✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Unveiling the WhatsApp VBS RMM Campaign: A 2026 Cybersecurity Threat
In June 2026, a sophisticated malware campaign was identified, leveraging WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. These scripts, once executed, initiated a multi-stage infection chain that ultimately installed Remote Monitoring and Management (RMM) software, granting attackers persistent remote access to compromised Windows systems. The campaign employed social engineering tactics, using deceptive file names to entice users into executing the scripts. Notably, the malware utilized renamed legitimate Windows utilities and retrieved payloads from trusted cloud services, effectively evading detection mechanisms. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/31/whatsapp-malware-campaign-delivers-vbs-payloads-msi-backdoors/?utm_source=openai)) This incident underscores a concerning trend in cyber threats, where attackers exploit widely-used communication platforms and legitimate tools to infiltrate systems. The use of trusted cloud services for payload delivery and the manipulation of standard Windows utilities highlight the evolving sophistication of threat actors. Organizations must remain vigilant, enhancing their security protocols to detect and mitigate such deceptive tactics.
1 month ago
Kill Chain
AryStinger Malware Hijacks 4,300 Legacy Routers in 2026
In June 2026, security researchers at QiAnXin's XLab identified a new malware strain named AryStinger, which has compromised over 4,300 outdated routers, primarily D-Link models like DIR-850L and DIR-818LW. The malware exploits old vulnerabilities—CVE-2013-3307 and CVE-2016-5681—to transform these devices into a distributed network for reconnaissance and proxying malicious traffic. Unlike typical botnets used for DDoS attacks, AryStinger focuses on pre-intrusion activities such as internet scanning, service fingerprinting, subdomain enumeration, and traffic tunneling, effectively masking the attacker's origin. This incident underscores the critical risks posed by unpatched, legacy hardware in both residential and small office environments. The widespread infection, notably concentrated in South Korea and China, highlights the necessity for regular firmware updates and the decommissioning of unsupported devices to prevent their exploitation in sophisticated cyber operations.
1 month ago
Kill Chain
CSIS's Landmark Operation: Neutralizing Botnet Threats in Canada
In May 2024, the Canadian Security Intelligence Service (CSIS) obtained a Federal Court warrant to neutralize two foreign-operated botnets that had infected servers, home routers, and IoT devices across Canada. This unprecedented legal authorization allowed CSIS to alter, degrade, and destroy malicious data on compromised devices, effectively severing their connection to the botnet networks. The operation targeted a range of devices, including Ring doorbells, security cameras, and Wi-Fi-enabled appliances, to mitigate potential threats to critical infrastructure and national security. This case underscores the evolving landscape of cyber threats and the necessity for intelligence agencies to adopt proactive measures. The legal framework established by this warrant sets a precedent for future cyber defense operations, highlighting the importance of balancing national security interests with individual privacy rights.
1 month ago
Kill Chain
Squidbleed Vulnerability (CVE-2026-47729) Exposes Cleartext HTTP Requests
In June 2026, researchers disclosed 'Squidbleed' (CVE-2026-47729), a critical vulnerability in the Squid web proxy that has existed since 1997. This heap over-read flaw allows an attacker with access to the same proxy to leak another user's cleartext HTTP requests, potentially exposing sensitive information such as credentials or session tokens. The vulnerability stems from improper handling of FTP directory listings, leading to memory disclosure when parsing malformed responses from attacker-controlled FTP servers. Squid's default configuration, which enables FTP support and permits traffic on port 21, exacerbates the risk. The disclosure of Squidbleed underscores the persistent risks associated with legacy code and the importance of regular security audits. Organizations relying on Squid proxies should promptly update to version 7.7 or later, which addresses this vulnerability. Additionally, disabling FTP support can mitigate exposure. This incident highlights the need for vigilant maintenance of network infrastructure to prevent exploitation of longstanding vulnerabilities.
1 month ago
Kill Chain
AryStinger Botnet Hijacks Over 4,000 D-Link Routers Globally
In June 2026, the AryStinger botnet compromised over 4,000 outdated D-Link routers worldwide, transforming them into proxies for malicious activities. The malware exploited known vulnerabilities, including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, primarily targeting D-Link DIR-850L and DIR-818LW models. Infected devices were utilized for scanning, proxying, tunneling, and command execution, with the capability to tamper with DNS settings and monitor network traffic. The majority of infections were reported in South Korea (48.5%), China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%). This incident underscores the critical need for organizations to replace end-of-life hardware and apply the latest firmware updates to mitigate risks associated with outdated devices. The AryStinger botnet's exploitation of legacy vulnerabilities highlights the ongoing threat posed by unpatched systems in the cybersecurity landscape.
1 month ago
Kill Chain
Mastra AI Supply Chain Attack: A Wake-Up Call for Software Security
In June 2026, Microsoft identified a significant supply chain attack targeting the Mastra AI ecosystem, attributed to the North Korean state-sponsored group Sapphire Sleet (also known as BlueNoroff). The attackers compromised an npm maintainer account, 'ehindero,' with publishing privileges across the Mastra package environment. They published malicious updates for over 140 packages within the @mastra scope, introducing a malicious dependency named 'easy-day-js,' a typosquat of the legitimate 'dayjs' JavaScript library. Upon installation, this dependency executed a post-install hook deploying a malware dropper on developers' devices, aiming to steal sensitive credentials, API keys, authentication tokens, and cryptocurrency wallets. The second-stage payload was a cross-platform information stealer designed to target Windows, Linux, and macOS systems, collecting host information, browser histories, installed applications, running processes, and checking for 166 cryptocurrency wallet browser extensions, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. The malware employed different persistence methods depending on the operating system, such as Windows Registry Run keys, macOS LaunchAgents, and Linux systemd services. Microsoft observed that systems communicating with the attackers' command-and-control servers exhibited follow-on activity consistent with Sapphire Sleet's previous campaigns, including the deployment of a PowerShell backdoor, additional persistence mechanisms, Microsoft Defender exclusions, and a malicious Windows service granting SYSTEM privileges. This incident underscores the evolving tactics of North Korean threat actors in targeting the software supply chain to facilitate credential theft and cryptocurrency asset exfiltration. Organizations are urged to enhance their supply chain security measures and remain vigilant against such sophisticated attacks.
1 month ago
Kill Chain
Prinz Eugen Ransomware: A New Threat Targeting Recent Files
In June 2026, the Prinz Eugen ransomware group launched attacks targeting organizations in the United Kingdom, France, and South Africa. The group gained initial access through stolen RDP credentials, utilizing legitimate remote monitoring and management tools to establish persistence. Their Go-based malware prioritized encrypting recently modified files, aiming to disrupt critical business operations. Notably, the ransomware did not leave a ransom note, complicating detection and response efforts. This incident underscores the evolving tactics of ransomware groups, emphasizing the need for organizations to enhance their cybersecurity measures. The use of legitimate tools for malicious purposes highlights the importance of monitoring for anomalous behavior and implementing robust access controls to mitigate such threats.
1 month ago
Kill Chain
CISA Confirms Active Exploitation of Splunk Enterprise Vulnerability CVE-2026-20253
In June 2026, a critical vulnerability (CVE-2026-20253) was identified in Splunk Enterprise versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6, allowing unauthenticated remote attackers to create or truncate arbitrary files via a PostgreSQL sidecar service endpoint lacking authentication controls. This flaw enables potential remote code execution, posing significant risks to affected systems. ([advisory.splunk.com](https://advisory.splunk.com/advisories/SVD-2026-0603?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of this vulnerability and has mandated federal agencies to patch their systems by June 22, 2026.
1 month ago
Kill Chain
Understanding Device Code Phishing: The New Frontier in MFA Bypass
In early 2026, cybersecurity researchers identified a surge in phishing campaigns exploiting the OAuth 2.0 Device Authorization Grant flow to bypass multi-factor authentication (MFA). Attackers trick users into entering device codes on legitimate Microsoft authentication pages, granting unauthorized access to services like Outlook, OneDrive, and Teams without stealing credentials. This method allows persistent access, even after password resets, posing significant risks to organizations relying on traditional MFA for security. The proliferation of Phishing-as-a-Service platforms, such as Kali365, has lowered the technical barrier for cybercriminals, enabling large-scale exploitation of this technique. The FBI and Microsoft have issued warnings, emphasizing the need for organizations to implement conditional access policies, disable device code authentication where unnecessary, and adopt phishing-resistant MFA solutions to mitigate these evolving threats.
1 month ago
Kill Chain
Texas Parks and Wildlife Department Data Breach Exposes Over 3 Million Records
In June 2026, the Texas Parks and Wildlife Department (TPWD) disclosed a significant data breach involving its license system vendor, exposing personal information of over 3 million individuals. The compromised data includes driver's license information, passport numbers, email addresses, phone numbers, and residential addresses. Notably, Social Security numbers, dates of birth, and financial information were not affected. The breach was detected by the Texas Cyber Command, prompting an immediate investigation and the implementation of enhanced security measures. ([tpwd.texas.gov](https://tpwd.texas.gov/about/notification-of-data-security-incident/?utm_source=openai)) This incident underscores the escalating risks associated with third-party vendors in data security. Organizations are increasingly vulnerable to breaches through external partners, highlighting the necessity for stringent vendor management and comprehensive security protocols to safeguard sensitive information.
1 month ago
Kill Chain
AutoJack Attack: A Wake-Up Call for AI Agent Security
In June 2026, Microsoft researchers disclosed a critical vulnerability named 'AutoJack' that allows a single web page to hijack AI browsing agents, leading to remote code execution on the host machine. By directing an AI agent to load a malicious web page, attackers can exploit JavaScript to interact with privileged local services, spawning unauthorized processes without requiring user credentials or further interaction. This exploit underscores the significant risks associated with AI agents' integration with web content and their elevated system privileges. The AutoJack attack highlights the growing trend of adversaries targeting AI development tools and agents. Similar incidents, such as the 'Agentjacking' attack, have demonstrated how AI coding agents can be manipulated into executing malicious code through crafted error reports. These developments emphasize the urgent need for robust security measures in AI agent design and deployment to prevent exploitation through prompt injections and other novel attack vectors.
1 month ago
Kill Chain
The Gentlemen RaaS Unleashes GentleKiller: A New EDR Evasion Framework
In June 2026, The Gentlemen ransomware-as-a-service (RaaS) operation was identified as actively developing and distributing a suite of endpoint detection and response (EDR) termination tools, collectively known as the GentleKiller framework. This framework targets approximately 400 processes associated with 48 distinct security programs, effectively disabling system defenses prior to deploying ransomware payloads. The Gentlemen group has demonstrated rapid operationalization of newly disclosed proof-of-concept exploits, often integrating them within days of public release. The Gentlemen's ability to swiftly adapt and enhance their EDR evasion techniques underscores a significant evolution in ransomware tactics, emphasizing the need for organizations to implement robust, multi-layered security measures. The group's extensive use of the bring your own vulnerable driver (BYOVD) technique highlights the importance of monitoring and controlling driver installations to prevent such attacks.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports