✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Ransomware Gangs Exploit Critical Linux Kernel Flaw in 2024 Attacks
In early 2024, a high-severity privilege escalation vulnerability (CVE-2024-1086) in the Linux kernel was actively exploited by multiple ransomware gangs, as confirmed by CISA. Attackers used the flaw to gain root access on targeted Linux systems, bypassing standard user restrictions. This escalation provided threat actors the means to deploy ransomware payloads, encrypt files, and cripple business operations across sectors relying on Linux servers. The attack chain typically started with initial compromise of a Linux system, followed by privilege escalation and lateral movement, exposing organizations to data loss and downtime. This incident underscores the growing trend of ransomware operators targeting critical open-source infrastructure through recent or unpatched vulnerabilities. Organizations must adapt their security posture rapidly, as evidence of weaponization demonstrates that patching and vigilant privilege management remain urgent for foundational platforms like Linux.
6 months ago
Kill Chain
Russian Authorities Dismantle Meduza Stealer Malware Group After Major Data Thefts (2024)
In June 2024, Russian law enforcement authorities arrested three alleged administrators behind the Meduza Stealer information-stealing malware in Moscow. The operation was part of a wider investigation following attacks on Russian organizations by the threat actor group, who distributed Meduza Stealer via phishing campaigns and illicit online forums. The malware targeted sensitive credentials, browser data, and cryptocurrency wallets, which were then exfiltrated to attacker-controlled servers. The arrests are expected to significantly disrupt the group’s operations and potentially curb related cybercriminal activity in the region. The Meduza Stealer case underscores the global proliferation of credential-stealing malware and highlights growing law enforcement action against cybercrime groups. With similar infostealer campaigns on the rise and rapid threat actor adaptation, organizations must prioritize endpoint protection and user awareness to stay ahead of evolving tactics.
6 months ago
Kill Chain
University of Pennsylvania 2024 Email Account Compromise: Lessons for Higher Ed
In June 2024, the University of Pennsylvania experienced a cybersecurity incident involving unauthorized access to internal email accounts. Students and alumni received a series of offensive emails from compromised university email addresses, with messages claiming data had been stolen in a security breach. Attackers leveraged email compromise, impersonating trusted university entities, and threatened to leak sensitive data, causing significant alarm among recipients. The university responded swiftly by investigating the breach, working with law enforcement, and reassuring the community that containment efforts were underway. This incident underscores the ongoing threat of email compromise and phishing-driven data breaches within higher education. With educational institutions facing increased attacks targeting both user trust and sensitive information, this event highlights the urgent need for robust email security, lateral movement detection, and strategic incident response planning.
6 months ago
Kill Chain
CISA Flags China-Linked APT Exploitation of VMware Zero-Day (CVE-2025-41244)
In October 2025, a critical zero-day vulnerability, CVE-2025-41244, affecting VMware Aria Operations and VMware Tools was actively exploited by a China-linked Advanced Persistent Threat (APT) group. The attackers leveraged this flaw to achieve remote code execution within enterprise environments, bypassing authentication on exposed VMware instances. Initial access was typically gained via internet-facing management interfaces, followed by lateral movement to access sensitive data and systems. The incident prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the rapid operational impact and the potential for widespread compromise in cloud and hybrid infrastructures. This breach exemplifies the ongoing risk posed by state-sponsored actors exploiting enterprise software supply chain gaps and underscores the need for rigorous patch management and segmentation. Organizations face renewed urgency as attackers increasingly focus on high-value cloud platforms, driving heightened regulatory scrutiny and reinforcing the importance of visibility and agility in security operations.
6 months ago
Kill Chain
Eclipse Foundation Supply Chain Risk: Open VSX Token Exposure Sparks Security Response
In June 2025, the Eclipse Foundation, custodians of the Open VSX open-source project, took immediate remedial action after Wiz security researchers reported that authentication tokens had been unintentionally leaked in several Visual Studio Code (VS Code) extensions across official marketplaces. These exposed tokens could have allowed malicious actors to tamper with extensions, inject malicious code, or compromise downstream developer environments. Upon validation, the Eclipse Foundation promptly revoked a limited set of impacted tokens and notified affected extension maintainers, mitigating potential risks before evidence of active exploitation surfaced. This event underscores the inherent risks in software supply chains, particularly in widely-used open-source development tools. Software supply chain vulnerabilities remain a top concern for enterprises as development workflows increasingly depend on publicly distributed packages and extensions. The growing adoption of open-source ecosystems means that even small credential leaks can impact thousands of users, driving new urgency for continuous monitoring and proactive threat detection.
6 months ago
Kill Chain
CISA and NSA Warn: Immediate Action Required to Harden Exchange & WSUS – 2025 Global Security Advisory
In October 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and National Security Agency (NSA), together with Australian and Canadian cyber authorities, issued urgent joint guidance to mitigate widespread exploitation risks targeting on-premises Microsoft Exchange Server and Windows Server Update Services (WSUS) deployments. These critical advisories arise after recent campaigns revealed how sophisticated threat actors leveraged open administrative interfaces and inadequate authentication to gain persistence, move laterally, and exfiltrate sensitive data from unpatched systems. Organizations globally are at risk of business disruption and potential regulatory violation from ensuing breaches. This new wave of advisories underscores the persistent targeting of core enterprise infrastructure by nation-state and criminal groups. The trend toward exploiting unencrypted data in transit, identity and access misconfigurations, and patching gaps makes immediate action essential for IT and security leaders, especially with regulatory scrutiny and ransomware risk at all-time highs.
6 months ago
Kill Chain
China-Linked APT Exploits Windows Shortcut Flaw in 2025 to Breach EU Diplomats
In late 2025, the China-linked threat group UNC6384 orchestrated a targeted cyber espionage campaign against European diplomatic and government institutions. Utilizing a previously unpatched Windows shortcut (LNK) vulnerability, attackers delivered malicious payloads to compromise systems in Hungary, Belgium, Italy, the Netherlands, and Serbia. The group specialized in stealthy lateral movement, data collection, and command-and-control operations while evading standard defenses. As a result, sensitive government data and communications were potentially exposed, undermining national security and international collaboration efforts. This incident underscores the growing sophistication of state-sponsored cyberattacks, intensified by the exploitation of zero-day vulnerabilities and advanced lateral movement techniques. The frequent targeting of government and diplomatic organizations shows a continued evolution in APT tactics and a rising threat to global critical infrastructure.
6 months ago
Kill Chain
2025 Lanscope Zero-Day: Tick APT’s Attack on Corporate Systems
In October 2025, the cyber espionage group Tick (also known as Bronze Butler), believed to be linked to China, exploited CVE-2025-61932—a critical zero-day vulnerability (CVSS 9.3) affecting Motex Lanscope Endpoint Manager. The attackers gained remote SYSTEM-level access to targeted on-premise environments, allowing them to hijack corporate systems and exfiltrate sensitive data. The attack chain involved leveraging the flaw for command execution, facilitating lateral movement and persistence within victim organizations, primarily impacting Japanese and East Asian enterprises. Authorities issued advisory alerts urging immediate remediation to prevent data loss and further intrusions. This incident underscores the growing operational risk posed by nation-state actors exploiting enterprise endpoint vulnerabilities. It highlights an escalation in zero-day weaponization and reinforces the need for robust segmentation, endpoint monitoring, and proactive patch management amid intensifying APT activity and regulatory scrutiny.
6 months ago
Kill Chain
Airstalk Malware: 2025 Nation-State Supply Chain Attack Hits Mobile Device Ecosystems
In October 2025, a suspected nation-state threat actor, tracked as CL-STA-1009, orchestrated a sophisticated supply chain attack involving the novel 'Airstalk' malware. Investigations by Palo Alto Networks Unit 42 revealed that Airstalk exploited the AirWatch mobile device management (MDM) API to gain unauthorized access to victim organizations' internal networks. This enabled adversaries to compromise large numbers of mobile devices, bypass network controls, and pivot laterally within affected systems, causing operational disruption and data loss. The primary targets were organizations with complex supply chains, where the attackers injected malicious code via trusted software providers, highlighting the vulnerabilities inherent in interconnected IT ecosystems. This incident is especially relevant as supply chain attacks become increasingly prevalent, with attackers leveraging trusted third-party relationships to bypass traditional network defenses. Nation-state actors' use of advanced evasion techniques and MDM abuse underscores the need for enhanced visibility, segmentation, and threat detection across distributed and hybrid IT environments.
6 months ago
Kill Chain
LotL Malware Concealed in Windows Native AI Stack Exposes New Risks
In early 2024, security researchers uncovered a Living-off-the-Land (LotL) attack that leveraged Windows' native AI stack to conceal and deploy malware within trusted AI data files. Attackers exploited the inherent trust that many Windows systems grant to files used by the native AI stack, allowing the threat to bypass traditional detection methods. The malicious payloads used fileless techniques, hiding in AI models and exploiting automated processing pipelines to achieve stealthy initial access and lateral movement. The campaign resulted in significant risks of unauthorized access, data theft, and potential disruption to business operations reliant on AI-driven processes. This incident is a timely reminder of evolving threat tactics using fileless malware and trusted native components. As the adoption of AI and automation accelerates, attackers are adapting by targeting supply chains and leveraging trusted AI data flows to bypass security controls and compliance frameworks.
6 months ago
Kill Chain
CISA & NSA Issue 2024 Guidance to Harden Microsoft Exchange Servers
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) issued joint guidance targeting administrators of Microsoft Exchange servers. This proactive measure follows a history of critical vulnerabilities in Exchange, which have enabled advanced threat actors and ransomware groups to access sensitive organizational email systems, often through unpatched servers and weak configurations. By outlining best practices for hardening Exchange, the agencies aim to help organizations mitigate risks from exploitation, data theft, and business disruption associated with increasingly sophisticated attack vectors seen throughout 2023 and 2024. This guidance reflects the heightened urgency around securing ubiquitous enterprise communications tools following high-profile breaches exploiting on-premise infrastructure. With persistent evolution in offensive capabilities and regulatory scrutiny increasing, consistently applying infrastructure hardening and Zero Trust controls is now critical for organizations of all sizes.
6 months ago
Kill Chain
CISA Orders Urgent Patch of VMware Tools Flaw Exploited by Chinese Hackers
In October 2024, Chinese state-sponsored hackers exploited a high-severity vulnerability in Broadcom’s VMware Aria Operations and VMware Tools software, targeting U.S. federal agencies through a software supply-chain attack. The attackers leveraged the unpatched flaw to gain unauthorized access, move laterally within networks, and potentially exfiltrate sensitive data. The Cybersecurity and Infrastructure Security Agency (CISA) responded by issuing an emergency directive, mandating all federal agencies to immediately patch the affected systems amid evidence of ongoing compromise. This incident underscores the persistent risks of vulnerable supply-chain components and the growing sophistication of state-sponsored adversaries. In light of increased regulatory scrutiny and rising exploitation of critical infrastructure platforms, organizations must prioritize rapid vulnerability management and layered defense strategies.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports