✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV
In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2024-1708, a path traversal flaw in ConnectWise ScreenConnect, and CVE-2026-32202, a protection mechanism failure in Microsoft Windows Shell. CVE-2024-1708 allows remote code execution or unauthorized access to sensitive data, while CVE-2026-32202 enables network-based spoofing attacks. Both vulnerabilities have been actively exploited by threat actors, including the China-based group Storm-1175 deploying Medusa ransomware and the Russian APT28 targeting Ukraine and EU countries. Federal agencies are mandated to remediate these vulnerabilities by May 12, 2026. ([thehackernews.com](https://thehackernews.com/2026/04/cisa-adds-actively-exploited.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by state-sponsored actors exploiting known flaws. Organizations must prioritize patching and enhance monitoring to mitigate risks associated with these and similar vulnerabilities.
3 months ago
Kill Chain
Credential-Stealing Malware Found in Official SAP npm Packages
In April 2026, a sophisticated supply chain attack targeted SAP's Cloud Application Programming Model (CAP) by compromising four official npm packages: @cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48. The attackers, identified as TeamPCP, injected malicious 'preinstall' scripts into these packages, which, upon installation, executed a multi-stage payload designed to steal a wide array of credentials from developers' systems and CI/CD environments. The stolen data included npm and GitHub authentication tokens, SSH keys, and cloud credentials for AWS, Azure, and Google Cloud. The malware also attempted to extract secrets directly from the CI runner's memory, bypassing standard log masking mechanisms. The exfiltrated data was encrypted and uploaded to public GitHub repositories under the victim's account, with descriptions indicating the presence of 'A Mini Shai-Hulud.' This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools and the necessity for robust security measures in software development pipelines.
3 months ago
Kill Chain
Vidar Infostealer 2026 Breach: A Wake-Up Call for Enhanced Security Measures
In early 2026, the Vidar infostealer malware emerged as a dominant threat in the cybercriminal ecosystem, exploiting the void left by the takedowns of Lumma and Rhadamanthys. Vidar's operators released significant upgrades and expanded distribution channels, leading to widespread infections across various sectors. The malware targets sensitive data, including credentials, cookies, and cryptocurrency wallets, facilitating unauthorized access and potential financial losses. Organizations such as Pickett & Associates, Deloitte, KPMG, and Samsung were among those compromised due to inadequate multi-factor authentication (MFA) enforcement, resulting in the exfiltration of substantial volumes of sensitive data. ([techradar.com](https://www.techradar.com/pro/security/dozens-of-organizations-fall-victim-to-infostealers-after-failing-to-enforce-mfa?utm_source=openai)) This incident underscores the critical importance of implementing robust security measures, particularly MFA, to protect against credential theft. The rapid evolution and distribution of infostealer malware like Vidar highlight the need for continuous vigilance and proactive defense strategies to mitigate emerging cyber threats.
3 months ago
Kill Chain
Ransomware Rivalry: 0APT and KryBit Expose Each Other's Operations
In April 2026, a rare conflict erupted between two emerging ransomware-as-a-service (RaaS) groups, 0APT and KryBit. 0APT, initially known for fabricating victim claims, targeted rival ransomware operators, including KryBit, by leaking their operational data. This exposure revealed KryBit's infrastructure, personnel details, and victim negotiations. In retaliation, KryBit breached 0APT's systems, exposing fabricated victim lists and defacing 0APT's leak site. This mutual exposure has significantly disrupted both groups' operations, necessitating infrastructure rebuilding and rebranding efforts. This incident underscores the volatile nature of cybercriminal alliances and the potential for internal conflicts to disrupt malicious operations. For defenders, such feuds provide valuable insights into ransomware tactics, techniques, and procedures, enhancing preparedness against future attacks.
3 months ago
Kill Chain
Vect 2.0 Ransomware: A Flawed Threat Acting as a Data Wiper
In April 2026, the Vect 2.0 ransomware variant was discovered to contain a critical design flaw that causes it to function as a data wiper rather than traditional ransomware. This flaw affects versions targeting Windows, Linux, and VMware ESXi systems. Specifically, for files larger than 128KB, the malware generates four encryption nonces but only retains the final one, rendering the first three-quarters of each large file permanently unrecoverable. Consequently, victims who pay the ransom cannot retrieve their critical data, as the necessary decryption information is irreversibly lost. ([darkreading.com](https://www.darkreading.com/threat-intelligence/vect-ransomware-wiper-design-error?utm_source=openai)) This incident underscores the evolving nature of cyber threats, where even ransomware can inadvertently become more destructive due to coding errors. Organizations must prioritize robust backup strategies and comprehensive security measures to mitigate such risks. The Vect 2.0 case also highlights the importance of thorough threat analysis and the potential unintended consequences of malware development flaws.
3 months ago
Kill Chain
NSA GRASSMARLIN CVE-2026-6807 XXE Vulnerability: A Wake-Up Call for ICS Security
In April 2026, a vulnerability identified as CVE-2026-6807 was disclosed in NSA's GRASSMARLIN v3.2.1, a tool used for mapping industrial control system (ICS) networks. The flaw involves improper handling of XML input, allowing attackers to exploit XML External Entity (XXE) references to access sensitive information. This vulnerability has a CVSS v3 base score of 5.5, indicating medium severity. Notably, GRASSMARLIN reached end-of-life status in 2017, and no patches or updates are planned to address this issue. The disclosure of this vulnerability underscores the risks associated with using unsupported software in critical infrastructure environments. Organizations relying on GRASSMARLIN should assess their exposure and consider transitioning to actively maintained alternatives to mitigate potential security threats.
3 months ago
Kill Chain
Critical cPanel Authentication Vulnerability: Immediate Action Required
In April 2026, cPanel identified a critical authentication vulnerability affecting all supported versions of its software, potentially allowing unauthorized access to control panel interfaces. The issue was addressed with patches released on April 28, 2026, for versions 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.136.0.5, and 11.134.0.20. Organizations were urged to update their systems promptly to mitigate the risk of exploitation. ([thehackernews.com](https://thehackernews.com/2026/04/critical-cpanel-authentication.html?utm_source=openai)) This incident underscores the importance of timely patch management and proactive security measures, as attackers were reportedly exploiting the vulnerability before the patch was available. ([cyberkendra.com](https://www.cyberkendra.com/2026/04/cpanel-authentication-bypass-was.html?utm_source=openai))
3 months ago
Kill Chain
CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
On April 28, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2024-1708, a path traversal vulnerability in ConnectWise ScreenConnect versions 23.9.7 and prior, and CVE-2026-32202, a Windows Shell protection mechanism failure. CVE-2024-1708 allows attackers to execute remote code or access sensitive data by exploiting improper path handling, while CVE-2026-32202 enables attackers to steal NTLMv2 hashes without user interaction, leading to potential unauthorized access. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2024-1708/?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by actively exploited security flaws. Organizations are urged to prioritize patching these vulnerabilities to mitigate risks associated with remote code execution and unauthorized data access, which can lead to significant operational disruptions and data breaches.
3 months ago
Kill Chain
DPRK-Linked Supply Chain Attack on Axios npm Package in 2026
In March 2026, North Korean state-sponsored hackers, identified as UNC1069, executed a sophisticated supply chain attack by compromising the widely-used JavaScript library Axios. The attackers gained access to the maintainer's npm account and published malicious versions 1.14.1 and 0.30.4, which included a remote access trojan (RAT). This malware granted the attackers control over infected systems, potentially leading to credential theft and persistent access. The malicious versions were available for approximately three hours before detection and removal, during which time they were downloaded millions of times, posing a significant risk to developers and organizations worldwide. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid deployment and widespread use of compromised packages highlight the need for enhanced security measures in software development pipelines. Organizations must implement stringent monitoring and verification processes to safeguard against such vulnerabilities.
3 months ago
Kill Chain
Understanding and Mitigating AI-Driven Cyberattacks
In February 2026, cybersecurity researchers identified a significant evolution in attack methodologies: threat actors are now leveraging custom AI systems to automate and expedite the cyber kill chain. This advancement enables attackers to autonomously map Active Directory structures and obtain Domain Admin credentials within minutes, drastically reducing the time required for system compromise. The integration of AI into cyberattacks has rendered traditional defensive workflows insufficient, as these automated systems can adapt and execute complex attacks with unprecedented speed and precision. This development underscores a critical shift in the cybersecurity landscape, where AI-enhanced attacks are no longer theoretical but a present reality. Organizations must recognize the urgency of adapting their security strategies to counteract these sophisticated threats. The rapid adoption of AI by malicious actors necessitates a reevaluation of existing defenses to ensure they are capable of mitigating the risks posed by autonomous cyberattacks.
3 months ago
Kill Chain
Vercel's 2026 Security Breach: A Wake-Up Call for Third-Party Integration Risks
In April 2026, Vercel, a cloud development platform known for supporting frameworks like Next.js, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to access a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This led to unauthorized access to non-sensitive environment variables, posing potential risks to customer data. The breach underscores the vulnerabilities associated with interconnected systems and the importance of stringent access controls. ([vercel.com](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident/?utm_source=openai)) This incident highlights the growing threat landscape where attackers leverage third-party integrations to gain unauthorized access to enterprise systems. Organizations must reassess their security postures, especially concerning third-party tools, to mitigate such risks effectively.
3 months ago
Kill Chain
GopherWhisper: Unveiling a New China-Aligned APT Group Exploiting Collaboration Platforms
In January 2025, ESET researchers identified a previously undocumented China-aligned APT group named GopherWhisper targeting a Mongolian governmental institution. The group employs a suite of custom tools, primarily written in Go, including backdoors like LaxGopher, RatGopher, and BoxOfFriends, as well as the C++ backdoor SSLORDoor. GopherWhisper leverages legitimate services such as Discord, Slack, Microsoft 365 Outlook, and file.io for command and control (C&C) communications and data exfiltration. Analysis of C&C traffic from these platforms provided significant insights into the group's operations and post-compromise activities. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/?utm_source=openai)) This incident underscores the evolving tactics of APT groups in utilizing common collaboration platforms for malicious activities, highlighting the need for enhanced monitoring and security measures within such services to detect and mitigate potential threats.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports