Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 12 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 133–144 / 3786 reports
GMO's Onamae Desktop Cloud Ransomware Attack: How a Pre-Staged Payload Held 26,739 Cloud Servers Hostage
GMO's Onamae Desktop Cloud Ransomware Attack: How a Pre-Staged Payload Held 26,739 Cloud Servers Hostage
Information Technology/IT1 week ago

GMO's Onamae Desktop Cloud Ransomware Attack: How a Pre-Staged Payload Held 26,739 Cloud Servers Hostage

In October 2026, GMO Internet Group's Onamae Desktop Cloud virtual private server platform was compromised by a threat actor who gained unauthorized access on October 20, potentially affecting up to 26,739 customer servers. The attacker exfiltrated company and customer data—including MetaTrader 4/5 trading credentials—and demanded an ¥8 billion ($50 million) ransom, which GMO refused to pay. The attacker subsequently published stolen data online and threatened to detonate a pre-planted ransomware payload, prompting GMO to urge customers to physically disconnect and shut down their systems. GMO partnered with Trend Micro for incident response and offered ¥5,000 per affected customer as interim compensation. This incident highlights an accelerating extortion playbook in which threat actors pre-position ransomware payloads inside cloud-hosted infrastructure before issuing demands, weaponizing the fear of detonation as leverage. As VPS and desktop-cloud services grow in adoption across Asia-Pacific financial and retail sectors, the risk of supply-chain-style detonation attacks on shared cloud infrastructure is now an urgent board-level concern.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Node2Shell (CVE-2026-111497): CISA Confirms Active Exploitation of Critical Brotli RCE Flaw
Node2Shell (CVE-2026-111497): CISA Confirms Active Exploitation of Critical Brotli RCE Flaw
Information Technology/IT1 week ago

Node2Shell (CVE-2026-111497): CISA Confirms Active Exploitation of Critical Brotli RCE Flaw

In October 2026, CISA added CVE-2026-111497 — a critical remote code execution vulnerability in Google's Brotli compression library, dubbed Node2Shell — to its Known Exploited Vulnerabilities catalog after confirming active in-the-wild exploitation. The flaw stems from an out-of-bounds write in the Brotli decoder, enabling unauthenticated remote attackers to corrupt decoder state memory, disclose sensitive data, cause denial-of-service, or achieve full remote code execution via a maliciously crafted compressed stream. Affected surfaces include Node.js runtimes, HTTP servers, clients, and .NET applications, prompting emergency patches from Microsoft. Federal agencies were mandated to remediate by November 10, 2026. The Node2Shell campaign underscores a persistent and accelerating trend: attackers weaponizing widely deployed open-source compression and runtime libraries to gain initial footholds at scale. As Brotli is embedded across cloud-native workloads, container images, and API gateways, the blast radius of unpatched deployments is exceptionally broad, heightening urgency for organizations operating hybrid and multicloud environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
16 Actively Exploited CVEs in One Month: How InfraTrust's October 2026 Report Exposes the Edge Infrastructure Crisis
16 Actively Exploited CVEs in One Month: How InfraTrust's October 2026 Report Exposes the Edge Infrastructure Crisis
Information Technology/IT1 week ago

16 Actively Exploited CVEs in One Month: How InfraTrust's October 2026 Report Exposes the Edge Infrastructure Crisis

Between September 18 and October 14, 2026, InfraTrust's October Pulse report documented 133 security advisories across 18 vendors covering 2,813 vulnerabilities in critical network infrastructure. Sixteen advisories included actively exploited flaws added to CISA's Known Exploited Vulnerabilities catalog, targeting edge devices including Citrix NetScaler, Ivanti Connect Secure, Check Point Security Management Server, Cisco SD-WAN, Arista VeloCloud, FortiMail, F5 BIG-IP APM, and PAN-OS. Attackers leveraged unauthenticated remote code execution, authentication bypass, and path traversal flaws to gain initial access and pivot into enterprise networks. The PHP2Shell vulnerabilities further compounded risk by exposing management interfaces of firewalls, VPN appliances, and application delivery controllers to unauthenticated RCE. This wave of infrastructure exploitation reflects a maturing initial-access-broker ecosystem where edge appliances serve as primary entry points. With threat actors including nation-state groups systematically targeting network management planes, organizations face compounding risk from unpatched vendor firmware cycles that delay PHP2Shell and Linux kernel fixes beyond enterprise control.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Operation Omegaline: How the Virtualine Bulletproof Hosting Takedown Exposes the Ransomware Supply Chain
Operation Omegaline: How the Virtualine Bulletproof Hosting Takedown Exposes the Ransomware Supply Chain
Financial Services1 week ago

Operation Omegaline: How the Virtualine Bulletproof Hosting Takedown Exposes the Ransomware Supply Chain

In October 2026, a coordinated international law enforcement operation led by the FBI, with support from Germany's Polizei Hessen, the Netherlands' Politie Midden-Nederland, and the UK's National Crime Agency, seized the primary domain of Virtualine—a bulletproof hosting provider operating since at least 2022 under aliases including Secury, Massgod, and Omegatech. Virtualine knowingly hosted ransomware operators, infostealer infrastructure, phishing platforms, Russian-language cybercrime forums, and illicit markets, accepting direct Bitcoin payments to launder criminal proceeds. Dutch authorities seized dozens of physical servers in Limburg, taking hundreds of virtual servers offline and recovering data tied to over 3,000 customers. Blockchain intelligence firms Chainalysis and TRM Labs confirmed financial links to ransomware groups, the StealC infostealer, and a Russian drug marketplace that alone accounted for 44% of Virtualine's inflows. This takedown underscores a hardening global posture against bulletproof hosting infrastructure—the connective tissue of ransomware, infostealer, and cybercrime-as-a-service ecosystems. With law enforcement increasingly using blockchain tracing and private-sector intelligence partnerships to dismantle hosting providers rather than just end-point actors, enterprises must recognize that criminal infrastructure takedowns expose customer data and enable follow-on investigations targeting the broader cybercrime supply chain.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI-Powered APT Chains PHP2Shell and Linux Kernel Exploit to Root 25 Servers Including U.S. Government Systems
Government Administration1 week ago

AI-Powered APT Chains PHP2Shell and Linux Kernel Exploit to Root 25 Servers Including U.S. Government Systems

On October 25, 2026, a suspected China-nexus APT actor exploited a chained vulnerability set—PHP2Shell (CVE-2026-109618 and CVE-2026-109619) and the Fragnesia Linux kernel privilege escalation flaw (CVE-2026-46300)—to root 25 servers across the U.S., Japan, Taiwan, and South Korea. Three compromised systems belonged to a U.S. government-affiliated organization. Attackers used AI-assisted tooling including Anthropic's Claude Code, FOFA reconnaissance, and LLM-augmented offensive scripting to automate target identification, exploitation, and Active Directory credential extraction. Persistent reverse SSH tunnels and dormant web shells remain active across 22 additional rooted firewalls, and the full scope of credential compromise is still undetermined. This incident exemplifies a new generation of AI-accelerated espionage operations where nation-state actors leverage large language models to compress exploit development timelines, automate reconnaissance at scale, and chain zero-day-class vulnerabilities against management interfaces—dramatically lowering the barrier to high-impact government network penetration.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
No Memory Corruption Needed: How Five Logic Bugs Broke Microsoft Edge for $175,000 at Pwn2Own 2026
No Memory Corruption Needed: How Five Logic Bugs Broke Microsoft Edge for $175,000 at Pwn2Own 2026
Information Technology/IT1 week ago

No Memory Corruption Needed: How Five Logic Bugs Broke Microsoft Edge for $175,000 at Pwn2Own 2026

In May 2026, security researcher Orange Tsai of DEVCORE won $175,000 at Pwn2Own Berlin by chaining five logic flaws in Microsoft Edge to achieve a full sandbox escape and remote code execution—without a single memory-corruption bug. The exploit, under 100 lines of code, began with a misconfigured conditional access navigation throttle to generate a universal cross-site scripting primitive, leveraged a hardcoded allowlist bypass, an auto-sign-in feature, and a misconfigured CORS header on assets.msn.com, then used Edge's Immersive Reader and a diagnostic log-zip function to write arbitrary files to disk, ultimately hijacking the telnet:// protocol handler to execute attacker-planted code. Microsoft patched the three CVEs (CVE-2026-45492, CVE-2026-45494, CVE-2026-45495) within 24 hours in Edge 148.0.3967.70. This exploit signals a paradigm shift in browser attack research: logic-only chains that produce full code execution are now viable, lowering the technical barrier for sophisticated threat actors who previously required rare memory-corruption primitives. As enterprise browsers become identity and SaaS gateways, logic-abuse chains targeting browser features represent a growing and underappreciated attack surface demanding renewed focus on egress controls, sandbox telemetry, and east-west traffic inspection.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
The Shai-Hulud Worm Proves SBOMs Are Not Enough: What Supply Chain Defenders Must Do Now
The Shai-Hulud Worm Proves SBOMs Are Not Enough: What Supply Chain Defenders Must Do Now
Computer Software/Engineering1 week ago

The Shai-Hulud Worm Proves SBOMs Are Not Enough: What Supply Chain Defenders Must Do Now

At the ISC2 Security Congress 2026, Atlassian product security manager Deepam Kanjani detailed a real-world supply chain compromise involving the Shai-Hulud worm, a malicious transitive dependency buried three layers deep inside a seemingly legitimate npm package with over 3,400 GitHub stars and a matching SHA hash. Because the dependency was not direct, it evaded top-level SBOM audits and initial behavioral alerts were dismissed as false positives. The team was forced to manually correlate logs across more than 400 services without reliable runtime telemetry, severely hampering incident scoping. Attribution led to dead ends, with the publisher identity fabricated, though later research linked subsequent Shai-Hulud campaigns to threat actor TeamPCP. This incident underscores a widening gap between static dependency inventories and the dynamic reality of production environments. As software supply chain attacks grow in sophistication and frequency, organizations that rely solely on SBOMs for incident scoping face dangerous blind spots in runtime visibility, transitive dependency tracking, and rapid stakeholder communication during active compromise.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
15 Minutes to Malware: How Black Basta Turned Microsoft Teams Into a Ransomware On-Ramp
15 Minutes to Malware: How Black Basta Turned Microsoft Teams Into a Ransomware On-Ramp
Information Technology/IT1 week ago

15 Minutes to Malware: How Black Basta Turned Microsoft Teams Into a Ransomware On-Ramp

Since mid-2024, threat actors linked to the Black Basta ransomware ecosystem have weaponized Microsoft Teams' external chat functionality at scale, combining email-bombing with IT-support impersonation to achieve payload execution in under 15 minutes. Across more than 400 observed incidents, attackers flood a target's inbox, then contact them via Teams using display names such as 'IT Support (Internal)' from throwaway or attacker-controlled tenants. Victims are coaxed into granting remote access via tools including Quick Assist, AnyDesk, and Atera, after which attackers execute PowerShell payloads, deploy C2 beacons, harvest credentials via Kerberoasting, and stage ransomware. Roughly 15% of targeted users progressed to full compromise. This campaign signals a maturation of social-engineering-as-a-service tradecraft, with standardized infrastructure, locale-aware lures, and integration with ClickFix-style techniques. As Microsoft prepares AI-powered phishing detection for Teams and organizations expand hybrid collaboration tooling, defenders must close the gap between user-trust assumptions and verified identity controls before attackers further automate the playbook.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
PolyShell & Node2Shell: How Two Critical CVEs in 2026 Breached 953+ E-Commerce Stores and Put 91% of Cloud Environments at Risk
PolyShell & Node2Shell: How Two Critical CVEs in 2026 Breached 953+ E-Commerce Stores and Put 91% of Cloud Environments at Risk
Retail Industry1 week ago

PolyShell & Node2Shell: How Two Critical CVEs in 2026 Breached 953+ E-Commerce Stores and Put 91% of Cloud Environments at Risk

In October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-48356 (CVSS 9.3), an unrestricted file upload flaw in Adobe Commerce and Magento dubbed PolyShell, and CVE-2026-111497 (CVSS 9.2), a memory-corruption RCE in Google's Brotli decoder library dubbed Node2Shell. Threat actors exploited CVE-2026-48356 to breach over 953 e-commerce stores, injecting malicious loaders via Magento CMS blocks active since at least July 2025. Simultaneously, live Node2Shell exploit traffic was recorded in the wild from a Netherlands-based IP also linked to PHP2Shell campaigns, signaling mass-exploitation tooling adoption across the web stack. These twin campaigns illustrate a maturing pattern of attackers chaining supply-chain library flaws with CMS upload vulnerabilities to achieve persistent RCE at scale. With 91% of cloud environments reported vulnerable to CVE-2026-111497 and FCEB agencies given until November 10, 2026 to patch, organizations running unpatched Node.js, PHP, or Adobe Commerce instances face immediate, high-probability compromise risk.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
When Your AI Bot Is Actually a Threat Actor: The 2026 Credential Scan Campaign
When Your AI Bot Is Actually a Threat Actor: The 2026 Credential Scan Campaign
Financial Services1 week ago

When Your AI Bot Is Actually a Threat Actor: The 2026 Credential Scan Campaign

Beginning in late September 2026, an unidentified threat actor launched a persistent, automated credential-harvesting campaign by impersonating more than 32 legitimate AI bots—including crawlers and assistants attributed to OpenAI, Anthropic, Perplexity, and Meta. Operating around the clock, the scanner fired bursts of 50–190 HTTP requests in under eight seconds per target, probing roughly 90 file paths known to contain passwords, API keys, SSH private keys, and cloud credentials. On a single day in October 2026, 48% of organizations protected by Cequence Security received the malicious traffic. Targeted sectors included retail, financial services, telecommunications, energy, and software. Nearly all requests were blocked or failed, but the campaign remained active as of late October 2026. This incident underscores a structural shift in the threat landscape: as enterprises accelerate AI agent adoption, attackers are weaponizing AI identity itself. The ability to rotate through dozens of trusted bot personas in seconds exposes a critical gap in perimeter and API security controls that were designed for human or single-service traffic patterns, not polymorphic machine identities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Three Flaws, One Patch, One Zero-Day: How ShinyHunters Dismantled Oracle PeopleSoft Security
Three Flaws, One Patch, One Zero-Day: How ShinyHunters Dismantled Oracle PeopleSoft Security
Higher Education/Acadamia1 week ago

Three Flaws, One Patch, One Zero-Day: How ShinyHunters Dismantled Oracle PeopleSoft Security

Between May 27 and June 9, 2026, the financially motivated threat group ShinyHunters (tracked by Mandiant as UNC6240) exploited a zero-day chain in Oracle PeopleSoft Enterprise PeopleTools versions 8.61 and 8.62, later patched as CVE-2026-35273 (CVSS 9.8). The attack chains three distinct flaws: an unauthenticated server-side request forgery (SSRF) in the Integration Gateway (PSIGW), a loopback-trust bypass in the Environment Management Hub (PSEMHUB), and either an arbitrary file-write for web shell deployment or a malicious XMLDecoder payload for stealthier code execution. Oracle issued an out-of-band patch on June 10; a second, broader campaign targeting universities, healthcare, government, and technology sectors was confirmed by Mandiant in September 2026. The September wave demonstrated that WAF-based mitigations were bypassed trivially via URL-encoding, underscoring a persistent industry pattern: perimeter controls are insufficient when attackers can manipulate request encoding, and organizations relying on signature-based filtering rather than patching remain exposed. ShinyHunters' data-theft-then-extortion model means affected organizations face both data breach notification obligations and ransom demands simultaneously.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Tailworm: How Tailscale SSH Flaws Turned Trusted Devices Into Root-Access Gateways
Tailworm: How Tailscale SSH Flaws Turned Trusted Devices Into Root-Access Gateways
Information Technology/IT1 week ago

Tailworm: How Tailscale SSH Flaws Turned Trusted Devices Into Root-Access Gateways

In October 2026, Tailscale disclosed four security bulletins (TS-2026-014 through TS-2026-017) affecting its built-in SSH server on Linux and open-source macOS builds. Researcher Erica Windisch of Cyberdione Labs published the Tailworm report revealing that an attacker with an already-trusted device on a Tailscale network could exploit Unix socket-forwarding logic—running with root privileges—to reach root-only sockets such as the Docker control socket, read /etc/shadow, crash Tailscale nodes via memory exhaustion, and remotely control nodes via the tailscaled local API. Tailscale released version 1.104.4 on October 28, 2026, remediating the issues by dropping forwarding privileges to the logged-in user and relying on OS-level file permissions. No confirmed real-world exploitation was reported at time of publication. This incident underscores a growing pattern of privilege-escalation vulnerabilities in zero-trust network tooling itself—the very infrastructure organizations rely on to enforce least-privilege access. As enterprises accelerate adoption of overlay networking and identity-based SSH, attackers are shifting focus to the trust fabric, making supply-chain and tooling security a board-level concern.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports