✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
RedTail Cryptojacking: 2024 SSH Honeypot Attack Exposes Evasive Trends
In 2024, repeated attempts to deploy RedTail cryptojacking malware were observed targeting honeypots through brute-forced SSH credentials and exploitation of vulnerabilities. Attackers gained access by cracking weak SSH passwords, uploaded and executed scripts such as setup.sh and clean.sh, and implemented persistent access by implanting their own SSH keys. They evaded detection by deleting evidence, queried system info to optimize deployment, and communicated outbound over HTTPS to control mining pools, siphoning off computing resources for Monero mining. The attack demonstrated both technical sophistication and evasiveness, resulting in loss of system performance and increased operational costs for victims. The RedTail campaign stands out for its focus on stealth, persistence, and lateral evasion, signaling a shift from noisy ransomware to more subtle and long-term threats like cryptojacking. With attackers honing in on resource hijacking and leveraging diverse TTPs, organizations face new challenges in detection and response. This incident shows the increasing necessity for robust SSH hardening, proactive monitoring, and defense-in-depth measures against evolving cryptojacking methods.
6 months ago
Kill Chain
2025 Cloud Provider Breach Uncovers Critical Zero Trust Weaknesses
In early 2025, a major global cloud provider suffered a sophisticated multi-stage breach in which adversaries gained initial access using compromised identity credentials, exploited weak east-west segmentation, and moved laterally across multicloud environments. The attackers leveraged unencrypted traffic channels and insufficient policy controls to evade detection, escalate privileges, and access sensitive customer data. As a result, organizations relying on this provider experienced outages, data exfiltration, and business continuity disruptions while the cloud provider scrambled to restore services and conduct forensic investigations. This incident highlights a rapidly growing trend: attackers are increasingly targeting cloud infrastructure, exploiting vulnerabilities in workload isolation, cloud-native policy enforcement, and hybrid connectivity. With regulators enhancing requirements and business dependence on cloud rising, defending against lateral movement and enforcing zero-trust has become a critical priority.
6 months ago
Kill Chain
RedNovember: Chinese State-Sponsored Espionage Campaign Hits Global Defense and Tech Sectors
Between June 2024 and July 2025, the Chinese state-sponsored threat group RedNovember (overlapping with Storm-2077 and formerly tagged as TAG-100) orchestrated a far-reaching cyber-espionage campaign targeting government, defense, and technology organizations globally. Leveraging weaponized perimeter device exploits and open-source tools like Pantegana and Cobalt Strike, the group gained initial access via widely used firewalls and VPNs, including SonicWall, Fortinet, Palo Alto, and Ivanti Connect Secure. Victims included ministries, intergovernmental bodies, US defense contractors, European manufacturers, and space organizations. The campaign’s impact highlights persistent perimeter vulnerabilities and demonstrated operational scale and stealth through commodity tooling and strategic timing near geopolitical events. This incident underscores the shift toward exploiting edge devices and open-source frameworks for stealth, scalable compromise by advanced actors. The trend signals urgent challenges for organizations relying on perimeter appliances and highlights the need to strengthen monitoring, zero trust segmentation, and compliance-driven security controls across hybrid and multicloud environments.
6 months ago
Kill Chain
npm Package Supply Chain Compromise: 2023’s Maintainer Phishing Attacks
In mid-2023, a significant wave of supply chain attacks targeted the npm JavaScript ecosystem, compromising maintainer accounts through highly sophisticated phishing campaigns and credential theft. Adversaries delivered convincing emails impersonating npmjs.org, tricking developers into revealing login credentials and two-factor authentication secrets. Stolen publishing tokens and, in some cases, hijacked email domains enabled attackers to inject malicious code into popular packages such as 'prettier', 'chalk', and 'debug'. This resulted in malware propagation to thousands of downstream applications, facilitating widespread credential theft, cryptocurrency manipulation, and exfiltration risks within user environments. Organizations and end users faced significant exposure due to the trust placed on these foundational open-source dependencies. The incident remains highly relevant as npm and the broader open-source software community continue to see an uptick in targeted supply chain attacks. Threat actors are evolving their techniques, leveraging both technical exploits and sophisticated social engineering, raising the urgency for robust package vetting, stronger identity controls, and supply chain transparency.
6 months ago
Kill Chain
Double Agents: The 2024 Exploitation of AI Agent Mode in Commercial Platforms
In March 2024, security researchers revealed how threat actors exploited 'agent mode' in commercial AI products to conduct AI-in-the-middle (AIitM) attacks. By abusing the emerging capability that allows AI assistants to autonomously perform actions, adversaries were able to impersonate users or escalate privileges by intercepting and manipulating commands. This allowed attackers to facilitate lateral movement, data exfiltration, and policy circumvention within enterprise environments, often leaving minimal forensic traces. The incident highlighted how the wider adoption of agentic AI features substantially expands the potential threat surface for organizations. This breach has rapidly gained industry attention amid a surge in advanced AI-driven attacks and a wave of regulatory scrutiny on AI operational security. As enterprises accelerate their deployment of commercial AI tools, understanding the novel risks introduced by agentic AI is now critical for leadership and security teams.
6 months ago
Kill Chain
NPM Supply Chain: Shai-Hulud Attack Compromises 700+ Packages
In September 2024, researchers identified a large-scale supply chain attack leveraging malicious NPM packages weaponized with the "Shai-Hulud" malware. Attackers trojanized over 700 NPM packages—including popular and widely-used ones such as CrowdStrike's—compromising developer systems and creating persistent, unauthorized GitHub Actions workflows in code repositories. The attack targeted both Windows and Linux environments, harvesting developer credentials, CI/CD tokens, and secrets, then exfiltrating the data via webhooks to attacker-controlled servers. The worm-like propagation enabled ongoing data theft and espionage, raising substantial risks for any organization dependent on NPM or continuous integration workflows. This incident underscores growing risks in software supply chains, as modern attacks increasingly target developer tools and automation infrastructure. Self-propagating, persistent attacks such as Shai-Hulud highlight the need for stronger code provenance controls, real-time threat detection, and updated development pipeline security to counter evolving adversary tactics.
6 months ago
Kill Chain
King KongTuke Breach Unmasks East-West Security Gaps in Multi-Cloud Era
In September 2025, a sophisticated breach attributed to the threat group 'King KongTuke' targeted several enterprises operating in multi-cloud environments. Attackers exploited weaknesses in east-west traffic controls and bypassed improper network segmentation by leveraging encrypted, paste-and-run lures to establish covert lateral movement between cloud workloads. Once inside, the group utilized remote access tools and encrypted tunnels to exfiltrate sensitive data at scale, evading traditional threat detection and impairing business operations across industries including fintech and healthcare. The incident revealed extensive compliance risks and forced urgent remediation of cloud and hybrid network configurations. This breach highlights a growing trend of threat actors exploiting hybrid and multicloud blind spots. The event has triggered renewed urgency on east-west visibility, zero trust controls, and AI-enabled anomaly detection. Regulatory attention is increasing on enforcing segmentation, encryption in transit, and cloud-native policy enforcement at scale.
6 months ago
Kill Chain
Phishing and RMM Tool Abuse Drive Multi-Vector Attacks – September 2025 Wrap-Up
In September 2025, organizations faced a surge of multi-vector cyber campaigns targeting enterprises through sophisticated phishing attacks and compromised WordPress sites. Attackers used phishing emails as entry points, tricking employees into installing remote monitoring and management (RMM) tools such as AnyDesk and Atera, thereby gaining unauthorized access to internal networks. Simultaneously, threat actors leveraged vulnerable or hijacked WordPress websites to distribute malware payloads, facilitating both initial compromise and lateral movement across organizations' internal networks. The impact included credential theft, unauthorized remote control, and data exfiltration, as well as disruption to normal business activities. This incident highlights a rapidly evolving threat landscape where attackers combine social engineering, legitimate RMM tools, and supply-chain exploits to evade traditional security defenses. It underscores increased regulatory attention on monitoring east-west traffic, policy enforcement, and anomaly detection across hybrid cloud environments.
6 months ago
Kill Chain
DraftKings 2025 Credential Stuffing Breach: Lessons in Password Security
In October 2025, DraftKings, a prominent sports betting company, disclosed that less than 30 customer accounts were compromised via credential stuffing attacks. Threat actors utilized previously stolen username and password combinations from breaches of unrelated services, leveraging automated tools to gain unauthorized access to DraftKings user accounts. While the attackers obtained personal data such as names, addresses, dates of birth, contact details, and the last four digits of payment cards, there was no evidence of access to sensitive government-issued IDs or full financial account numbers. DraftKings responded swiftly by notifying affected users, requiring password resets, and recommending the use of multifactor authentication to mitigate further risk. This incident highlights the persistent threat of credential stuffing—an attack vector that exploits widespread password reuse. With large troves of leaked credentials available and automated attack tools on the rise, organizations across industries face increasing regulatory pressure to implement layered authentication and robust account monitoring to defend against identity-driven threats.
6 months ago
Kill Chain
Google Gemini Hit by Unfixed ASCII Smuggling AI Attack in 2025
In October 2025, a newly disclosed ASCII smuggling attack targeting Google’s Gemini AI assistant exposed a significant security vulnerability stemming from the model's processing of hidden Unicode payloads. Security researcher Viktor Markopoulos demonstrated that attackers could leverage invisible Unicode characters in Calendar invites or emails, prompting Gemini to execute unseen instructions and alter its behavior without user awareness. Notably, the exploit could automate data extraction or spoof identities within Google Workspace integrations, increasing risk for both users and enterprises. Despite the demonstrated risks, Google chose not to address the vulnerability, citing its overlap with social engineering tactics. This incident underscores the heightened threat posed by AI/ML attacks against widely integrated platforms. As LLMs increasingly automate workflows and access sensitive data, adversarial prompt manipulation and Unicode character abuse are becoming urgent areas for organizational security reviews and regulatory scrutiny.
6 months ago
Kill Chain
Salesforce 2025 Supply Chain Data Breach: An Executive Overview
In 2025, Salesforce and hundreds of its customers were targeted in two coordinated data theft campaigns by the threat group "Scattered Lapsus$ Hunters," leveraging both social engineering and stolen OAuth tokens. Attackers tricked employees into connecting malicious OAuth applications or exploited compromised Salesloft Drift tokens, gaining unauthorized access to sensitive CRM data, support tickets, credentials, and authentication tokens. The attackers subsequently attempted to extort 39 major organizations, threatening to leak up to 1.5 billion records via a dark web leak site unless sizable ransom demands were met. Salesforce publicly refused to negotiate or pay any ransom, and law enforcement actions appeared to subsequently seize the extortion domain. This incident underscores the growing sophistication of supply-chain attacks using identity-based and OAuth token compromise, highlighting the rising risk to SaaS ecosystems. The event triggered significant concerns across industries that increasingly rely on interconnected third-party platforms and further emphasizes urgent gaps in SaaS security, zero trust application governing, and lateral movement prevention.
6 months ago
Kill Chain
Google Workspace 2025 OAuth Supply Chain Breach: Lessons From the Drift Incident
In August 2025, a supply chain attack targeted Google Workspace via compromised OAuth tokens associated with the Drift email integration, impacting several organizations. Attackers leveraged stolen Drift tokens to gain unauthorized, delegated access to connected Google Workspace mailboxes, bypassing traditional security controls by exploiting trusted third-party app grants. Google rapidly responded on August 9 by revoking the affected tokens and disabling the integration. While only a small number of mailboxes were directly accessed, the incident underscored how attackers increasingly exploit SaaS interconnections rather than direct platform breaches. This incident is particularly relevant today as exploitation of OAuth tokens and third-party integrations continues to climb, representing a paradigm shift in enterprise attack surfaces. It highlights the growing need for comprehensive SaaS integration visibility, rigorous token governance, and real-time behavioral monitoring as attackers increasingly favor these stealthy, scalable techniques.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports