✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
GitHub Mandates 2FA and Short-Lived Tokens After npm Supply Chain Attack
In September 2025, GitHub responded to a series of sophisticated supply chain attacks targeting the npm package ecosystem, most notably the Shai-Hulud compromise. Adversaries exploited weak authentication mechanisms and abused publishing tokens to inject self-replicating malware into widely used npm libraries. These malicious packages were automatically distributed downstream to thousands of unsuspecting development workflows, putting the integrity of software supply chains at risk. The attacks prompted GitHub to mandate two-factor authentication (2FA) for all npm publishers and to introduce short-lived authentication tokens to substantially reduce exposure to token theft. This incident underscores the growing trend of attackers targeting developer ecosystems as entry points for widespread compromise. The enhanced security controls by GitHub reflect a broader industry movement to harden software supply chains amid intensifying regulatory scrutiny and increasingly sophisticated attack methods.
6 months ago
Kill Chain
SolarWinds 2025 RCE Flaw: What CVE-2025-26399 Means for Enterprise Security
In September 2025, SolarWinds disclosed a critical vulnerability (CVE-2025-26399, CVSS 9.8) in its Web Help Desk software, allowing remote code execution via deserialization of untrusted data. Attackers could exploit this flaw to execute arbitrary commands on affected systems, potentially leading to full compromise of customer environments. SolarWinds released urgent hotfixes to address the flaw after it was identified during routine security testing, emphasizing the risk to organizations running unpatched instances exposed to the internet. This incident underscores the persistent threat posed by software supply chain vulnerabilities and insecure coding practices in widely used IT management platforms. With high-profile supply chain attacks on the rise, rapid vulnerability disclosure and patching are now critical to minimizing both direct exploitation and regulatory exposure.
6 months ago
Kill Chain
Supermicro BMC Supply-Chain Bugs Reveal Firmware Trust Weaknesses in 2025
In September 2025, researchers unveiled two medium-severity vulnerabilities affecting Supermicro's Baseboard Management Controller (BMC) firmware. Attackers could leverage improper cryptographic signature validation to bypass root-of-trust controls, allowing the deployment of malicious firmware images through supply-chain vectors. The flaws enable an adversary to compromise hardware integrity, potentially resulting in persistent access, data exfiltration, and disruption within enterprise server environments. Supermicro promptly released firmware updates and provided mitigation guidance as exploitation risks became public. This incident reflects an unsettling rise in supply-chain attacks targeting device firmware and hardware trust anchors. It underscores both the growing sophistication of attacker techniques and the criticality of maintaining robust verification, anomaly detection, and real-time firmware integrity validation for modern IT infrastructure.
6 months ago
Kill Chain
Fake GitHub Pages Used to Deliver Atomic Stealer to Mac Users in 2024
In early 2024, cybercriminals launched a large-scale campaign targeting macOS users by leveraging SEO poisoning, fraudulent GitHub repositories, and fake GitHub Pages to distribute the Atomic (AMOS) infostealer malware. Attackers lured users searching for popular software with malicious websites that mimicked legitimate download portals, redirecting victims to GitHub-hosted payloads. Once executed, the malware exfiltrated critical information such as credentials, browser data, cryptocurrency wallets, and system details, putting both individuals and organizations at serious risk. The campaign’s scope and reliance on open-source infrastructure enabled the threat actors to infect a wide swathe of Mac users with relative ease. This incident is particularly relevant due to the increasing prevalence of infostealer malware targeting macOS, the cunning use of SEO manipulation for initial access, and the abuse of trusted development platforms like GitHub. Security teams must be vigilant as these multi-vector attacks blend social engineering, supply chain compromise, and cloud service misuse to evade traditional defenses.
6 months ago
Kill Chain
SANS Honeypot 2024: SYN Flood Distraction Amplifies Network Reconnaissance Threat
Between March 31 and April 20, 2024, the SANS Internet Storm Center's honeypot experienced a persistent barrage of over 2.3 million TCP SYN packets in three distinct waves, mimicking a distributed denial of service (DDoS) campaign. Traffic originated from thousands of hosts—mostly within Bangladeshi and Iraqi ISPs—leveraging spoofed and potentially compromised IPs to generate low-rate, highly patterned SYN floods targeting port 443. Despite the scale, the attack's volume and packet rates were insufficient to disrupt modern services and instead appeared to serve as a diversionary tactic. This incident highlights emerging trends in network reconnaissance and distraction techniques, where attackers intentionally generate noisy traffic to mislead analysts and mask parallel or future activities. As SYN flood patterns evolve and attackers increasingly use crafted packets and IP spoofing, traditional DDoS detection and response strategies must adapt to avoid misallocation of resources or missing stealthier threats.
6 months ago
Kill Chain
AT&T 2023: How Salt Typhoon Changed the APT Playbook
In 2023, the telecommunications giant AT&T was targeted by the advanced persistent threat group Salt Typhoon, which launched a sophisticated campaign exploiting unconventional vulnerabilities. Unlike conventional attacks, Salt Typhoon focused on endpoints lacking robust detection and response (EDR), hunted for network blind spots with minimal logging, and engaged in 'living off the land' attacks—leveraging legitimate administrative tools to evade detection and persist inside networks. This multi-pronged methodology enabled deep network infiltration before discovery, ultimately jeopardizing sensitive data and service availability across AT&T’s infrastructure. Following the breach, the company reported the threat group was successfully evicted from its systems. This incident has set a precedent, with numerous threat actors now adopting Salt Typhoon’s tactics to bypass traditional security controls. The breach highlights an urgent need for organizations to enhance monitoring, bolster endpoint visibility across all platforms, and adapt defenses for evolving attacker methodologies in critical infrastructure sectors.
6 months ago
Kill Chain
Steam’s Platform Breached: BlockBlasters Game Used for Massive 2025 Crypto Theft
In September 2025, a verified Steam game, BlockBlasters, was discovered to have been weaponized to steal cryptocurrency from users, including a content creator raising money for cancer treatment. Initially benign, the game was compromised on August 30 with a cryptodrainer component that harvested Steam credentials, IP addresses, and ultimately drained victims’ digital wallets. Attackers targeted high-value accounts sourced from social media, using a mix of batch scripts, Python backdoors, and StealC payloads, leading to an estimated $150,000 in theft across hundreds of accounts. At least one streamer lost $32,000 in funds intended for lifesaving care. This incident exemplifies the growing threat of supply-chain and platform abuse, with attackers leveraging trusted app marketplaces to deliver infostealers. The BlockBlasters case underscores the urgent need for advanced egress security, anomaly detection, and zero trust controls, as attackers increasingly exploit digital trust and social media to orchestrate high-impact thefts.
6 months ago
Kill Chain
2025's Multichannel Phishing Campaigns: The End of Email-Only Defense
In September 2025, organizations experienced a surge of sophisticated credential harvesting attacks that moved beyond traditional email phishing, utilizing instant messaging, social media, and malicious advertising channels. Attackers deployed advanced Attacker-in-the-Middle (AiTM) phishing kits and leveraged compromised accounts, cloned login pages, and rapid domain rotation to evade both detection and remediation. Case studies included targeted spear-phishing via LinkedIn and malvertising on Google Search, resulting in high-value session theft and lateral account compromise. These attacks not only bypassed email security but exploited any channel where business users could be reached, often leading to the breach of core cloud platforms and widespread internal access. This campaign marks a critical evolution in attacker tactics, underlining that perimeter-focused and email-only defenses are insufficient. The surge in non-email phishing brings new urgency for organizations to secure east-west traffic, implement zero trust segmentation, and enhance visibility across all cloud and SaaS environments.
6 months ago
Kill Chain
Fake Password Managers Spread AMOS Malware on Mac: The 2025 LastPass Incident
In September 2025, LastPass reported an ongoing malware campaign targeting macOS users with fake password managers distributed through fraudulent GitHub repositories and deceptive SEO-optimized links. The attackers impersonated over 100 popular software products—including LastPass, 1Password, Dropbox, and others—using build-your-own repositories that redirected victims to install scripts containing the Atomic (AMOS) infostealer malware. Victims were instructed to run shell commands that downloaded backdoored payloads, risking credential theft, data exfiltration, and sustained system compromise. The campaign employed automated methods for rapid replication and evasive takedown resistance. This incident underscores a surge in supply chain and social engineering attacks using open platforms and SEO abuse, highlighting the persistent vulnerabilities in software distribution channels for macOS. It demonstrates attackers' growing sophistication in exploiting user trust and platform discoverability to deploy credential-stealing malware at scale.
6 months ago
Kill Chain
Ransomware Attack Disrupts Major European Airports via Collins Aerospace in 2025
In September 2025, a major ransomware attack on Collins Aerospace, a critical provider of check-in and boarding systems, triggered widespread disruptions at several major European airports, including Heathrow, Brussels, and Berlin Brandenburg. The hackers targeted the Multi-User System Environment (MUSE) platform, which airlines rely on to coordinate check-in desks and gate assignments. As a result, more than 100 flights were delayed or cancelled, and thousands of passengers faced manual check-in procedures while airports scrambled to contain the operational fallout. Law enforcement and cybersecurity agencies are actively investigating, prioritizing the restoration of affected systems and mitigation of further impact. This incident underlines the escalating risk posed by ransomware targeting supply chain infrastructure and the aviation sector’s reliance on shared IT systems. It also reflects a broader trend of cybercriminals exploiting third-party service dependencies, bringing renewed urgency to layered defense strategies and zero-trust adoption for business-critical environments.
6 months ago
Kill Chain
Microsoft Entra ID Flaw Exposed: How One Vulnerability Enabled Global Admin Impersonation
In September 2025, Microsoft disclosed a severe security flaw (CVE-2025-55241) affecting its Entra ID (formerly Azure Active Directory) service. The vulnerability, which received a maximum CVSS score of 10.0, allowed threat actors to bypass token validation and impersonate any user—including Global Administrators—across any tenant. Successful exploitation could grant attackers unrestricted access to sensitive data and resources within affected organizations, making this a high-impact privilege escalation incident. Microsoft responded swiftly, issuing a critical patch to contain the risk and urging immediate customer action. This incident highlights the ongoing trend of identity-based attacks against cloud platforms, emphasizing the necessity of robust access controls and vigilant monitoring. The discovery reinforces the risks of SaaS/IDaaS privilege escalation, as attackers increasingly target provider-side weaknesses to achieve large-scale compromise.
6 months ago
Kill Chain
Multi-Vector Cyberattack 2025: AI, Chrome 0-Day, DDR5 and npm Supply Chain Breach
In September 2025, a multifaceted wave of cyber threats was observed, including a Chrome zero-day exploit, AI-generated hacking toolkits, active exposure of DDR5 memory vulnerability (Rowhammer-based bit-flip attacks), and a virulent npm worm targeting the software supply chain. Attackers leveraged 0-day browser exploits to execute malicious code, engineered advanced AI tools for automation, and deployed the npm worm to laterally move via package dependencies. The surge in attack sophistication resulted in unauthorized access, rapid lateral movement, and significant operational disruption for developers and enterprises globally. This incident underscores an urgent pivot in attacker tactics—combining classic and novel vulnerabilities across infrastructure, code, and memory. The simultaneous exploitation of multiple vectors signals a broader trend of adaptive threat landscapes, increasing regulatory scrutiny, and the need for rapid detection, cross-layer visibility, and agile patching cycles.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports