
SonicWall SonicOS SSLVPN Flaw Leaves Firewalls Exposed to Crash Attacks
In June 2024, SonicWall disclosed a high-severity vulnerability in its SonicOS SSLVPN implementation, which allowed unauthenticated attackers to crash and potentially render SonicWall firewall appliances unusable. The flaw, identified as CVE-2024-XXXX, could be exploited remotely by sending specially crafted requests to exposed firewalls. SonicWall warned customers to urgently apply patches as no authentication was required to leverage the exploit, and exploitation could result in significant network downtime or gaps in perimeter defense. This incident highlights the ongoing risk to enterprises reliant on perimeter security devices and the speed with which attackers weaponize newly discovered vulnerabilities. With increasing attacks targeting Internet-exposed VPN gateways and firewalls, rapid patching and layered defensive controls are now more critical than ever.
6 months ago
Kill Chain
Salesforce 2024 Breach: Gainsight Supply Chain Compromise Exposes Customer Data
In June 2024, Salesforce launched an investigation after a supply chain breach at Gainsight, a software vendor, resulted in the theft of certain Salesforce customer data. Attackers exploited compromised Gainsight credentials to gain unauthorized access to customer information via third-party OAuth apps. Salesforce responded quickly by revoking refresh tokens linked to impacted Gainsight-published integrations and advised customers to take precautionary steps, including reviewing and rotating their credentials. While the breach did not affect Salesforce’s internal systems, it highlighted the significant risk posed by interconnected software supply chains and third-party integrations. This incident underscores the increasing sophistication of supply chain attacks targeting cloud platforms and SaaS providers. As businesses rely more heavily on integrated services and external vendors, attackers are exploiting trust relationships to bypass traditional security controls, emphasizing the urgent need for robust third-party risk management and continuous monitoring.
6 months ago
Kill Chain
Supply Chain Breach Hits Italian Rail Group via Almaviva: 2.3TB Data Stolen in 2024
In early June 2024, a threat actor claimed responsibility for breaching the Italian railway operator FS Italiane Group by targeting its IT services provider, Almaviva, resulting in the exfiltration of 2.3TB of sensitive data. The attackers reportedly gained initial access through compromised internal systems and leveraged this infiltration to move laterally, eventually accessing and downloading a vast trove of corporate documents, contracts, and possibly personal information related to employees and customers. The incident exposed Italy's transportation sector to significant risk of espionage, operational disruption, and data loss, igniting widespread concern among critical infrastructure operators. This breach highlights the mounting threat posed by attacks on trusted IT service providers, which serve as gateways to high-value targets. With the proliferation of supply chain and third-party compromise incidents globally, organizations in critical industries must reassess their lateral movement controls, segmentation, and third-party risk governance.
6 months ago
Kill Chain
TamperedChef Malware: Fake Software Installers Fuel a Global Attack Wave
In late 2025, a widespread malvertising campaign dubbed 'TamperedChef' was uncovered by Acronis Threat Research Unit. Threat actors distributed fake installers of popular software through fraudulent ads and compromised websites to trick users into deploying malicious payloads. Once installed, the malware established persistence, deployed JavaScript-based remote access tools, and enabled lateral movement within enterprise and individual networks. The campaign demonstrated sophisticated social engineering tactics and leveraged encrypted command-and-control channels to evade traditional detection mechanisms, resulting in compromise of endpoints across multiple countries. This incident highlights a surge in supply chain and software installer threats, with attackers exploiting user trust and sophisticated malvertising techniques. As ransomware groups and financially motivated actors increasingly target software distribution vectors, organizations face mounting regulatory scrutiny and operational risk without multilayered defenses and advanced endpoint monitoring.
6 months ago
Kill Chain
Tsundere Botnet: How Blockchain-Powered Node.js Malware Threatened Global Supply Chains in 2025
In mid-2025, the Tsundere botnet, attributed to a Russian-speaking threat actor known as "koneko," emerged as a new and flexible malware campaign. It primarily targeted Windows users by disguising itself as installers for popular games or using Remote Monitoring and Management (RMM) tools to deliver its payload. The malware leveraged MSI and PowerShell-based installers to deploy malicious Node.js scripts, establishing persistence and communicating with its command-and-control (C2) infrastructure by dynamically retrieving C2 addresses from Ethereum blockchain smart contracts. This adaptive technique, along with a marketplace-enabled control panel, facilitated operational resilience and monetization among cybercriminals. This incident is significant due to the combination of modern supply chain manipulation, blockchain-based C2 address obfuscation, and pay-per-build business models. Tsundere highlights a trend toward malware leveraging decentralized platforms for better survivability against take-downs and rapid evolution, posing ongoing challenges for traditional defenses and compliance frameworks.
6 months ago
Kill Chain
ThreatsDay 2025: Multi-Vector Attacks Redefine the Global Breach Landscape
In November 2025, a coordinated wave of multi-vector cyberattacks swept across organizations worldwide, leveraging zero-day exploits, LinkedIn spear-phishing, cryptocurrency theft, and vulnerabilities in IoT devices. Attackers exploited both east-west and egress traffic to evade detection, compromise sensitive data in transit, and establish persistent remote access. Prominent threat groups utilized unencrypted and encrypted traffic, weaponized browser extensions, and abused legitimate remote monitoring tools like AnyDesk. The result was disruption to business operations, regulatory investigations, and an uptick in ransomware and crypto-related financial crimes traced to state-sponsored and criminal actors. This incident underscores the escalating risk posed by attackers who blend diverse TTPs across cloud, hybrid, and enterprise networks. The convergence of espionage motives, cybercrime, and advanced ransomware strains highlights the need for real-time visibility, layered segmentation, and updated anomaly detection strategies.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports