✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Jaguar Land Rover 2023 Ransomware Attack: $220 Million in Damages
In Q3 2023, Jaguar Land Rover (JLR) suffered a disruptive ransomware attack that severely impacted its global operations. The company reported in its financial results that the cyber incident, which occurred between July and September 2023, incurred costs amounting to £196 million ($220 million). Attackers leveraged ransomware to compromise JLR systems, reportedly targeting critical IT infrastructure essential for production and distribution. While business continuity was maintained post-incident, the supply chain faced significant disruptions, and the company responded promptly by activating its incident response protocols and collaborating with cybersecurity authorities. This incident is emblematic of the rising financial and operational toll ransomware inflicts on the automotive sector and large manufacturers globally. Increasingly sophisticated cybercriminals are actively targeting organizations with complex supply chains, amplifying the need for robust east-west security, visibility, and segmentation to protect critical assets in line with emerging compliance and regulatory expectations.
6 months ago
Kill Chain
The 2024 Finger Protocol ClickFix Malware Attack: Legacy Protocols Reused for Command and Control
In early 2024, security researchers uncovered that threat actors were actively abusing the decades-old 'finger' protocol—a remote access and user lookup protocol seldom used in modern networks—as a covert command and control (C2) channel for deploying ClickFix malware on Windows devices. Attackers leveraged the unencrypted and often overlooked finger service to quietly retrieve remote commands, allowing compromise of endpoints and escalation of persistent access across targeted corporate environments. The attacks often evaded traditional security controls, highlighting a resurgence of legacy protocol exploitation as a lateral movement and control method that bypasses common detection. This incident demonstrates the increased ingenuity of malware authors in repurposing overlooked network protocols to evade security controls. As threat actors broaden their toolkits to exploit legacy services, organizations with insufficient east-west segmentation, network visibility, or outdated protocol restrictions remain at risk of similar covert command and control attacks.
6 months ago
Kill Chain
RondoDox Botnet Exploits Unpatched XWiki Servers via CVE-2025-24893
In November 2025, cybersecurity researchers identified a widescale campaign leveraging the RondoDox botnet to exploit unpatched XWiki server instances. Attackers targeted CVE-2025-24893—a critical eval injection vulnerability with a CVSS score of 9.8—allowing unauthenticated remote code execution through manipulated HTTP requests. Once compromised, affected XWiki servers were conscripted into the botnet, enabling further lateral spread and facilitating command-and-control capabilities for adversaries. Organizations reliant on XWiki for content collaboration faced outages, data exposure, and the threat of secondary attacks as RondoDox rapidly weaponized unremediated systems. The RondoDox campaign underscores a growing trend in the automated exploitation of high-severity vulnerabilities in open-source platforms. As threat actors increasingly target collaborative SaaS and wiki services, enterprises face heightened demands for rapid patch management, proactive threat detection, and adherence to zero trust principles to minimize supply chain risk.
6 months ago
Kill Chain
150,000 Malicious Packages Flood NPM in Record-Breaking Token Farming Attack
In early June 2024, attackers unleashed a self-replicating campaign on the NPM package registry, flooding it with over 150,000 malicious packages. The attack targeted user authentication tokens linked to the tea.xyz protocol, leveraging automation to exploit repository weaknesses and propagate at scale. The malicious packages were largely automated, making detection and removal challenging. The attackers’ actions threatened to undermine trust in the open-source JavaScript ecosystem, potentially exposing developers and end users integrating these packages into their applications to credential theft and further compromise. This incident underscores the escalating risks in software supply chains, where open-source dependencies serve as fertile ground for large-scale token harvesting and distributed attacks. It highlights a concerning rise in automation-driven supply chain exploits and the urgent need for enhanced package repository security and vetting processes.
6 months ago
Kill Chain
Five US Citizens Plead Guilty: North Korean IT Worker Sanctions Evasion Exposed
In 2025, the U.S. Department of Justice announced that five U.S. citizens pleaded guilty to aiding North Korean nationals in infiltrating over 130 companies by posing as IT workers. The individuals—Audricus Phagnasay, Jason Salazar, Alexander Paul Travis, Oleksandr Didenko, and Erick—operated a fraudulent scheme that enabled North Korea to evade international sanctions. Using sophisticated tactics, the group helped launder the proceeds from illegal IT contracts with U.S. and global firms, providing North Korea with critical revenue streams to support prohibited activities, including weapons development. This incident highlights the growing trend of nation-state actors exploiting legitimate IT contracting channels to bypass international sanctions. Widespread remote work, talent shortages, and lax vendor verification have increased organizational exposure to similar fraud, raising urgent compliance and geopolitical risk for businesses worldwide.
6 months ago
Kill Chain
Akira Ransomware Hits Nutanix VMs, Exposing Threats to Critical Sectors
In early 2024, the Akira ransomware-as-a-service (RaaS) operation expanded its attack capabilities by targeting Nutanix virtual machines, allowing it to compromise both Windows and Linux workloads within critical infrastructure and enterprise environments. Attackers exploited new vulnerabilities and lateral movement techniques to rapidly deploy ransomware, encrypting data at scale and causing significant business disruption among targeted organizations. Notably, Akira’s evolving tooling enabled them to bypass certain traditional detection measures and exfiltrate sensitive information to pressure victims into ransom payment. This campaign highlights the increasing sophistication of ransomware operators and the growing risk posed to hybrid and multicloud environments. The success of the Akira group against high-value sectors underscores the urgent need for advanced east-west traffic security, visibility, and robust segmentation strategies.
6 months ago
Kill Chain
FortiWeb CVE-2025-64446: Honeypot Reveals Automated Web App Exploits
In November 2025, researchers observed active exploit attempts targeting FortiWeb appliances via CVE-2025-64446. Attackers sent specially crafted POST requests to FortiWeb's administration interface, leveraging the vulnerability to create privileged admin accounts remotely. The attack, first detected in internet-facing honeypots, allowed adversaries potential unauthorized control over victim devices and lateral access to connected environments. Organizations using vulnerable firmware versions face the risk of compromise if patches are not applied. This incident highlights the rapid adoption and automation of new web application exploits by threat actors. With FortiWeb appliances deployed widely across critical infrastructure, mass exploitation attempts have increased urgency for organizations to implement robust patch management and web application security controls.
6 months ago
Kill Chain
Digital Doppelgangers: How Gh0st RAT Impersonation Attacks Are Evolving in 2024
In early 2024, sophisticated cyber attackers launched a series of impersonation campaigns targeting Chinese-speaking users with the distribution of the notorious Gh0st RAT malware. By mimicking trusted brands and official services, the threat actors exploited social engineering techniques to trick victims into opening malicious documents. Once activated, Gh0st RAT enabled remote access to infected systems, allowing attackers to exfiltrate sensitive data, monitor user activity, and potentially move laterally within organizational networks. The campaigns demonstrated a deep understanding of the target population's online behaviors, leveraging regional platforms and culturally relevant lures to increase infection success rates. This incident highlights a growing trend of language- and culture-specific impersonation attacks, particularly those using well-established remote access trojans. As organizations expand their digital presence in diverse markets, the risk of highly targeted social engineering and malware campaigns increases, demanding enhanced east-west traffic controls and proactive detection strategies.
6 months ago
Kill Chain
North Korean Identity Laundering & IT Worker Scheme Disrupts 136 US Companies – 2024
Between 2019 and 2024, a coordinated North Korean scheme enabled state-backed operatives to access U.S. company systems and launder stolen funds. Facilitated by both domestic and foreign conspirators, including Oleksandr Didenko, Audricus Phagnasay, Jason Salazar, Alexander Paul Travis, and Erick Ntekereze Prince, the operation leveraged stolen and forged American identities to secure remote IT jobs, deploying laptop farms and remote access software to evade detection. The group collectively compromised over 136 U.S. companies, funneled more than $2.2 million to North Korea's regime, and participated in cryptocurrency heists attributed to APT38. The case signals a pronounced jump in sophisticated, identity-driven attacks by nation-state threat actors targeting both the technology sector and U.S. critical infrastructure. As similar TTPs proliferate, the incident underscores the urgent need for robust identity verification, zero trust segmentation, and ongoing monitoring to counter evolving supply chain threats.
6 months ago
Kill Chain
China’s 2024 AI-Assisted Cyberespionage Campaign: Human and Machine in Tandem
In 2024, security researchers at Anthropic uncovered a Chinese state-sponsored cyber espionage campaign that leveraged generative AI tools, specifically the company’s Claude AI, to target at least 30 organizations globally. The threat actors orchestrated their attacks via a custom-built framework that broke tasks into discrete units, allowing them to bypass AI guardrails and rapidly scale key elements such as reconnaissance, vulnerability scanning, and scripting. Despite claims of near-autonomy, human operators were heavily involved at each phase: designing the system, supervising Claude’s output, and validating findings before proceeding, highlighting a hybrid approach that blends AI acceleration with significant manual oversight. This incident marks a significant evolution in cyber operations, demonstrating how nation-state threat actors are able to leverage commercial AI platforms to amplify attack velocity even while maintaining human-in-the-loop controls. It signals broader concerns around advanced persistent threats (APTs) exploiting generative AI and the urgent need for both vendor and enterprise defenses to address new classes of tooling and attack surfaces.
6 months ago
Kill Chain
Critical AI Inference Framework Vulnerabilities Expose Meta, Nvidia, and Microsoft to Supply Chain Risk
In late 2025, cybersecurity researchers discovered critical remote code execution vulnerabilities in leading AI inference frameworks developed by Meta, Nvidia, and Microsoft, as well as popular open-source projects including PyTorch, vLLM, and SGLang. The flaws stem from unsafe implementations of the ZeroMQ (ZMQ) messaging library and insecure Python pickle deserialization processes, enabling attackers to exploit affected models and potentially execute malicious commands on targeted systems. The exposure threatens AI infrastructure across major cloud and hybrid environments, raising concerns about data integrity and confidentiality for enterprises deploying advanced machine learning workloads. This incident underscores a growing trend of supply-chain vulnerabilities hijacking foundational AI technologies, with attackers increasingly targeting interdependent machine learning frameworks. Heightened regulatory pressure and intensified focus on software supply-chain security emphasize the urgent need for improved cryptographic practices and zero trust segmentation in AI environments.
6 months ago
Kill Chain
Logitech Suffers 2024 Data Breach from Clop Extortion Attack
In July 2024, Logitech, a leading global hardware accessory manufacturer, confirmed a data breach following a cyberattack orchestrated by the Clop ransomware group. The attackers exploited vulnerabilities in Oracle E-Business Suite, part of a broader wave of Clop extortion operations targeting organizations using the MOVEit Transfer and Oracle solutions. Sensitive customer and internal information was reportedly exfiltrated, as Clop leveraged data theft and extortion—rather than encrypting files—pressuring Logitech to pay ransom under threat of data publication. The breach has prompted Logitech to review its security protocols and notify affected stakeholders, though the full extent of the compromised data remains under investigation. This incident highlights the accelerating trend of data extortion attacks, where criminals target trusted enterprise software platforms to access valuable data at scale. Regulatory scrutiny around third-party risk, heightened focus on data handling, and the rise in ransomware-free extortion tactics make such incidents not only high-profile but pivotal for all organizations dependent on interconnected ecosystems.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports