✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
INC Ransomware: A Rising Threat with Over 830 Victims Since 2023
Since August 2023, the INC ransomware group has rapidly evolved into a significant ransomware-as-a-service (RaaS) operation, claiming over 830 victims by June 2026. The group's attacks are characterized by the use of Rust-based encryptors for cross-platform compatibility and resistance to reverse engineering. They employ a diverse range of tools and techniques, including exploiting vulnerabilities in public-facing applications, credential dumping from Veeam backup servers, and utilizing living-off-the-land binaries (LOLBins) for lateral movement. Notably, INC has targeted unpatched edge devices for initial access and used commercial remote monitoring and management (RMM) tools for command-and-control operations. The rise of INC ransomware underscores the adaptability of cybercriminals in leveraging existing vulnerabilities and tools to execute widespread attacks. Their success highlights the critical need for organizations to maintain up-to-date security measures, conduct regular vulnerability assessments, and implement robust incident response plans to mitigate the risks posed by such sophisticated ransomware operations.
1 month ago
Kill Chain
DragonForce Ransomware's Stealthy Exploitation of Microsoft Teams
In December 2025, the DragonForce ransomware group infiltrated a major U.S. services firm by exploiting an SQL-related vulnerability. They deployed a custom Go-based remote access trojan (RAT) named Backdoor.Turn, which concealed command-and-control (C2) traffic within Microsoft Teams' TURN relay infrastructure. This method allowed the attackers to remain undetected for one to two months, as the malicious traffic appeared as legitimate Teams communication. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/16/dragonforce-microsoft-teams-malware-backdoor-turn/?utm_source=openai)) This incident underscores a significant evolution in cyberattack methodologies, highlighting the increasing sophistication of threat actors in leveraging trusted communication platforms to evade detection. Organizations must reassess their security postures to address such advanced persistent threats.
1 month ago
Kill Chain
Microsoft Uncovers Sophisticated Windows Clipper Malware Campaign
In June 2026, Microsoft disclosed a sophisticated malware campaign targeting Windows users through USB drives containing malicious LNK files. Once executed, these shortcuts leveraged Windows Script Host and ActiveX to initiate a Tor proxy, establishing a connection to a hidden command-and-control (C2) server. The primary objective of this campaign was to deploy a cryptocurrency clipper, designed to intercept and alter clipboard contents, thereby redirecting cryptocurrency transactions to attacker-controlled wallets. This incident underscores the persistent threat posed by USB-based malware and the evolving tactics of cybercriminals who exploit legitimate Windows functionalities to evade detection. The use of Tor for C2 communication highlights the increasing adoption of anonymization techniques by threat actors, complicating traditional network defense strategies.
1 month ago
Kill Chain
Red Hat npm Supply Chain Attack: A Wake-Up Call for Software Security
In June 2026, Red Hat's npm packages were compromised in a significant supply chain attack. Threat actors infiltrated the @redhat-cloud-services namespace, injecting a credential-stealing worm into 32 packages, affecting 96 versions. These malicious packages, downloaded over 116,000 times weekly, exploited GitHub Actions' OpenID Connect to publish the compromised code, indicating a breach in the CI/CD pipeline. The attack led to unauthorized access to sensitive credentials, posing substantial risks to downstream users. ([aikido.dev](https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting trusted software ecosystems. Organizations must enhance their security measures, particularly in CI/CD pipelines, to prevent similar breaches. The event highlights the necessity for continuous monitoring and rapid response strategies to mitigate the impact of such sophisticated attacks.
1 month ago
Kill Chain
Surge in SSH Brute Force Attacks Correlates with Global Events in 2026
Between February and May 2026, a DShield honeypot recorded over 20 million SSH brute-force attempts, revealing a significant correlation between attack volumes and external events such as geopolitical tensions and cybersecurity advisories. Notably, a 2100% surge in attacks coincided with CISA's Emergency Directive 26-03 addressing Cisco SD-WAN vulnerabilities, and peaks in activity aligned with escalating conflicts involving Iran, Israel, and the United States. These findings underscore the adaptability of threat actors who exploit global events to intensify their malicious activities. The study highlights the persistent threat posed by coordinated SSH brute-force attacks and the necessity for organizations to implement robust security measures. As attackers continue to leverage global events to orchestrate large-scale attacks, it is imperative for entities to enhance their defenses, monitor for unusual activity, and stay informed about emerging threats to mitigate potential breaches.
1 month ago
Kill Chain
Crypto Clipper Malware: A New Threat Leveraging Tor and Worm-Like Propagation
In February 2026, Microsoft identified a Windows-based cryptocurrency clipper malware that propagates via malicious shortcut (.lnk) files. This malware comprises a worm component for self-propagation and a stealer component that harvests and exfiltrates cryptocurrency wallet information. Notably, it utilizes Windows Script Host and ActiveX to launch a bundled Tor proxy, enabling communication with a hidden-service command-and-control (C2) server. The malware performs high-frequency clipboard monitoring, screenshot exfiltration, and wallet-address substitution, effectively turning a financially motivated stealer into a lightweight backdoor. The incident underscores the evolving sophistication of malware leveraging anonymized communication channels like Tor and worm-like propagation methods. Organizations should be vigilant about script-based threats and implement behavioral detection mechanisms to identify suspicious activities such as script interpreters spawning unexpected child processes, localhost proxy usage, and clipboard inspection behaviors.
1 month ago
Kill Chain
Mastra npm Supply Chain Attack: A 2026 Case Study
In June 2026, a significant supply chain attack targeted the Mastra npm ecosystem, compromising over 140 packages. The attack originated from the hijacking of the 'ehindero' npm maintainer account, which was used to publish malicious versions of Mastra packages. These versions introduced 'easy-day-js,' a typosquat of the popular 'dayjs' library. Upon installation, 'easy-day-js' executed a postinstall script that disabled TLS certificate verification, contacted attacker-controlled command-and-control infrastructure, downloaded a second-stage payload, and executed it as a hidden process. This sophisticated attack posed substantial risks to developers and organizations relying on the affected packages. This incident underscores the escalating threat of supply chain attacks within the open-source ecosystem. The attackers' use of typosquatting and account hijacking highlights the need for enhanced security measures in package management and distribution. Organizations must remain vigilant, regularly audit their dependencies, and implement robust security practices to mitigate such risks.
1 month ago
Kill Chain
Shynet Vulnerability CVE-2026-35507: Host Header Injection in Password Reset
In April 2026, a critical vulnerability (CVE-2026-35507) was identified in Shynet versions prior to 0.14.0, allowing Host header injection during the password reset process. This flaw enabled attackers to manipulate password reset links, potentially redirecting users to malicious domains and facilitating credential theft. The vulnerability was promptly addressed in version 0.14.0. This incident underscores the importance of validating and sanitizing user input, especially in security-sensitive operations. Organizations are reminded to regularly update software to mitigate such vulnerabilities and to educate users on verifying the authenticity of password reset communications.
1 month ago
Kill Chain
Urgent: Patch Critical Joomla Plugin Vulnerability CVE-2026-48907 Now
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch a critical vulnerability in the Joomla Content Editor (JCE) plugin, identified as CVE-2026-48907. This flaw allowed unauthenticated attackers to create new editor profiles, leading to the upload and execution of arbitrary PHP code on affected servers. The JCE security team released version 2.9.99.6 to address this issue, urging immediate updates due to active exploitation and the availability of public exploit code. The urgency of this directive underscores the increasing trend of attackers targeting web application vulnerabilities to gain unauthorized access and control over systems. Organizations are reminded of the critical importance of timely patch management and continuous monitoring to mitigate such risks effectively.
1 month ago
Kill Chain
Meta's Instagram Account Takeover Incident: Lessons in AI Security
In April 2026, Meta disclosed a significant security incident affecting over 20,000 Instagram accounts. Attackers exploited a vulnerability in Instagram's AI-assisted account recovery tool, High Touch Support, to generate unauthorized password reset links. This flaw allowed them to bypass standard authentication measures, leading to unauthorized access to user accounts. The breach potentially exposed sensitive user data, including contact details, private messages, and linked services. Meta identified the issue on May 31, 2026, and took immediate steps to mitigate the vulnerability and notify affected users. This incident underscores the evolving tactics of cyber attackers who are increasingly targeting automated support systems to facilitate account takeovers. Organizations must enhance the security of their AI-driven tools and implement robust monitoring to detect and prevent such sophisticated attacks.
1 month ago
Kill Chain
Crypto Clipper Campaign: A New Era of Cyber Deception
In June 2026, a sophisticated cyber campaign was uncovered wherein an unidentified threat actor utilized multiple platforms to distribute a Rust-based cryptocurrency clipboard hijacker targeting Windows and macOS users. The malware was disseminated through a dedicated WordPress phishing page, GitHub and SourceForge projects promoted by fake accounts, and a YouTube channel featuring AI-generated narrators. Additionally, the actor manipulated reputation systems by posting benign votes and "safe" comments on VirusTotal to misclassify the malicious files as harmless. This campaign highlights the evolving tactics of cybercriminals who exploit trust mechanisms across various platforms to deceive users into downloading malicious software. The use of AI-generated content and coordinated fake reviews underscores the need for heightened vigilance and advanced detection methods to combat such deceptive practices.
1 month ago
Kill Chain
Attacker Exploits Tailscale and OpenSSH for Persistent Access in French Automotive Business Breach
In April 2026, a French-speaking attacker, identified as 'Poisson,' infiltrated a small French automotive business. Utilizing a VBScript stager and PowerShell loader, he deployed the Havoc Demon agent in memory, avoiding disk detection. For persistence, he established scheduled tasks and injected shellcode into Explorer.exe. Notably, before his command-and-control (C2) server went offline, Poisson installed OpenSSH and Tailscale on a compromised machine, creating an independent access route. This allowed him to maintain control even after the C2 server was deactivated, leading to the theft of banking and email credentials. This incident underscores the evolving tactics of cybercriminals who leverage legitimate tools like Tailscale and OpenSSH to establish resilient backdoors. The use of such tools complicates detection and remediation efforts, highlighting the need for organizations to monitor for unauthorized installations and unusual network configurations.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports