Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 123 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1465–1476 / 3786 reports
Cisco SD-WAN Zero-Day Exploited in Communications Provider Breach
Telecommunications4 months ago

Cisco SD-WAN Zero-Day Exploited in Communications Provider Breach

In early 2026, a sophisticated threat actor exploited a zero-day vulnerability (CVE-2026-20245) in Cisco Catalyst SD-WAN Manager to infiltrate a communications service provider's network. The attacker gained root-level access by uploading a malicious CSV file, creating a rogue user account named 'troot,' and potentially achieving undetected visibility into the provider's internal traffic. Cisco has since patched the flaw, but the full extent of the compromise remains unclear due to the attacker's anti-forensic measures. This incident underscores the increasing targeting of edge devices by cyber adversaries, highlighting the need for enhanced security measures in network management platforms. Organizations are urged to prioritize patching, implement robust monitoring, and adopt zero-trust architectures to mitigate similar threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Check Point VPN Vulnerability Exploited by Ransomware
Government Administration4 months ago

Critical Check Point VPN Vulnerability Exploited by Ransomware

In May 2026, a critical authentication bypass vulnerability (CVE-2026-50751) was discovered in Check Point's Remote Access VPN and Mobile Access products, specifically affecting configurations using the deprecated IKEv1 protocol. This flaw allowed unauthenticated attackers to establish VPN sessions without valid credentials, granting them unauthorized access to internal networks. Exploitation of this vulnerability began on May 7, 2026, with at least one incident linked to a Qilin ransomware affiliate. The vulnerability was publicly disclosed on June 8, 2026, and patches were subsequently released. ([mishcon.com](https://www.mishcon.com/news/active-exploitation-of-check-point-vpn-authentication-bypass-vulnerability-cve202650751?utm_source=openai)) The incident underscores the risks associated with relying on outdated protocols and the importance of timely patching. It also highlights the evolving tactics of ransomware groups, who are increasingly exploiting vulnerabilities in widely used security products to gain initial access. Organizations must reassess their security architectures to ensure they are not solely dependent on perimeter defenses, which can be compromised through such vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Operation Endgame: A Major Blow to Amadey and StealC Malware Networks
Financial Services4 months ago

Operation Endgame: A Major Blow to Amadey and StealC Malware Networks

In June 2026, an international coalition led by Europol, in partnership with Microsoft and other private entities, executed Operation Endgame to dismantle the infrastructure supporting the Amadey and StealC malware operations. This coordinated effort resulted in the disruption of 326 servers and 142 domains, the identification of over €41 million in illicit cryptocurrency, and the recovery of approximately 27 million stolen credentials from more than 385,000 compromised systems. The operation targeted the cybercrime assembly line, aiming to increase friction for cybercriminals and hinder their ability to conduct attacks. The significance of this operation lies in its comprehensive approach to disrupting malware-as-a-service platforms that facilitate initial access, credential theft, and subsequent deployment of ransomware or financial fraud. By targeting the foundational infrastructure of these malware families, law enforcement and private partners have set a precedent for future collaborative efforts to combat cybercrime at its roots.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Mistic Backdoor: A New Threat in Ransomware Attacks
Insurance4 months ago

Mistic Backdoor: A New Threat in Ransomware Attacks

In April 2026, a new backdoor named Mistic was identified in attacks targeting sectors such as insurance, education, IT, and professional services. Linked to the initial access broker KongTuke (also known as Woodgnat), Mistic facilitates unauthorized access to corporate networks, which is then sold to ransomware groups including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. The malware employs DLL side-loading techniques to maintain stealth and persistence, allowing attackers to execute commands, manipulate files, and exfiltrate data without detection. The emergence of Mistic underscores a growing trend where initial access brokers develop sophisticated tools to infiltrate networks, subsequently enabling ransomware operations. This development highlights the critical need for organizations to enhance their cybersecurity measures to detect and prevent such stealthy intrusions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Cisco SD-WAN Zero-Day CVE-2026-20245: Active Exploitation with No Patch Available
Telecommunications4 months ago

Cisco SD-WAN Zero-Day CVE-2026-20245: Active Exploitation with No Patch Available

In June 2026, Cisco disclosed CVE-2026-20245, a high-severity zero-day vulnerability in its Catalyst SD-WAN Manager, which was actively exploited in the wild. This flaw allows authenticated attackers with netadmin privileges to upload crafted files and execute arbitrary commands as root, potentially compromising the entire SD-WAN infrastructure. The vulnerability affects all deployment types, including on-premises, Cloud-Pro, Cisco Managed Cloud, and FedRAMP environments. Notably, this marks the seventh SD-WAN zero-day exploited in 2026, highlighting a concerning trend of targeted attacks on Cisco's SD-WAN solutions. Organizations utilizing Cisco SD-WAN should prioritize mitigating this vulnerability by restricting and auditing netadmin accounts, isolating management interfaces, and monitoring for anomalous command executions. ([thecybersignal.com](https://www.thecybersignal.com/cisco-catalyst-sd-wan-manager-cve-2026-20245-zero-day-exploited-no-patch-2026/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Global Coalition Dismantles Amadey and StealC Malware Networks
Financial Services4 months ago

Global Coalition Dismantles Amadey and StealC Malware Networks

In June 2026, an international law enforcement operation, in collaboration with private sector partners including Microsoft, Bitdefender, Bitsight, and ESET, successfully dismantled the infrastructure supporting the Amadey and StealC malware networks. This coordinated effort led to the seizure of 326 servers and 142 domains, the identification and restriction of over $47 million in illicit cryptocurrency assets, and the recovery of approximately 27 million stolen login credentials. The operation targeted the 'assembly lines' used by cybercriminals to launch ransomware, financial fraud, and attacks on critical infrastructure. This takedown underscores the growing effectiveness of public-private partnerships in combating cybercrime. By disrupting the infrastructure of malware-as-a-service operations like Amadey and StealC, authorities have significantly hindered the ability of cybercriminals to execute large-scale attacks, highlighting the importance of collaborative efforts in enhancing global cybersecurity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Klue OAuth Breach: A Wake-Up Call for Third-Party Integration Security
Computer Software/Engineering4 months ago

Klue OAuth Breach: A Wake-Up Call for Third-Party Integration Security

In June 2026, attackers exploited a legacy credential to breach Klue's backend servers, deploying malicious code that harvested OAuth tokens used to integrate with third-party platforms, including Salesforce. Utilizing these tokens, the attackers accessed and exfiltrated substantial CRM data—such as business contacts, price quotes, and sales communications—from multiple organizations, including Huntress and Recorded Future. The extortion group 'Icarus' claimed responsibility, threatening to leak the stolen data if ransom demands were not met. In response, Salesforce disabled the Klue Battlecards app integration to prevent further unauthorized access. This incident underscores the critical vulnerabilities associated with third-party integrations and the importance of stringent access controls and credential management. The exploitation of OAuth tokens highlights a growing trend in supply chain attacks, emphasizing the need for organizations to reassess and fortify their security postures against such sophisticated threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Understanding the 'Cordyceps' Vulnerability: A Threat to CI/CD Workflows
Computer Software/Engineering4 months ago

Understanding the 'Cordyceps' Vulnerability: A Threat to CI/CD Workflows

In June 2026, a critical vulnerability named 'Cordyceps' was identified, affecting Continuous Integration and Continuous Deployment (CI/CD) workflows across major platforms including Microsoft's Azure Sentinel, Google's AI Agent Development Kit, Apache's Doris analytics database, Cloudflare's Workers SDK, and the Python Software Foundation's Black. This flaw allows unauthenticated attackers to exploit automated workflows via malicious pull requests, potentially leading to command injection, privilege escalation, and full control over affected repositories. The attack vector leverages the inherent trust in pull requests and the automated processes that handle them, exposing millions of repositories to potential hijacking. ([darkreading.com](https://www.darkreading.com/application-security/cordyceps-malicious-pull-requests-developer-workflows?utm_source=openai)) The discovery of 'Cordyceps' underscores the escalating risks within software supply chains, particularly as agentic coding practices proliferate, reproducing insecure patterns across numerous repositories. Organizations are urged to audit and secure their CI/CD configurations to prevent unauthorized access and mitigate the risk of supply chain compromises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Malicious OpenClaw Skills Threaten AI Supply Chain
Computer Software/Engineering4 months ago

Malicious OpenClaw Skills Threaten AI Supply Chain

In June 2026, security researchers identified five malicious skills on ClawHub, OpenClaw's dedicated marketplace, that could steal credentials, bypass security scans, and perform other malicious activities for financial gain. These skills, appearing legitimate, demonstrated that such platforms are emerging as significant AI supply chain attack surfaces. ClawHub sells these skills to add functionality to the open-source AI agent, which has seen rapid adoption among developers and businesses since its launch last November. The malicious skills included infostealers targeting macOS, evasion techniques using inflated file sizes to bypass detection, and agentic threats like affiliate injection and front-running, all posing significant risks to organizations using OpenClaw. ([darkreading.com](https://www.darkreading.com/cyber-risk/malicious-openclaw-skills-clawhub-threaten-ai-supply-chain?utm_source=openai)) This incident underscores the growing threat of supply chain attacks within AI ecosystems, highlighting the need for rigorous verification frameworks and continuous monitoring of third-party extensions to prevent unauthorized access and data exfiltration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CISA Highlights Critical Vulnerabilities in Lantronix and Ubiquiti Devices
Government Administration4 months ago

CISA Highlights Critical Vulnerabilities in Lantronix and Ubiquiti Devices

On June 23, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. These vulnerabilities include CVE-2025-67038 affecting Lantronix EDS5000 devices, and three critical issues in Ubiquiti UniFi OS: CVE-2026-34908 (improper access control), CVE-2026-34909 (path traversal), and CVE-2026-34910 (improper input validation). These vulnerabilities are frequently exploited by malicious actors, posing significant risks to federal enterprises. ([cyberleveling.com](https://cyberleveling.com/blog/unifi-os-cve-2026-34908-34909-34910-critical?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched systems. Organizations are urged to prioritize remediation efforts to mitigate potential exploits, especially given the critical nature of these vulnerabilities and their potential impact on network infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
The Rise of Autonomous AI Cyber Threats in 2026
Financial Services4 months ago

The Rise of Autonomous AI Cyber Threats in 2026

In early 2026, the cybersecurity landscape experienced a paradigm shift with the emergence of frontier agentic AI models capable of autonomously discovering and exploiting software vulnerabilities at unprecedented speeds. These AI entities can identify, weaponize, and execute attacks before human defenders can respond, rendering traditional defense mechanisms inadequate. The convergence of IT and OT systems further amplifies the risk, as AI-driven breaches can seamlessly transition from digital to physical infrastructures, leading to potential operational disruptions and safety hazards. This development underscores the urgent need for organizations to reassess their cybersecurity strategies. The rapid evolution of AI-driven threats necessitates the adoption of advanced defense mechanisms that can operate at machine speed, ensuring resilience against these sophisticated adversaries.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OpenClaw AI Supply Chain Attack: A Wake-Up Call for AI Security
Computer Software/Engineering4 months ago

OpenClaw AI Supply Chain Attack: A Wake-Up Call for AI Security

In early 2026, the OpenClaw AI agent ecosystem experienced a significant supply chain attack. Malicious actors uploaded over 800 compromised skills to ClawHub, OpenClaw's official skill marketplace, embedding infostealers and enabling agentic financial fraud. This breach exposed more than 135,000 instances, highlighting critical vulnerabilities in AI agent platforms. The incident underscores the urgent need for enhanced security measures in AI supply chains, as attackers increasingly exploit these platforms to distribute malware and conduct sophisticated cyber operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports