The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
GopherWhisper APT Exploits Go-Based Backdoors to Target Mongolian Government
In January 2025, ESET researchers identified a previously undocumented China-aligned advanced persistent threat (APT) group named GopherWhisper targeting Mongolian governmental institutions. The group employs a suite of tools primarily written in Go, including injectors and loaders, to deploy various backdoors such as LaxGopher, RatGopher, and BoxOfFriends. GopherWhisper leverages legitimate services like Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control (C&C) communications and data exfiltration. The group's activities have been ongoing since at least November 2023, compromising at least 12 systems within a Mongolian government entity. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/04/23/3279634/0/en/ESET-Research-discovers-new-China-aligned-group-GopherWhisper-It-abuses-messaging-services-Discord-Slack-and-Outlook-to-spy.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who exploit widely used communication platforms to evade detection. The use of Go-based malware highlights a trend towards more versatile and cross-platform attack tools, posing significant challenges for traditional security measures. Organizations must adapt their defenses to address these sophisticated techniques.
5 months ago
Kill Chain
Bitwarden CLI Compromised in Checkmarx Supply Chain Attack
In April 2026, Bitwarden's Command Line Interface (CLI) version 2026.4.0 was compromised through a supply chain attack linked to the Checkmarx campaign. Attackers exploited a GitHub Action within Bitwarden's CI/CD pipeline to inject malicious code into the npm package, specifically targeting the 'bw1.js' file. This code executed during installation, leading to the theft of sensitive information such as GitHub and npm tokens, SSH keys, environment variables, shell history, and cloud credentials. The malicious package was available between 5:57 PM and 7:30 PM ET on April 22, 2026, before being identified and removed. Bitwarden confirmed that no end-user vault data or production systems were compromised. ([community.bitwarden.com](https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting CI/CD pipelines, emphasizing the need for robust security measures in software development processes. Organizations are urged to review and fortify their CI/CD workflows to prevent similar breaches.
5 months ago
Kill Chain
UNC6692's Deceptive Use of Microsoft Teams to Deploy SNOW Malware
In April 2026, the threat group UNC6692 executed a sophisticated social engineering campaign targeting corporate employees via Microsoft Teams. By impersonating IT helpdesk staff, they convinced victims to accept chat invitations, leading to the deployment of a custom malware suite known as SNOW. This malware facilitated unauthorized access, data exfiltration, and potential ransomware deployment, significantly compromising organizational security. This incident underscores a growing trend of attackers exploiting trusted communication platforms like Microsoft Teams to bypass traditional security measures. The use of social engineering combined with custom malware highlights the need for enhanced vigilance and robust security protocols to protect against such evolving threats.
5 months ago
Kill Chain
Chinese APT GopherWhisper Exploits Cloud Services in Mongolian Cyber Espionage
In April 2026, ESET researchers uncovered a Chinese advanced persistent threat (APT) group named GopherWhisper targeting Mongolian government institutions. Active since at least November 2023, GopherWhisper deployed multiple custom backdoors—LaxGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor—each utilizing different cloud services like Slack, Discord, Microsoft Outlook, and file.io for command-and-control communications and data exfiltration. This campaign compromised at least 12 systems within a Mongolian governmental institution, with indications of broader impact across the region. This incident underscores a growing trend of APT groups leveraging legitimate cloud services to evade detection and maintain persistent access. Organizations must enhance their monitoring of cloud-based communications and implement robust security measures to detect and mitigate such sophisticated threats.
5 months ago
Kill Chain
Anthropic's Claude Code Memory Vulnerability: A Wake-Up Call for AI Security
In March 2026, Cisco researchers identified a critical vulnerability in Anthropic's Claude Code AI coding assistant, where compromised memory files allowed attackers to persistently infect projects and sessions. This flaw enabled the insertion of hard-coded secrets into production code, selection of insecure packages, and propagation of these changes to other development team members. Anthropic has since addressed the issue, but the incident underscores the inherent risks associated with AI memory files and context data. The exploitation of AI memory files highlights a growing trend where attackers target the persistent state of AI systems to manipulate outputs and maintain unauthorized access. This incident serves as a cautionary tale for organizations integrating AI tools, emphasizing the need for robust security measures to protect against such vulnerabilities.
5 months ago
Kill Chain
Zealot AI: A Glimpse into Autonomous Cloud Attacks
In April 2026, Palo Alto Networks' Unit 42 unveiled 'Zealot,' an AI-driven, multi-agent system capable of autonomously executing end-to-end cloud attacks. In a controlled environment, Zealot rapidly identified and exploited vulnerabilities within a misconfigured Google Cloud Platform, achieving data exfiltration in mere minutes. This proof-of-concept underscores the potential for AI to accelerate cyberattacks beyond human response capabilities. The demonstration highlights the urgent need for organizations to enhance their security postures. As AI technologies evolve, they not only offer defensive advantages but also equip adversaries with tools to conduct swift and sophisticated attacks, emphasizing the importance of proactive and automated defense mechanisms.
5 months ago
Kill Chain
Microsoft Releases Emergency Patch for Critical ASP.NET Core Vulnerability CVE-2026-40372
In April 2026, Microsoft identified a critical vulnerability (CVE-2026-40372) in ASP.NET Core's Data Protection API, which could allow unauthenticated attackers to escalate privileges to SYSTEM level by forging authentication cookies. This flaw, present in versions 10.0.0 through 10.0.6, stemmed from improper verification of cryptographic signatures, enabling attackers to bypass authentication mechanisms and gain unauthorized access to sensitive data. Microsoft promptly released an out-of-band update (version 10.0.7) to address this issue and advised users to update their systems immediately. This incident underscores the importance of timely patch management and vigilance in monitoring for security updates. The rapid response by Microsoft highlights the evolving nature of software vulnerabilities and the necessity for organizations to stay informed about potential threats to maintain robust security postures.
5 months ago
Kill Chain
Harvester's Linux GoGra Backdoor Exploits Microsoft Graph API
In April 2026, the state-sponsored Harvester group deployed a Linux variant of its GoGra backdoor, utilizing the Microsoft Graph API and Outlook mailboxes for covert command-and-control communications. This sophisticated malware exploits legitimate Microsoft infrastructure to evade detection, targeting telecommunications, government, and IT organizations in South Asia. The Linux GoGra backdoor shares significant code similarities with its Windows counterpart, indicating a concerted effort by Harvester to expand its cross-platform capabilities. The emergence of this Linux variant underscores a growing trend among threat actors to develop multi-platform malware that leverages trusted cloud services for stealthy operations. Organizations must enhance their monitoring of cloud API interactions and implement robust security measures to detect and mitigate such advanced threats.
5 months ago
Kill Chain
Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Attacks
In April 2026, Microsoft disclosed a spoofing vulnerability (CVE-2026-32201) in SharePoint Server, affecting versions 2016, 2019, and Subscription Edition. This flaw allows unauthenticated attackers to perform network-based spoofing attacks due to improper input validation. Despite the release of patches on April 14, over 1,300 internet-exposed SharePoint servers remain unpatched, leaving organizations vulnerable to unauthorized access and data manipulation. The continued exploitation of CVE-2026-32201 underscores the critical need for timely patch management. Organizations must prioritize updating their SharePoint servers to mitigate potential breaches and maintain data integrity.
5 months ago
Kill Chain
Critical npm Supply Chain Attack Exposes Developer Credentials
In April 2026, a sophisticated supply chain attack targeted the Node Package Manager (npm) ecosystem, compromising multiple packages from Namastex Labs, a company specializing in AI-based solutions. The attackers injected malicious code into these packages, enabling the theft of developer credentials, API keys, SSH keys, and other sensitive data. The malware exhibited worm-like behavior by identifying npm publishing tokens on compromised systems and propagating itself by injecting malicious code into other packages that the stolen tokens could access, leading to a rapid spread across the npm ecosystem. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems. The attackers' ability to compromise trusted packages and leverage them to distribute malware highlights the critical need for enhanced security measures in software development pipelines. Organizations must prioritize the implementation of robust security practices, including regular audits of dependencies, strict access controls, and continuous monitoring, to mitigate the risks associated with such attacks.
5 months ago
Kill Chain
Inside Caller-as-a-Service Fraud: The Scam Economy Has a Hiring Process
In April 2026, cybersecurity researchers uncovered a sophisticated 'Caller-as-a-Service' (CaaS) fraud operation, where cybercriminals have structured their activities to mirror legitimate call centers. These operations involve specialized roles such as malware developers, phishing kit builders, infrastructure operators, and scam callers, all working in concert to execute large-scale social engineering attacks. This professionalization has led to a significant increase in the efficiency and impact of fraudulent phone calls, resulting in substantial financial losses and emotional distress for victims. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-caller-as-a-service-fraud-the-scam-economy-has-a-hiring-process/?utm_source=openai)) The emergence of CaaS highlights a critical evolution in cybercrime, emphasizing the need for enhanced security measures and public awareness. As these fraudulent operations become more organized and effective, individuals and organizations must adopt proactive strategies to detect and prevent such sophisticated social engineering attacks.
5 months ago
Kill Chain
Mirai Botnet Exploits D-Link Router Vulnerability CVE-2025-29635
In March 2026, Akamai's Security Intelligence and Response Team (SIRT) identified active exploitation of CVE-2025-29635, a command injection vulnerability in D-Link DIR-823X routers, by a new Mirai-based malware campaign. Attackers are sending POST requests to the vulnerable endpoint, executing remote commands to download and install a Mirai variant named "tuxnokill," which enables the compromised devices to perform distributed denial-of-service (DDoS) attacks. This marks the first observed in-the-wild exploitation of this vulnerability since its disclosure in March 2025. ([akamai.com](https://www.akamai.com/blog/security-research/cve-2025-29635-mirai-campaign-targets-d-link-devices?utm_source=openai)) The exploitation of end-of-life (EoL) devices underscores the critical need for organizations to replace outdated hardware and apply security patches promptly. The resurgence of Mirai variants targeting unpatched IoT devices highlights the ongoing threat posed by botnets leveraging known vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-mirai-campaign-exploits-rce-flaw-in-eol-d-link-routers/?utm_source=openai))
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports