Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 121 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1441–1452 / 3786 reports
Gamaredon's 2025 Cyber Offensive: Unveiling New Malware and Tactics
Government Administration4 months ago

Gamaredon's 2025 Cyber Offensive: Unveiling New Malware and Tactics

In 2025, the Russian-aligned APT group Gamaredon intensified its cyber operations against Ukrainian governmental and military institutions. ESET observed 35 distinct spear-phishing campaigns, primarily in the latter half of the year, utilizing archive attachments and XHTML files with HTML smuggling to deploy malicious HTA downloaders. These campaigns aimed to exfiltrate sensitive information to support Russian interests in the ongoing conflict. Gamaredon also exploited a WinRAR vulnerability (CVE-2025-8088) to achieve persistence by placing malicious files in the Windows Startup folder. Additionally, the group introduced six new PowerShell tools, including PteroDee and PteroCache, to enhance their malware arsenal. ([thehackernews.com](https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html?utm_source=openai)) The group's reliance on third-party services grew significantly, employing tunnel services and serverless platforms to conceal their infrastructure. This evolution underscores the increasing sophistication of state-sponsored cyber threats and the necessity for robust cybersecurity measures to protect sensitive governmental data. ([thehackernews.com](https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical DirtyClone Vulnerability in Linux Kernel (CVE-2026-43503) Exposes Systems to Root Access
Information Technology/IT4 months ago

Critical DirtyClone Vulnerability in Linux Kernel (CVE-2026-43503) Exposes Systems to Root Access

In June 2026, a critical vulnerability known as DirtyClone (CVE-2026-43503) was discovered in the Linux kernel, allowing local users to escalate privileges to root by exploiting cloned network packets. This flaw, a variant of the earlier DirtyFrag vulnerability, affects multiple Linux distributions, including Debian, Ubuntu, and Fedora. The vulnerability arises from the kernel's mishandling of shared socket-buffer fragments during network packet processing, enabling attackers to manipulate the Linux page cache and gain unauthorized access. ([thehackernews.com](https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html?utm_source=openai)) The emergence of DirtyClone underscores the persistent challenges in securing the Linux kernel against privilege escalation attacks. With the increasing adoption of multi-tenant cloud environments and containerized workloads, the risk of such vulnerabilities being exploited has escalated, highlighting the need for prompt patching and vigilant system monitoring. ([securityweek.com](https://www.securityweek.com/dirtyclone-linux-kernel-vulnerability-leads-to-root-access/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Exploiting AI Coding Agents: The New Frontier in Supply Chain Attacks
Computer Software/Engineering4 months ago

Exploiting AI Coding Agents: The New Frontier in Supply Chain Attacks

In June 2026, researchers at Mozilla's Zero Day Investigative Network (0DIN) identified a novel supply chain attack targeting AI coding agents. The attack involved a seemingly benign GitHub repository containing standard setup instructions. When an AI coding agent, such as Claude Code, cloned and initialized the repository, it encountered an error message prompting the execution of an initialization command. This command triggered a shell script that retrieved and executed a payload from a DNS TXT record controlled by the attacker, resulting in the establishment of an interactive shell on the developer's machine. This method allowed attackers to gain unauthorized access to sensitive information without any malicious code present in the repository itself. This incident underscores the evolving sophistication of supply chain attacks, particularly those exploiting AI-driven development tools. As AI coding agents become more integrated into software development workflows, they present new vectors for exploitation. Organizations must enhance their security protocols to address these emerging threats, ensuring that AI tools are configured to disclose and verify the full execution chain of setup commands to prevent unauthorized code execution.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
ShinyHunters' Breach of Instructure's Canvas Platform Highlights Third-Party Risks in Education
Higher Education/Acadamia4 months ago

ShinyHunters' Breach of Instructure's Canvas Platform Highlights Third-Party Risks in Education

In May 2026, the cybercriminal group ShinyHunters breached Instructure, the company behind the widely used learning management system Canvas, affecting numerous educational institutions. The attackers demanded a ransom, threatening to leak sensitive data if unpaid. This incident underscores the vulnerability of the education sector to third-party breaches, given its reliance on external vendors for critical services. ([insidehighered.com](https://www.insidehighered.com/news/tech-innovation/administrative-tech/2026/05/05/pay-or-leak-hackers-target-big-higher-ed-vendor?utm_source=openai)) The breach highlights the urgent need for educational institutions to enhance their third-party risk management strategies. As cyber threats targeting third-party vendors increase, schools must implement robust security measures and establish comprehensive incident response plans to mitigate potential damages.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical SSRF Vulnerability in OHIF DICOM Web Viewer Framework (CVE-2026-12473)
Health Care / Life Sciences4 months ago

Critical SSRF Vulnerability in OHIF DICOM Web Viewer Framework (CVE-2026-12473)

In June 2026, a critical vulnerability (CVE-2026-12473) was identified in the OHIF DICOM Web Viewer Framework versions up to 3.12.0. This Server-Side Request Forgery (SSRF) flaw allowed attackers to steal authenticated clinicians' OIDC Bearer tokens via crafted links, potentially granting unauthorized access to sensitive patient data. The issue stemmed from two data sources—DICOMWebProxy and DICOMJSON—fetching arbitrary URL parameters without validation, leading to token exposure when requests were sent to attacker-controlled servers. ([hipaajournal.com](https://www.hipaajournal.com/high-severity-vulnerability-identified-in-ohif-viewers-dicom/?utm_source=openai)) The vulnerability was addressed with the release of version 3.12.2 on May 18, 2026. Users are strongly advised to upgrade to this version or later to mitigate the risk. This incident underscores the critical importance of validating external inputs and implementing robust security measures in healthcare applications to protect sensitive information. ([machinespirits.com](https://www.machinespirits.com/advisory/0a7f3c/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Russian Intelligence Services' Phishing Campaigns Targeting Messaging Apps in 2026
Government Administration4 months ago

Russian Intelligence Services' Phishing Campaigns Targeting Messaging Apps in 2026

In March 2026, the FBI and CISA issued a Public Service Announcement warning of ongoing phishing campaigns by Russian Intelligence Services (RIS) targeting commercial messaging applications (CMAs) such as Signal and WhatsApp. These campaigns aim to compromise individual user accounts by impersonating official support channels and tricking users into sharing verification codes or personal information. High-value targets include U.S. government officials, military personnel, political figures, and journalists. Once access is gained, attackers can view messages, contact lists, and conduct further phishing attacks. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260626?utm_source=openai)) This incident underscores the persistent threat posed by nation-state actors employing social engineering tactics to bypass encryption and gain unauthorized access to sensitive communications. The rise in such targeted phishing campaigns highlights the need for heightened vigilance and robust security practices among users of CMAs.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Cybersecurity Firms Deceived by Fraudulent OpenAI Organization Invitations
Computer/Network Security4 months ago

Cybersecurity Firms Deceived by Fraudulent OpenAI Organization Invitations

In June 2026, cybersecurity firms were targeted by a sophisticated social engineering campaign dubbed 'Poisoned Tenant.' Threat actors created fraudulent OpenAI ChatGPT organizations impersonating legitimate companies and sent authentic-looking invitations to employees, urging them to join these fake tenants. Upon acceptance, employees were granted administrative privileges, potentially exposing sensitive company information. The attackers utilized OpenAI's legitimate notification system, making the invitations appear credible and bypassing standard email security measures. This incident underscores the evolving tactics of cyber adversaries who exploit trusted platforms to execute social engineering attacks. The use of legitimate services to deliver malicious content highlights the need for organizations to enhance their security awareness training and implement robust verification processes for unsolicited invitations, even when they appear to originate from trusted sources.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
StrikeShark Campaign Unleashes SharkLoader to Deploy Cobalt Strike Beacons
Government Administration4 months ago

StrikeShark Campaign Unleashes SharkLoader to Deploy Cobalt Strike Beacons

In June 2026, a cyber attack campaign named StrikeShark was identified, deploying a new malware loader called SharkLoader to deliver Cobalt Strike Beacons on compromised systems. The campaign targeted a diverse range of entities, including diplomatic organizations in Indonesia, government bodies in Taiwan, and software development companies across multiple countries. Attackers exploited known vulnerabilities in Microsoft Exchange Server (CVE-2021-26855), Openfire (CVE-2023-32315), and GeoServer (CVE-2024-36401) to gain initial access, subsequently establishing persistence through web shells and DLL side-loading techniques. The use of open-source post-compromise tools like FScan and Pillager suggests potential involvement of Chinese-speaking threat actors. This incident underscores the persistent threat posed by sophisticated malware loaders and the exploitation of known vulnerabilities. Organizations must prioritize timely patching and employ robust detection mechanisms to mitigate such risks. The broad geographic reach and diverse target set of this campaign highlight the evolving tactics of threat actors in the current cyber threat landscape.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
Instructure's Canvas LMS Breached Twice by ShinyHunters in 2026
Higher Education/Acadamia4 months ago

Instructure's Canvas LMS Breached Twice by ShinyHunters in 2026

In early May 2026, Instructure's Canvas learning management system (LMS) suffered two significant cyberattacks orchestrated by the ShinyHunters group. The initial breach on April 29 led to the exfiltration of personal data from approximately 275 million users across nearly 9,000 educational institutions. Compromised information included names, email addresses, student ID numbers, and private messages. Despite Instructure's remediation efforts, ShinyHunters executed a second attack on May 7, defacing Canvas login pages to pressure the company into paying a ransom. In response, Instructure reached an agreement with the attackers, resulting in the return and purported destruction of the stolen data. ([techcrunch.com](https://techcrunch.com/2026/05/12/instructure-strikes-deal-with-hackers-who-breached-it-twice/?utm_source=openai)) This incident underscores a growing trend where cybercriminals target educational technology vendors to exploit vulnerabilities and access vast amounts of sensitive data. The attacks on Instructure highlight the critical need for robust cybersecurity measures within the edtech sector to protect against such large-scale breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Gamaredon's 2025 Spearphishing Escalation: A Wake-Up Call for Cybersecurity
Government Administration4 months ago

Gamaredon's 2025 Spearphishing Escalation: A Wake-Up Call for Cybersecurity

In 2025, the Russian state-sponsored APT group Gamaredon intensified its cyber espionage activities against Ukrainian governmental institutions. The group launched numerous spearphishing campaigns, introducing six new malware tools leveraging PowerShell and VBScript to enhance stealth, persistence, and lateral movement. Notably, Gamaredon concealed its command-and-control infrastructure behind Cloudflare tunnels and utilized third-party services like Telegram and Dropbox to obfuscate its operations. ([eset.com](https://www.eset.com/uk/about/newsroom/press-releases/eset-research-russias-gamaredon-apt-group-unleashed-spearphishing-campaigns-against-ukraine-with-an-evolved-toolset-uk/?utm_source=openai)) This escalation underscores the evolving threat landscape, highlighting the need for organizations to adopt advanced detection and response strategies to counter sophisticated state-sponsored cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Turla's STOCKSTAY Backdoor: A New Cyber Espionage Threat
Government Administration4 months ago

Turla's STOCKSTAY Backdoor: A New Cyber Espionage Threat

In June 2026, Google's Threat Intelligence Group identified a new .NET backdoor named STOCKSTAY, attributed to the Russian state-sponsored group Turla. This malware has been deployed against government and military organizations in Ukraine and entities interested in Italian foreign policy. STOCKSTAY, developed since at least December 2022, shares significant code and functional overlaps with Turla's previous implant, Kazuar. The backdoor comprises multiple components that communicate via inter-process communication channels and utilize secure WebSocket connections for command-and-control communication. It supports various commands, including file manipulation, system information gathering, and screen capture. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering/?utm_source=openai)) The discovery of STOCKSTAY underscores the evolving sophistication of state-sponsored cyber espionage tools. Its deployment highlights the persistent threat posed by advanced persistent threats (APTs) like Turla, emphasizing the need for robust cybersecurity measures and continuous monitoring to protect sensitive governmental and military information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Alerts Hospitality Sector to Advanced Phishing Threat
Hospitality4 months ago

Microsoft Alerts Hospitality Sector to Advanced Phishing Threat

Since April 2026, a sophisticated phishing campaign has been targeting hotel and hospitality organizations across Europe and Asia. Attackers send emails impersonating 'Booking Manager (via Calendly)' with subjects referencing guest complaints or health inspections. These emails contain links leading to ZIP files named 'photo-<numbers>.zip,' which, when opened, execute a Node.js-based remote access trojan (RAT) called TonRAT. The malware establishes command-and-control channels through the TON blockchain API, complicating detection and mitigation efforts. This incident underscores the evolving tactics of cybercriminals who exploit trusted platforms like Calendly and Google’s URL redirect services to bypass traditional email security measures. The use of Node.js implants and blockchain-based command-and-control mechanisms highlights the need for organizations to enhance their cybersecurity defenses against increasingly sophisticated phishing campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports