✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Atroposia Malware-as-a-Service Threatens 2024 Cybersecurity with Automated Vulnerability Scanning
In early June 2024, the cybersecurity community confirmed the emergence of Atroposia, a sophisticated Malware-as-a-Service (MaaS) platform offering attackers a feature-rich remote access trojan (RAT). Atroposia distinguishes itself from conventional malware by fusing persistent access, stealthy evasion, credential theft, and automated local vulnerability scanning within a single toolkit. Threat actors leveraging Atroposia can gain initial footholds via phishing or malware campaigns, then use the built-in scanner to enumerate unpatched vulnerabilities in compromised environments, accelerating lateral movement and privilege escalation while remaining elusive to defenses. The rapid adoption of Atroposia by criminal actors raises the risk of automated exploitation and more deeply entrenched incidents across industries. This incident is notable for the shift toward criminal malware platforms bundled with security assessment features, lowering the barrier for less-skilled attackers to conduct advanced operations. Security teams must address these evolving threats with layered defenses and continuous vulnerability management as attacker agility outpaces legacy controls.
6 months ago
Kill Chain
Qilin Ransomware Leverages WSL for Unprecedented Cross-Platform Attacks
In early June 2024, security researchers uncovered that the Qilin ransomware group leveraged the Windows Subsystem for Linux (WSL) to execute Linux-based encryptors on Windows systems. By deploying ransomware binaries within the WSL environment, attackers bypassed many traditional security products that focus on Windows malware, allowing the ransomware to encrypt files with reduced detection rates. This approach enabled more effective lateral movement and evasion within corporate networks, potentially increasing the victim's downtime and recovery costs after infection. This incident is especially noteworthy as it demonstrates an increasing trend of threat actors targeting multi-platform environments and exploiting hybrid operating system features. Security teams must update their approaches to not only monitor classic Windows vectors but also enforce visibility and controls across cross-platform and virtualization layers.
6 months ago
Kill Chain
Dentsu Merkle 2024 Data Breach: What Went Wrong and How to Respond
In June 2024, Japanese advertising conglomerate Dentsu disclosed a cybersecurity breach affecting its U.S.-based subsidiary, Merkle. Unauthorized attackers gained access to internal systems, resulting in the exposure of sensitive employee and client data. The incident was detected after suspicious activity was identified, prompting an immediate investigation and containment measures. While the full extent of the breach is under review, initial reports confirm that personally identifiable information and potentially business-critical records were compromised, highlighting gaps in east-west traffic security and egress controls within corporate IT infrastructure. This incident demonstrates the continuing trend of cyberattacks against major marketing and advertising firms, which are prized for their troves of client data. Organizations are under mounting pressure to modernize east-west traffic security, enforce strict network segmentation, and rapidly detect post-compromise anomaly activity as threat actors increasingly target supply chain partners and professional services firms.
6 months ago
Kill Chain
SideWinder’s 2025 ClickOnce Attack Chain Exposes South Asian Diplomats
In September 2025, the advanced persistent threat group SideWinder targeted a prominent European embassy in New Delhi alongside organizations in Sri Lanka, Pakistan, and Bangladesh. The attackers employed a sophisticated attack chain leveraging weaponized PDF files and Microsoft's ClickOnce technology to deliver malicious payloads. This marks a significant evolution in SideWinder's tactics, exploiting trusted digital distribution methods to bypass legacy security controls. The campaign highlights the risk to diplomatic and government entities in South Asia, raising alarms over the exposure of confidential communications and potential national security impacts. Organizations suffered from disrupted operations and faced reputational damage as investigations unfolded. This incident exemplifies a wider shift toward blending email-based phishing with novel delivery vectors like ClickOnce and cloud distribution platforms. The campaign signals increasing professionalization among APT groups and serves as a warning for public sector and diplomatic organizations to reevaluate defenses against targeted, sophisticated malware attacks.
6 months ago
Kill Chain
Memento Labs Leverages Chrome Zero-Day to Deploy LeetAgent Spyware in 2025
In March 2025, a critical zero-day vulnerability (CVE-2025-2783) in Google Chrome was exploited in the wild, enabling threat actors to escape the browser sandbox and deliver espionage-focused LeetAgent spyware attributed to Italian firm Memento Labs. Security researchers from Kaspersky identified targeted campaigns leveraging this flaw to compromise high-value victims via crafted web content, resulting in covert surveillance, data exfiltration, and unauthorized system access before Google patched the issue. This breach underscores the rapid weaponization of browser vulnerabilities by sophisticated actors to distribute espionage tools, often before defenders can respond. Incidents like this demonstrate an uptick in exploitation of high-impact zero-day flaws, especially in widely used software like Chrome, allowing elite cyber espionage operators to rapidly compromise organizations. The trend poses mounting risks as zero-days are increasingly used for targeted intrusions ahead of public disclosure and patch deployment.
6 months ago
Kill Chain
Invisible Unicode: A 2024 Phishing Campaign Evades Filters with Steganographic Subjects
In October 2024, a targeted phishing campaign exploited invisible Unicode characters—specifically soft hyphens—in email subject lines and bodies to evade detection by automated email filtering systems. The attackers crafted emails with subjects encoded in MIME 'encoded-word' format and used invisible characters to break up suspicious keywords, rendering them undetectable by many traditional filtering solutions. The email lured recipients to a generic credential-stealing webmail page via a deceptive link, aiming to harvest login credentials. This incident highlights a growing trend of adversaries leveraging subtle encoding techniques and Unicode manipulation to bypass security controls. Recent phishing attacks demonstrate increasing sophistication, making it critical for organizations to update their detection mechanisms and user awareness to defend against such evasive TTPs.
6 months ago
Kill Chain
Remote Code Execution: WSUS Patch Bypass Turns Trusted Update Service Into Attack Platform
In June 2024, attackers exploited a critical remote code execution vulnerability (CVE-2025-59287) in Microsoft’s deprecated Windows Server Update Services (WSUS), bypassing an emergency patch that was meant to mitigate the threat. Attackers leveraged publicly exposed WSUS servers, executing unauthenticated commands that enabled environmental enumeration and potential data exfiltration. Researchers observed threat activity just hours after Microsoft released a revised patch, with at least 2,800 exposed WSUS instances identified globally. These servers, operating with high system privileges, presented an ideal entry point for attackers to target downstream systems via malicious software updates, elevating the risk of a far-reaching internal supply chain compromise. This incident highlights the increasing risk associated with outdated and internet-exposed infrastructure. It underscores the rapid pace of threat actor adaptation—often outpacing defenders’ patch cycles—and demonstrates the necessity for organizations to promptly apply patches and follow defense-in-depth practices for critical administrative tools.
6 months ago
Kill Chain
RedTiger Infostealer Attack Hits Discord Users in 2024
In early June 2024, cybersecurity researchers uncovered a new campaign in which attackers used a RedTiger-based infostealer to target Discord users. The campaign leveraged the open-source red-team tool RedTiger to build a custom infostealer designed to harvest Discord account credentials and stored payment information by injecting malicious code into Discord’s directories. Victims typically became infected through malicious downloads or phishing websites, unknowingly handing over sensitive data, including authentication tokens and payment details, to the attackers. As a result, stolen Discord accounts were sold or used for further fraud and account takeovers, risking both personal and organizational information leakage. This incident highlights an escalating trend of using open-source red-team tools for malicious infostealer campaigns, boosting attackers’ agility and reach. It underscores the risk of credential-based attacks on popular platforms, the need for real-time threat detection, and reinforces the importance of continuous endpoint monitoring and stronger egress security controls.
6 months ago
Kill Chain
CISA Orders Immediate Patch for Critical Windows Server WSUS Flaw Exploited in Attacks
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive requiring all U.S. government agencies to urgently patch a critical Windows Server Update Services (WSUS) vulnerability after it was found to be actively exploited in the wild. Attackers leveraged the flaw to gain unauthorized access to Windows Server environments via malicious update mechanisms, potentially allowing for privilege escalation and lateral movement within targeted networks. The incident raised concerns about the rapid exploitation of newly discovered vulnerabilities in core infrastructure and emphasized the necessity for timely patching and robust network segmentation to mitigate further risk. This incident underscores a broader surge in targeted attacks against on-premises infrastructure, with threat actors increasingly exploiting supply chain and software update mechanisms. It reveals an urgent need for organizations to prioritize vulnerability management and align with zero trust best practices, as high-profile vulnerabilities continue to be rapidly weaponized.
6 months ago
Kill Chain
QNAP Backup Software Exposed by Critical ASP.NET Vulnerability in 2024
In June 2024, QNAP, a prominent provider of network-attached storage (NAS) solutions, disclosed that its NetBak PC Agent backup utility for Windows is vulnerable to a critical ASP.NET Core flaw (CVE-2024-27348). This vulnerability, originally reported in Microsoft's platform, allows unauthenticated remote attackers to potentially execute arbitrary code or compromise data in transit. QNAP urged customers to apply security patches immediately, as exploitation may permit attackers to pivot from compromised endpoints to valuable NAS devices, affecting both business continuity and data confidentiality. The QNAP incident highlights the ongoing risk of supply-chain vulnerabilities, particularly when third-party software libraries are widely adopted. With attackers increasingly leveraging zero-day software flaws and targeting backup systems as initial entry points for ransomware and data exfiltration, IT teams must remain vigilant about patching integrations and dependencies across the entire software stack.
6 months ago
Kill Chain
Prompt Injection Flaw in ChatGPT Atlas Browser Enables Hidden Command Execution
In October 2025, security researchers at NeuralTrust identified a prompt injection vulnerability in the newly launched OpenAI ChatGPT Atlas Browser, allowing attackers to disguise malicious prompts as benign URLs in the omnibox. The attack exploits how the omnibox interprets user input, confusing it as either a navigation destination or a natural-language command to the agent. Malicious actors can craft deceptive URLs that bypass basic user scrutiny and trigger hidden commands, exposing users to unauthorized actions, potential data leaks, and unintended system manipulations. OpenAI was notified and subsequently began working on mitigations to address this risk. This incident underscores a rising wave of sophisticated prompt injection attacks targeting AI-powered web interfaces. As AI tools become widely integrated in everyday applications, the attack surface expands, making seamless human-computer interactions susceptible to exploitation from both classic and emerging attack vectors.
6 months ago
Kill Chain
ChatGPT Atlas Browser Hack Reveals Persistent AI Command Exploit
In October 2025, cybersecurity researchers revealed a critical vulnerability in OpenAI’s ChatGPT Atlas web browser, enabling attackers to plant persistent hidden commands within the AI assistant’s memory. Exploiting weaknesses in browser-based AI integration, adversaries were able to inject malicious code that allowed system compromise, privilege escalation, and malware deployment. This attack vector bypassed traditional security controls, proving effective in environments that heavily relied on browser AI plugins for business workflows. The exploit was notable for its ease of delivery through crafted websites or malicious scripts and posed significant operational and reputational risks to affected organizations. This incident underscores the urgent need for robust AI security governance as businesses rapidly integrate AI-powered tools into daily operations. The exploit spotlights a growing class of AI/ML-driven attacks leveraging browser interfaces, echoing wider industry concerns on shadow AI risks and prompting fresh regulatory scrutiny.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports