✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Cybercriminals Exploit Remote Access Tools in 2026 Attacks
Between January and March 2026, cybercriminals exploited legitimate remote access tools such as LogMeIn and ScreenConnect to gain unauthorized access to victim devices. These attacks, detailed in HP's Threat Insights Report, involved phishing emails that tricked users into installing these tools, allowing attackers to control systems without triggering security alerts. The abuse of trusted software enabled threat actors to blend malicious activities with normal IT operations, complicating detection and response efforts. This incident underscores a growing trend where attackers leverage legitimate remote monitoring and management (RMM) tools to establish persistent access and deploy malware. The increasing sophistication of such tactics highlights the need for organizations to enhance monitoring of software installations, enforce strict privilege controls, and update defenses to detect and prevent misuse of trusted applications.
1 month ago
Kill Chain
Understanding the HTTP/2 Bomb (CVE-2026-49975) Vulnerability
In June 2026, a critical denial-of-service vulnerability, CVE-2026-49975, known as the "HTTP/2 Bomb," was disclosed. This flaw exploits the HPACK compression and flow control features of the HTTP/2 protocol, allowing attackers to send minimal requests that rapidly exhaust server memory. Major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora, are affected in their default configurations. The attack can be executed remotely without authentication, leading to immediate service disruptions. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-49975-http-2-bomb-dos/?utm_source=openai)) The discovery of this vulnerability underscores the evolving threat landscape, where attackers leverage protocol features to amplify attacks. Organizations must prioritize patching affected systems and consider implementing additional security measures, such as Web Application Firewalls (WAFs), to mitigate potential exploits. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-49975-http-2-bomb-dos/?utm_source=openai))
1 month ago
Kill Chain
CISA Issues Warning on Actively Exploited Joomla JCE Vulnerability
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability, CVE-2026-48907, affecting the Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities catalog. This flaw, present in JCE versions 1.0.0 through 2.9.99.4, allows unauthenticated users to create new editor profiles, enabling the upload and execution of arbitrary PHP code on the server. The vulnerability has been actively exploited, with attackers leveraging it to gain unauthorized access and control over affected Joomla installations. The active exploitation of this vulnerability underscores the persistent threat posed by improper access controls in widely used content management systems. Organizations utilizing Joomla with the JCE extension are urged to update to version 2.9.99.5 or later to mitigate this risk. Additionally, administrators should audit their systems for unauthorized editor profiles and monitor server logs for suspicious activity to prevent potential breaches.
1 month ago
Kill Chain
Unveiling the VHDX-Based Remcos RAT Attack: A 2026 Cybersecurity Challenge
In June 2026, a sophisticated malware campaign was identified, utilizing a VHDX disk image within a ZIP archive to deliver the Remcos Remote Access Trojan (RAT). Upon extraction, the VHDX file auto-mounted on Windows systems, revealing an obfuscated JavaScript file named 'Partnerschaft_fur_neue_Angebotsanfrage.js', indicating potential targeting of German-speaking users. This JavaScript initiated a multi-stage infection chain involving PowerShell scripts and .NET loaders, ultimately injecting the Remcos RAT into the 'backgroundTaskHost.exe' process. The malware established communication with a command-and-control server at animal342[.]duckdns[.]org:53552, enabling remote surveillance and data exfiltration. Notably, the campaign employed techniques such as WMI for process execution and Base64 encoding with XOR decryption to evade detection by traditional security measures. This incident underscores the evolving tactics of cybercriminals who leverage legitimate system features and complex obfuscation methods to bypass security controls. The use of VHDX files as malware containers highlights the need for enhanced vigilance and advanced detection mechanisms to counter such sophisticated threats.
1 month ago
Kill Chain
Mastra npm Supply Chain Attack: 144 Packages Compromised
In June 2026, a significant supply chain attack targeted the Mastra npm ecosystem, compromising 144 packages associated with the '@mastra' namespace. The attack was initiated through the hijacking of a former contributor's npm account, 'ehindero'. The attackers introduced a malicious dependency named 'easy-day-js', which masqueraded as the legitimate 'dayjs' library. Initially, 'easy-day-js' appeared benign, but subsequent versions contained obfuscated post-install scripts designed to exfiltrate sensitive information from developers' systems. This incident underscores the vulnerabilities inherent in open-source software supply chains, particularly when trusted contributor accounts are compromised. The Mastra framework, widely used for building AI applications, saw its core components, such as '@mastra/core', affected, amplifying the potential impact on downstream projects and organizations. The attack highlights the critical need for robust security measures in package management and dependency verification processes. The increasing frequency of such supply chain attacks emphasizes the urgency for the developer community to adopt stringent security practices, including regular audits of dependencies, implementation of multi-factor authentication for contributor accounts, and continuous monitoring for anomalous activities within software ecosystems.
1 month ago
Kill Chain
Malicious JetBrains Plugins Compromise AI API Keys in 2026
In June 2026, cybersecurity researchers identified a coordinated malware campaign involving at least 15 malicious plugins on the JetBrains Marketplace. These plugins, masquerading as AI coding assistants built on DeepSeek and other large language models, were designed to exfiltrate artificial intelligence (AI) provider keys. The plugins offered functionalities such as chat, commit messages, code review, bug finding, and unit tests, thereby enticing developers to install them. Once installed, the plugins covertly transmitted sensitive API keys to attacker-controlled servers, potentially compromising the security of AI-driven applications and services. This incident underscores a growing trend where threat actors exploit the trust in developer tools and marketplaces to distribute malicious software. The increasing integration of AI into development workflows makes such platforms attractive targets. Organizations must remain vigilant, ensuring the integrity of the tools they incorporate and regularly auditing their development environments to prevent unauthorized access and data exfiltration.
1 month ago
Kill Chain
Introducing Sulla: Praetorian's Open-Source SMB Secret Scanner
In June 2026, Praetorian released Sulla, an open-source tool designed to scan SMB shares for exposed credentials across enterprise networks. Sulla automates the discovery of readable SMB shares, traverses their file structures, and scans contents for sensitive information using the Titus detection library. This tool addresses the challenge of manually reviewing numerous network shares, which is often tedious and inefficient. By integrating Sulla into their Continuous Threat Exposure Management platform, Guard, Praetorian ensures that SMB secrets are identified promptly as they appear in environments. The release of Sulla highlights the growing need for automated tools to detect and mitigate the risks associated with exposed credentials in network shares. As organizations increasingly rely on complex network infrastructures, tools like Sulla become essential in proactively identifying and addressing security vulnerabilities, thereby enhancing overall cybersecurity posture.
1 month ago
Kill Chain
Critical Vulnerability in SolarWinds Serv-U: CVE-2026-28318
In early June 2026, a high-severity vulnerability (CVE-2026-28318) was identified in SolarWinds Serv-U, a widely used file transfer server. This flaw allows unauthenticated attackers to crash the Serv-U service by sending specially crafted POST requests with the 'Content-Encoding: deflate' header, leading to a denial-of-service (DoS) condition. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of this vulnerability and added it to their Known Exploited Vulnerabilities catalog on June 5, 2026. Organizations are urged to apply the available patch or implement recommended mitigations promptly to prevent service disruptions. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/08/cisa-patch-actively-exploited-solarwinds-serv-u-dos-vulnerability-cve-2026-28318/?utm_source=openai)) The exploitation of CVE-2026-28318 underscores the persistent targeting of file transfer services by threat actors. Given the critical role of such services in business operations, this incident highlights the necessity for organizations to maintain vigilant patch management practices and to monitor for emerging threats to ensure operational resilience.
1 month ago
Kill Chain
Earth Lusca's Advanced Windows Malware Targets Government Entities
Between 2023 and 2024, the Chinese state-sponsored threat group Earth Lusca, also known as FishMonger, expanded its cyber espionage operations by deploying Windows variants of the previously Linux-based SprySOCKS malware. These sophisticated backdoors targeted government organizations in Taiwan, Thailand, Pakistan, and Honduras, focusing on sectors such as foreign affairs, technology, and telecommunications. The Windows versions, identified as WIN_DRV and WIN_PLUS, introduced advanced capabilities including kernel-level stealth mechanisms, enabling the malware to hide processes, network connections, and files, thereby evading detection. Both variants support over 30 command-and-control commands, facilitate communication over multiple protocols, and possess functionalities like keystroke logging and SOCKS proxy support. The emergence of these Windows variants underscores a significant evolution in Earth Lusca's tactics, highlighting the group's commitment to enhancing its toolset for broader and more effective cyber espionage campaigns. This development reflects a broader trend among nation-state actors to adapt and refine their malware to target diverse operating systems, emphasizing the need for organizations to implement comprehensive, cross-platform cybersecurity measures.
1 month ago
Kill Chain
iRhythm Data Breach 2026: A Wake-Up Call for Healthcare Cybersecurity
In June 2026, iRhythm Holdings, a digital healthcare company specializing in cardiac monitoring, experienced a significant data breach. On June 8, unauthorized activity was detected in third-party-hosted business applications, leading to the exfiltration of sensitive information, including proprietary data and patient protected health information (PHI). The attackers, employing social engineering tactics, contacted iRhythm on June 9, demanding a ransom to prevent public disclosure of the stolen data. The company promptly activated its cybersecurity response plan, engaged external experts, and confirmed the breach's materiality due to the volume of affected data. Importantly, iRhythm reported no impact on its products, clinical or medical device systems, patient safety, manufacturing and distribution operations, or financial reporting systems. ([streetinsider.com](https://www.streetinsider.com/Reuters/iRhythm%2Bdiscloses%2Bcyber%2Bincident%2C%2Bsays%2Bno%2Bimpact%2Bon%2Bdevice%2Bsystems%2C%2Bpatient%2Bsafety/26648941.html?utm_source=openai)) This incident underscores the escalating threat landscape targeting healthcare organizations, particularly through social engineering and ransomware attacks. The breach highlights the critical need for robust cybersecurity measures, comprehensive employee training to recognize and prevent social engineering attempts, and stringent data protection protocols to safeguard sensitive patient information.
1 month ago
Kill Chain
DragonForce Ransomware's Innovative Exploitation of Microsoft Teams in 2025
In December 2025, the DragonForce ransomware group executed a sophisticated attack against a major U.S. services company. They exploited an unknown vulnerability in an SQL or MSSQL server to gain initial access. Subsequently, they deployed a custom Go-based malware named 'Backdoor.Turn,' which abused Microsoft Teams' Traversal Using Relays around NAT (TURN) protocol to conceal command-and-control (C2) communications within legitimate Teams traffic. This allowed the attackers to evade detection while exfiltrating data and deploying ransomware to encrypt the victim's systems. This incident underscores a concerning trend where threat actors leverage trusted cloud-based collaboration platforms to mask malicious activities. The abuse of Microsoft Teams' infrastructure for C2 communications highlights the need for organizations to scrutinize even legitimate traffic and implement robust monitoring mechanisms to detect anomalies within trusted services.
1 month ago
Kill Chain
Critical cPanel Plugin Vulnerability (CVE-2026-48172) Actively Exploited
In May 2026, a critical privilege escalation vulnerability (CVE-2026-48172) was discovered in the LiteSpeed User-End cPanel Plugin versions prior to 2.4.5. This flaw allows authenticated cPanel users to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function. The vulnerability has been actively exploited in the wild, leading to full system compromises on affected shared hosting servers. LiteSpeed released patches in May 2026, urging users to update to version 2.4.7 or later to mitigate the risk. The active exploitation of this vulnerability underscores the persistent threat posed by privilege escalation flaws in widely used web hosting platforms. Organizations must prioritize timely patching and implement robust monitoring to detect and prevent unauthorized access, especially in shared hosting environments where a single compromised account can jeopardize the entire server.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports