✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Advantech DeviceOn/iEdge 2025: Multiple Path Traversal and XSS Vulnerabilities Threaten IoT Security
In November 2025, security researchers disclosed multiple critical vulnerabilities in Advantech’s DeviceOn/iEdge IoT management platform, affecting version 2.0.2 and earlier. Among the vulnerabilities were improper input handling flaws including cross-site scripting (CVE-2025-64302) and several variants of path traversal (CVE-2025-62630, CVE-2025-59171, CVE-2025-58423), which could allow remote attackers to gain unauthorized access, execute arbitrary code, trigger denial-of-service conditions, or read sensitive files. No public exploitation has been reported, but the potential risks span information leakage and remote code execution, with system-level impact possible from authenticated and unauthenticated attackers. This incident is particularly relevant as IoT management and industrial control environments remain popular targets for exploitation of legacy systems, which often lack timely security updates. With operational continuity and data integrity at risk, organizations face mounting regulatory and business pressure to retire end-of-life products and implement robust remediation strategies.
6 months ago
Kill Chain
Nikkei Data Breach: Slack Compromise Exposes Employee and Partner Information in 2024
In early June 2024, Japanese media conglomerate Nikkei disclosed a cybersecurity breach involving the unauthorized compromise of its Slack workspace. Attackers gained access to Slack accounts and chat histories, potentially exposing sensitive information belonging to thousands of employees and business partners. The incident is believed to have occurred via stolen Slack credentials, granting threat actors access to business communications and personal data. Nikkei swiftly launched an investigation, engaged incident response expertise, and notified affected individuals while reporting the matter to regulatory authorities. This attack highlights the continuing risk of platform-based credential compromises affecting collaboration tools. The frequency of SaaS-targeted breaches is growing, underlining the urgent need for robust identity, access management, and segmentation controls on corporate communication channels.
6 months ago
Kill Chain
Bronze Butler Exploits Zero-Day to Breach Japanese Enterprise Networks
In early 2025, Chinese state-sponsored APT group 'Bronze Butler' exploited a zero-day vulnerability (CVE-2025-61932) in a widely used endpoint management platform to penetrate several Japanese organizations. The attackers gained privileged access by leveraging the flaw for initial compromise, then established persistence and moved laterally across victims’ networks. Exfiltrated data included sensitive business documents and internal communications. The coordinated campaign went undetected for weeks, resulting in significant operational disruption and exposure of confidential assets, raising alarms about cyber-espionage threats facing Japan’s critical industries. This breach highlights the intensifying use of zero-day vulnerabilities by advanced threat actors for targeting supply chain software and trusted management tools. Similar recent attacks signal a broader trend of sophisticated, nation-state-driven intrusions against key sectors in Asia, and reinforce the urgent need for proactive patch management and stronger east-west network segmentation.
6 months ago
Kill Chain
Multiple ChatGPT Security Bugs Expose User Data in 2023 OpenAI Breach
In March 2023, OpenAI faced a significant application security incident involving multiple vulnerabilities within its flagship ChatGPT platform. Attackers exploited bugs that enabled prompt injection, retrieval of other users’ conversation histories, and potential bypassing of safety restrictions, exposing sensitive user data and proprietary prompts. These exploits, which allowed lateral movement and unauthorized data exfiltration, highlighted systemic issues in handling session tokens, API security, and isolation of user environments. The breaches forced OpenAI to temporarily take ChatGPT offline, conduct emergency patching, notify users, and engage external security review. The operational impact included reputational damage and increased regulatory scrutiny over cloud-based AI platforms’ data handling. This event underscores the growing risk as generative AI platforms become integral to business operations and personal productivity. The use of increasingly complex APIs and reliance on cloud-native architecture have introduced new attack surfaces, making timely detection and robust segmentation critical. Regulatory bodies and security practitioners now regard application-layer lateral movement and API leakage as top-tier threats, especially given AI’s centrality to enterprise workflows.
6 months ago
Kill Chain
Capital One’s 2019 Cloud Breach: Insider Threats & Misconfiguration Risks
In 2019, Capital One suffered a major data breach when Paige Thompson, a former AWS engineer, exploited a cloud misconfiguration—specifically a poorly secured firewall running in Capital One's AWS environment—to access the personal information of over 100 million customers. The attacker leveraged insider knowledge and a misconfigured identity and access management policy to move laterally and exfiltrate sensitive data, including social security numbers and bank account details. The breach resulted in substantial financial costs, regulatory scrutiny, and reputational damage to Capital One, with Thompson ultimately convicted of wire fraud and computer intrusion. This incident remains relevant as organizations increasingly migrate to the cloud and face similar risks of configuration errors, compounded by the complexity of managing access controls and real-time monitoring in cloud-native infrastructures. The Capital One breach exemplifies the critical need for robust cloud security measures and continuous compliance with evolving regulatory requirements.
6 months ago
Kill Chain
US Sanctions North Korean Banks for Cryptocurrency Cybercrime in 2024
In May 2024, the U.S. Treasury sanctioned two North Korean banks and eight individuals believed to be heavily involved in high-profile cryptocurrency laundering operations linked to state-sponsored cybercrime. The sanctioned parties allegedly laundered millions of dollars in digital assets stolen through cyberattacks and IT worker fraud, often hiding illicit proceeds to evade international detection. North Korean operatives reportedly posed as legitimate IT contractors for Western firms to gain unauthorized access to sensitive systems and divert funds, fueling further malicious operations and funding government programs in Pyongyang. This incident exemplifies shifting tactics in cyber-enabled financial crime, where attackers exploit advanced laundering techniques and foggy compliance areas around cryptocurrency. The urgency of improved detection and policy enforcement is fueled by growing international regulatory pressure and the adaptation of state-sponsored groups to exploit digital infrastructure.
6 months ago
Kill Chain
Hyundai AutoEver America Breach: SSN & ID Data Exposed in Latest 2024 Attack
In early 2024, Hyundai AutoEver America suffered a significant data breach after cyber attackers gained unauthorized access to the company's IT environment. Sensitive personal information, including Social Security Numbers and driver's license details, belonging to customers and employees was exposed over the course of the intrusion. The breach was detected and disclosed following internal investigations and third-party forensics, with impacted individuals promptly notified. While the company did not report operational disruptions, the exposure of such regulated data poses risks of identity theft and regulatory scrutiny. This incident underscores the growing trend of threat actors targeting organizations in the automotive sector for high-value personal data. It spotlights the importance of strong data-in-transit controls and proactive east-west traffic monitoring, as regulators and attackers alike escalate pressure on firms entrusted with sensitive consumer information.
6 months ago
Kill Chain
CentOS Web Panel Suffers Wide Scale Attacks Via Remote Command Execution Flaw
In early 2024, a critical remote command execution (RCE) vulnerability in CentOS Web Panel (CWP) was actively exploited by threat actors, as publicly warned by the U.S. Cybersecurity & Infrastructure Security Agency (CISA). Attackers leveraged this flaw, tracked as CVE-2022-44877, to gain unauthorized access to servers running CWP, enabling them to execute arbitrary commands and potentially take full control of affected systems. This exploitation campaign targeted internet-facing CWP instances, presenting significant risks to organizations relying on the popular Linux-based server management tool. The fallout included possible data compromise, deployment of additional malware, and interruption of web services. This incident highlights a growing trend in mass exploitation of critical web application vulnerabilities, with attackers increasingly focusing on widely-adopted open-source platforms. High-profile government advisories and the prevalence of ransomware toolkits leveraging RCE flaws have driven organizations to reinforce patch management and incident response as regulatory and operational priorities.
6 months ago
Kill Chain
CISA Adds Gladinet and CWP Flaws to KEV After Confirmed Exploitation
In November 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added critical vulnerabilities impacting Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. Attackers have leveraged CVE-2025-11371 and similar flaws, which expose sensitive files or directories, enabling unauthorized code execution and unauthorized access to critical business data. Exploitation techniques include remote access and privilege escalation, with incidents observed in both enterprise and cloud environments. The exploited weaknesses have led to compromised systems and elevated business risk for affected organizations. This incident highlights an escalating trend in the exploitation of web-facing management panels and software supply chain components, making east-west traffic security and timely vulnerability management crucial for defenders. Regulatory and industry pressure is mounting as the pace and sophistication of attacks accelerate.
6 months ago
Kill Chain
US Sanctions North Korean Network for $12.7M Crypto Laundering and IT Fraud
In November 2025, the U.S. Treasury Department sanctioned ten North Korean individuals and entities after uncovering a multi-year scheme involving crypto laundering and IT-related financial fraud totaling $12.7 million. These actors, linked to North Korea’s state-sponsored cyber operations, leveraged encrypted and unencrypted channels to move illicit funds across international financial systems. Their activities supported North Korea’s nuclear weapons ambitions and exploited gaps in network segmentation, egress controls, and threat detection processes. This incident underscores an escalation in nation-state cryptocurrency laundering methods and demonstrates continued exploitation of global IT workforce outsourcing, heightening regulatory focus and increasing the cyber risk to organizations transacting digitally or hiring remote technical staff.
6 months ago
Kill Chain
Google Uncovers PROMPTFLUX: AI-Driven Malware Raises the Stakes for 2025 Security
In November 2025, Google’s threat intelligence team identified a novel malware campaign involving PROMPTFLUX, a Visual Basic Script (VBScript) threat that leverages the Gemini AI model API for rapid self-obfuscation and evasion. Unattributed attackers deployed PROMPTFLUX to rewrite its own source code hourly using AI-driven prompts, significantly complicating detection and dismantling efforts. The malware infiltrated enterprise endpoints using social engineering and malicious email attachments before laterally propagating within corporate environments, thus undermining traditional endpoint and network defense measures. As a result, organizations faced heightened risk of data exfiltration, operational disruption, and increased response complexity. This incident highlights an emerging class of threats that weaponize generative AI models for polymorphic malware development. The ability to dynamically morph malicious code in real time increases attacker agility and strains legacy detection and compliance controls, reflecting a wider shift toward autonomous, AI-powered cyberattacks.
6 months ago
Kill Chain
ChatGPT 2025 Vulnerabilities: How AI Memory Leaks Put Data at Risk
In November 2025, cybersecurity researchers uncovered and disclosed a set of seven critical vulnerabilities affecting OpenAI's ChatGPT, specifically the GPT-4o and GPT-5 models. The vulnerabilities allowed attackers to exploit memory and chat history mechanisms, enabling the unauthorized extraction of sensitive user information—including personal data and confidential conversation content—without user awareness. The flaws could be triggered remotely through crafted prompts and API calls, presenting a considerable risk both to individuals and enterprises leveraging ChatGPT in production environments. OpenAI has issued patches and advisories, but the revelations highlight the rapid evolution and complexity of securing AI models at scale. This incident is especially significant given the increasing reliance on generative AI in business workflows and the concurrent surge in attacks targeting AI-powered infrastructure. With regulatory scrutiny intensifying around AI data handling and the advent of new compliance frameworks, protecting AI systems against data leakage has become a board-level imperative.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports