✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
TARmageddon: Remote Code Execution Risk in Popular Async-Tar Rust Library Uncovered (2025)
In late August 2025, researchers uncovered TARmageddon (CVE-2025-62518), a high-severity supply-chain vulnerability in the async-tar Rust library and its forks, including tokio-tar. This flaw could permit remote code execution (RCE) when processing maliciously-crafted tar archives, posing a significant risk to downstream applications and platforms relying on these libraries for file extraction and archive handling. Successful exploitation opens the door to system compromise, data loss, or service interruption for potentially thousands of applications leveraging async-tar in production workloads. This incident highlights the growing threat of software supply-chain vulnerabilities, especially within open-source dependencies widely adopted across cloud-native and DevSecOps environments. Organizations must closely monitor dependencies, establish strong vulnerability management pipelines, and rapidly respond to disclosures as attackers increasingly target the software supply chain.
6 months ago
Kill Chain
MuddyWater's 2025 Global Espionage Campaign Targets 100+ Organizations
In late 2025, the Iranian nation-state threat group known as MuddyWater launched a sophisticated espionage campaign targeting over 100 organizations across the Middle East and North Africa (MENA) region. Leveraging a compromised email account as an entry point, the attackers distributed a custom backdoor named Phoenix to high-value government entities, enabling covert infiltration and sustained intelligence gathering. The operation involved methods designed to evade detection and facilitate ongoing access to sensitive data, underscoring the persistent risk posed by nation-state actors. This campaign highlights a continued escalation in advanced cyberespionage activities targeting governmental and critical infrastructure sectors. With threat actors increasingly exploiting social engineering and custom malware, organizations face intensified pressure to strengthen defenses and adhere to evolving security frameworks.
6 months ago
Kill Chain
Chinese APT Group Rapidly Exploits SharePoint Vulnerability in Major 2025 Telecom Breach
In July 2025, Chinese state-affiliated threat actors exploited the recently patched ToolShell vulnerability in Microsoft SharePoint to breach a major telecommunications company in the Middle East. This advanced persistent threat (APT) group swiftly leveraged the disclosed flaw to gain unauthorized access, rapidly launching attacks just weeks after the patch was released. Their campaign extended to government bodies in Africa and South America, as well as academic and technology institutions in the US, highlighting a rapid weaponization of public vulnerabilities. The attackers used sophisticated techniques for lateral movement, data exfiltration, and persistence within the affected networks, likely resulting in compromise of sensitive communications, operational disruption, and potential regulatory exposure for the victims. This incident demonstrates how APT actors quickly adapt to disclosed vulnerabilities and underscores the urgency for organizations to accelerate patching cycles and bolster east-west security controls. The event marks an increasing trend of state-sponsored groups targeting hybrid cloud environments and critical infrastructure via freshly disclosed exploits.
6 months ago
Kill Chain
How a Vulnerable AI Plugin in Figma MCP Opened the Door for Remote Code Attacks
In early 2025, a critical vulnerability (CVE-2025-53967) was discovered in a third-party connector integrating agentic AI capabilities with Figma’s Multi-Cloud Platform (MCP) server. This supply-chain flaw enabled remote code execution (RCE), allowing attackers to exploit the connection to infiltrate organizational environments using the affected plugin. Threat actors leveraged the unsanctioned plugin to gain unauthorized access to internal systems, potentially exposing sensitive design data, intellectual property, and user information. The compromise highlighted risks associated with insufficient east-west security controls, lack of zero trust segmentation, and inadequate traffic visibility, ultimately impacting business continuity and trust in the collaboration platform. This incident exemplifies the growing threat of supply-chain vulnerabilities targeting enterprise SaaS applications, amid increasing adoption of AI integrations. Organizations are re-evaluating their third-party risk, agentic AI governance, and internal segmentation postures as regulatory scrutiny and attacker sophistication intensify.
6 months ago
Kill Chain
China-Nexus Threat Actors Weaponize 'Nezha' RAT for Stealthy Campaigns in 2024
In early 2024, cybersecurity researchers uncovered a new campaign by China-nexus threat actors leveraging the open source "Nezha" remote access tool (RAT) to facilitate covert network access and persistence. Unlike traditional RMM (Remote Monitoring and Management) abuse, the adversaries deployed Nezha across multiple victim environments to enable encrypted traffic tunneling, conduct command-and-control operations, and bypass security controls. Targeting enterprises in various sectors, the attackers exploited weak access controls and east-west network traffic to establish lateral movement pathways, with the operation resulting in significant risks to sensitive data and business continuity. This incident highlights an accelerating trend in the use of open source, commodity tools by nation-state-aligned actors to evade detection and complicate attribution. The campaign reflects shifting threat dynamics, as attackers weaponize cloud-native techniques and legitimate tools to target organizations seeking to modernize security controls and comply with frameworks such as NIST and PCI DSS.
6 months ago
Kill Chain
LockBit, Qilin & DragonForce Forge Ransomware Cartel in 2024
In early 2024, notorious ransomware groups LockBit, Qilin, and DragonForce announced a strategic partnership, effectively forming a collaborative ransomware 'cartel.' This alliance has seen these gangs pooling resources, intelligence, and attack methods, shortly after the release of LockBit 5.0. By inviting other e-crime affiliates, they have expanded their operational reach and attack surface across multiple industries. The cartel model increases both the speed and sophistication of attacks, complicating defenders' response and extending the lifecycle of compromised environments for criminal profit. The incident is particularly relevant as it signals a new phase in ransomware operations, with threat actors adopting formal, syndicate-like coordination. It highlights escalating risks for enterprises, as collective intelligence sharing among attackers can quickly disrupt even mature security postures.
6 months ago
Kill Chain
Red Hat Consulting Breach 2024: Crimson Collective Launches Major Supply Chain Attack
In April 2024, the Crimson Collective, in collaboration with elements of the Lapsus$ group, executed a supply chain attack targeting Red Hat Consulting by breaching its GitLab instance. The attackers gained unauthorized access through credential compromise and lateral movement across internal infrastructure, successfully exfiltrating sensitive source code and internal communications. The breach, which remained undetected for several days, raised concerns over east-west traffic security, lack of segmentation, and insufficient anomaly detection within Red Hat Consulting’s cloud development supply chain. This incident highlights the increasing prevalence of supply chain attacks leveraging lateral movement and sophisticated alliance between threat groups. Its relevance is underscored by renewed regulatory scrutiny, the growing risk posed by collaborative cybercriminal operations, and heightened demand for zero trust architecture and cloud-native threat mitigation strategies.
6 months ago
Kill Chain
Vampire Bot: Infostealer Malware Drains Job Hunters in BatShadow’s 2024 Campaign
In early June 2024, security researchers uncovered a widespread infostealer campaign targeting global job seekers through malicious job postings across popular employment platforms. The attack, orchestrated by the Vietnamese cybercriminal group BatShadow, involved the sophisticated Vampire Bot malware, which was delivered via phishing emails and deceptive job application portals. Once installed, Vampire Bot silently harvested sensitive personal data, login credentials, and browser-stored financial information, enabling unauthorized access to victims' accounts. Numerous job seekers reported financial losses and identity theft, highlighting the campaign's destructive business and personal impacts. This incident underscores a growing trend of cybercriminal groups exploiting economic anxieties and job market vulnerabilities to launch tailored infostealer attacks. The operation signals a broader shift towards targeted social engineering and the increasing professionalization of threat actors in Southeast Asia.
6 months ago
Kill Chain
Chaos Ransomware's C++ Upgrade: The 2024 Threat Every Enterprise Must Face
In early 2024, the Chaos Ransomware-as-a-Service operation unleashed a potent new C++ variant, featuring advanced encryption, wiper functionalities, and cryptocurrency-stealing modules. This evolution targets a broad array of victims by leveraging aggressive lateral movement across networks, rapid data encryption, and selective data destruction to intensify pressure on organizations. The threat actors deploy sophisticated evasion tactics and can pivot across cloud and hybrid infrastructures, resulting in operational disruptions and financial losses, especially in environments lacking east-west traffic controls and advanced detection capabilities. The Chaos ransomware upgrade exemplifies a broader trend of rapidly advancing ransomware toolkits integrating destructive and extortion-focused modules. With a spike in cross-industry ransomware incidents and escalating regulatory pressure to remediate compliance gaps, organizations must urgently reevaluate defenses, with emphasis on segmentation, visibility, and high-speed encrypted traffic controls.
6 months ago
Kill Chain
GitHub Copilot CamoLeak: AI Attack Demonstrates Exfiltration Risk in 2024
In early 2024, cybersecurity researchers disclosed a proof-of-concept (PoC) called 'CamoLeak' demonstrating a novel attack vector exploiting GitHub Copilot’s AI code completion capability for data exfiltration. The PoC showed how sensitive code snippets and secrets could be extracted from Copilot instances by crafting malicious prompts that trick the AI into leaking previously seen proprietary content. While GitHub employs robust internal mitigations, the research exposes significant risks for organizations integrating generative AI tools into development workflows, particularly where prompt and response data may be inadequately secured. This incident underscores the rapid evolution of attack techniques targeting GenAI platforms and highlights emergent threats of data leakage through AI-driven automation. As enterprises increasingly leverage AI coding assistants, understanding and mitigating AI-enabled exfiltration vectors is key to upholding governance, compliance, and intellectual property security.
6 months ago
Kill Chain
Nation-State Ransomware: Storm-2603 Exploits Velociraptor in 2024 Attacks
In early 2024, the Storm-2603 threat group, attributed to Chinese nation-state actors, conducted a series of ransomware campaigns leveraging the legitimate Velociraptor digital forensics and incident response (DFIR) tool. By abusing Velociraptor, the attackers achieved persistent access, lateral movement, and stealthy data collection within targeted corporate environments. The group exploited weaknesses in east-west traffic security and endpoint controls, using legitimate tooling to evade detection and deploy ransomware payloads, leading to operational disruption and potential data exfiltration for multiple organizations. This incident highlights an escalation in adversaries’ use of legitimate IT and forensics tools for malicious purposes, complicating detection strategies. It exemplifies the growing threat of "living-off-the-land" tactics, where attackers blend in with standard operations, underscoring the need for improved anomaly detection, zero trust segmentation, and lateral movement controls.
6 months ago
Kill Chain
RondoDox Botnet Unleashes 'Exploit Shotgun' on Edge Devices
In early 2024, cybersecurity researchers uncovered the RondoDox Botnet, a rapidly evolving threat that leverages an 'exploit shotgun' methodology to compromise a wide range of consumer edge devices worldwide. The botnet scans for and exploits multiple zero-day and known vulnerabilities across routers and IoT devices, often gaining initial access through unpatched firmware or exposed management interfaces. Once inside, RondoDox deploys malware that enables remote control, data exfiltration, and lateral movement, allowing attackers to build a resilient, distributed botnet infrastructure which has been used for DDoS attacks and potentially other malicious activities. The decentralized campaign demonstrates sophisticated automation, making incident response and containment significantly more difficult for defenders. This incident is highly relevant as it highlights the surge in automated botnet attacks targeting unmanaged edge devices, a trend driven by increasing adoption of IoT and remote work infrastructure. The RondoDox tactics underscore the urgency for organizations to address lateral movement, patch management, and zero trust segmentation, especially as regulatory scrutiny on device and network security continues to intensify.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports