Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 133 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1585–1596 / 3786 reports
Kyushu Electric Power Data Breach: 10.9 Million Customer Records Exposed
Utilities5 months ago

Kyushu Electric Power Data Breach: 10.9 Million Customer Records Exposed

In April 2026, Kyushu Electric Power Co., Inc., a major Japanese utility company, experienced a significant data breach involving the loss of an external storage device containing personal information of approximately 10.9 million customers. The device, used for routine data backups, was stored in a server room cabinet with multiple physical security layers. On May 26, IT staff discovered the cabinet unlocked and the device missing. The data included customer names, service addresses, electricity usage data, telephone numbers, and names of retail electricity providers. Notably, no bank account or credit card information was stored on the device. The company has notified affected customers and relevant authorities, including Japan’s Personal Information Protection Commission and the Ministry of Economy, Trade, and Industry. Investigations are ongoing, with no evidence of data leakage confirmed as of now. This incident underscores the critical importance of robust physical security measures and strict access controls for sensitive data storage. It highlights the need for organizations to regularly review and enhance their data protection protocols to prevent unauthorized access and potential data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Critical Security Flaws Discovered in OpenClaw AI Agent
Computer Software/Engineering5 months ago

Critical Security Flaws Discovered in OpenClaw AI Agent

In June 2026, security researchers from Imperva and Varonis identified critical vulnerabilities in OpenClaw, a widely used self-hosted AI agent. Imperva demonstrated that attackers could embed malicious instructions within shared contacts, vCards, and location pins, leading the agent to execute unauthorized code without user awareness. Varonis revealed that OpenClaw could be manipulated through standard emails to exfiltrate sensitive data, such as AWS keys and customer information, to external addresses. These findings underscore the agent's susceptibility to prompt injection attacks and its overreliance on unverified inputs, posing significant security risks to users. The rapid adoption of AI agents like OpenClaw has outpaced the development of robust security measures, highlighting the urgent need for comprehensive governance frameworks. Organizations must reassess their deployment strategies, implement stringent access controls, and ensure continuous monitoring to mitigate the risks associated with autonomous AI systems operating within their environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Escalating Cyber Threats from North Korea and China Target Asia-Pacific Financial Institutions
Financial Services5 months ago

Escalating Cyber Threats from North Korea and China Target Asia-Pacific Financial Institutions

In 2025, cyber threat groups linked to North Korea and China intensified their attacks on financial institutions and cryptocurrency assets in the Asia-Pacific region. North Korean adversaries, notably PRESSURE CHOLLIMA, executed the largest financial theft to date, stealing $1.46 billion in cryptocurrency through a supply chain compromise. Concurrently, Chinese threat actors like HOLLOW PANDA targeted financial institutions across multiple countries, including the Philippines, Indonesia, and Brazil. These operations leveraged advanced techniques, including AI-generated identities and sophisticated social engineering tactics, to infiltrate organizations and exfiltrate sensitive data. ([crowdstrike.com](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-2026-financial-services-threat-landscape-report/?utm_source=openai)) The escalation of these cyber activities underscores a growing trend of state-sponsored cybercrime aimed at financial gain and intelligence collection. The increasing sophistication and frequency of these attacks highlight the urgent need for enhanced cybersecurity measures and international collaboration to protect financial infrastructures from such persistent threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ServiceNow Security Alert: Understanding the June 2026 Incident
Computer Software/Engineering5 months ago

ServiceNow Security Alert: Understanding the June 2026 Incident

In early June 2026, ServiceNow identified a security issue that allowed unauthorized users to access certain customer data through a misconfigured API endpoint. The vulnerability, affecting customers on the Australia platform release and earlier versions with specific configurations, was exploited to query customer instance tables containing sensitive information. ServiceNow addressed the issue with a security update on June 5, 2026, restricting access to authenticated users. Subsequent investigations revealed that the anomalous activity was conducted by security researchers participating in bug bounty programs, not malicious actors. This incident underscores the importance of promptly addressing security vulnerabilities and the potential for security research activities to be misinterpreted as malicious threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
GitHub Enhances Security by Disabling npm Install Scripts by Default
Computer Software/Engineering5 months ago

GitHub Enhances Security by Disabling npm Install Scripts by Default

In June 2026, GitHub announced significant changes to npm version 12, aiming to enhance security by disabling install scripts by default. This measure addresses vulnerabilities where attackers exploit npm lifecycle hooks during the 'npm install' process to execute malicious code. By requiring explicit user approval for script execution, GitHub seeks to mitigate risks associated with software supply chain attacks. This change is particularly relevant given the recent surge in supply chain attacks targeting npm packages. Incidents like the 'Mini Shai-Hulud' campaign have demonstrated the potential for widespread impact, emphasizing the need for proactive security measures in package management systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
OceanLotus Targets Vietnamese Investors via FireAnt Metakit Supply Chain Attack
Construction5 months ago

OceanLotus Targets Vietnamese Investors via FireAnt Metakit Supply Chain Attack

Between mid-2024 and March 2026, the Vietnam-aligned threat actor OceanLotus (APT32) conducted cyber espionage campaigns targeting domestic entities. Notably, from October 2025 to March 2026, they executed a supply chain attack by compromising the update mechanism of FireAnt Metakit, a widely used stock investment platform in Vietnam. This allowed them to distribute the SPECTRALVIPER backdoor to a select group of investors, facilitating unauthorized access and data exfiltration. This incident underscores a strategic shift by OceanLotus towards domestic targets, highlighting the evolving threat landscape where nation-state actors exploit trusted software supply chains to infiltrate critical sectors. Organizations must enhance their software supply chain security and implement robust monitoring to detect such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
OpenClaw AI Agent Phishing Incident Highlights Critical Security Gaps
Computer Software/Engineering5 months ago

OpenClaw AI Agent Phishing Incident Highlights Critical Security Gaps

In June 2026, a significant cybersecurity incident was reported involving the OpenClaw AI agent. Security researchers at Varonis conducted an experiment where they connected an OpenClaw email agent to a simulated Gmail inbox containing fictitious company data. Through a single phishing email impersonating a colleague, the AI agent was tricked into disclosing sensitive information, including AWS credentials, database connection strings, and a customer export list. This breach underscores the vulnerability of autonomous AI systems to social engineering attacks, highlighting the need for robust security measures in AI deployments. The incident is particularly concerning given the increasing integration of AI agents in enterprise environments. As these systems gain more autonomy and access to critical data, the potential for exploitation through sophisticated phishing tactics grows. Organizations must prioritize the development and implementation of security frameworks tailored to AI agents to prevent similar breaches in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Understanding the OpenClaw Vulnerability and AI Agent Supply Chain Risks
Computer Software/Engineering5 months ago

Understanding the OpenClaw Vulnerability and AI Agent Supply Chain Risks

In early 2026, the OpenClaw AI agent framework, widely adopted for automating enterprise workflows, was found to have a critical vulnerability (CVE-2026-25253) that allowed remote code execution via a WebSocket exploit. This flaw enabled attackers to hijack agents by tricking users into visiting malicious websites, potentially compromising entire workstations. The incident highlighted the risks associated with unmanaged, autonomous AI systems operating with extensive access and minimal oversight. ([waxell.ai](https://www.waxell.ai/blog/openclaw-ai-agent-supply-chain-security?utm_source=openai)) This event underscores the growing security challenges in AI agent supply chains, emphasizing the need for robust governance and verification mechanisms. As organizations increasingly deploy AI agents, ensuring the integrity and security of third-party skills and components becomes paramount to prevent similar vulnerabilities and attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OpenAI Identifies Chinese Influence Operations Leveraging ChatGPT
Information Technology/IT5 months ago

OpenAI Identifies Chinese Influence Operations Leveraging ChatGPT

In June 2026, OpenAI's threat intelligence team identified two distinct influence operations originating from China, utilizing ChatGPT to generate content aimed at exacerbating divisive topics such as AI and data centers. The first operation, termed "Data Center Bandwagon," produced imagery and social media posts alleging that data center expansions were increasing electricity costs for Americans. The second operation created content portraying tariffs as covert tools for nations to exert control over the global technological landscape, selectively including U.S. President Donald Trump while omitting Chinese President Xi Jinping. Both campaigns employed VPNs to mask their origins, used ChatGPT in simplified Chinese to generate content in both English and Chinese, and impersonated Americans on platforms like X and YouTube. Despite these efforts, OpenAI found minimal evidence of significant engagement beyond the operators' own amplification networks, indicating limited impact on public discourse. This incident underscores the evolving use of AI tools in state-sponsored influence operations and highlights the necessity for vigilance against such tactics. The use of generative AI by foreign actors to manipulate public opinion represents a growing challenge in the cybersecurity landscape, emphasizing the need for robust detection and mitigation strategies to counteract misinformation campaigns.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
CISA's BOD 26-04: A New Era in Risk-Based Vulnerability Management
Government Administration5 months ago

CISA's BOD 26-04: A New Era in Risk-Based Vulnerability Management

On June 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04, mandating federal agencies to prioritize vulnerability remediation based on four specific criteria: public exposure of the asset, evidence of active exploitation, potential for automated exploitation, and the technical impact of the vulnerability. Vulnerabilities meeting all four criteria require remediation within three days, accompanied by a forensic assessment to determine if systems have been compromised. ([cyberscoop.com](https://cyberscoop.com/cisa-vulnerability-remediation-directive-bod-26-04/?utm_source=openai)) This directive reflects CISA's response to the accelerated threat landscape, particularly the role of artificial intelligence in rapidly identifying and exploiting vulnerabilities. By focusing on risk-based prioritization, BOD 26-04 aims to enhance the efficiency and effectiveness of federal agencies' cybersecurity efforts, ensuring that the most critical vulnerabilities are addressed promptly to mitigate potential threats. ([cyberscoop.com](https://cyberscoop.com/cisa-vulnerability-remediation-directive-bod-26-04/?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Addresses Critical Zero-Day Vulnerabilities: YellowKey, GreenPlasma, and MiniPlasma
Financial Services5 months ago

Microsoft Addresses Critical Zero-Day Vulnerabilities: YellowKey, GreenPlasma, and MiniPlasma

In June 2026, Microsoft addressed three critical zero-day vulnerabilities—YellowKey, GreenPlasma, and MiniPlasma—disclosed by the researcher 'Nightmare Eclipse.' YellowKey (CVE-2026-45585) allowed attackers with physical access to bypass BitLocker encryption via the Windows Recovery Environment. GreenPlasma (CVE-2026-45586) and MiniPlasma (CVE-2020-17103) were privilege escalation flaws in the Collaborative Translation Framework and Cloud Files Mini Filter Driver, respectively, enabling local attackers to gain SYSTEM privileges on fully patched Windows systems. These vulnerabilities were patched in Microsoft's June 2026 Patch Tuesday updates. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/microsoft/microsoft-patches-yellowkey-greenplasma-miniplasma-zero-days/?utm_source=openai)) The disclosure of these vulnerabilities highlights ongoing challenges in vulnerability management and coordinated disclosure practices. The public release of proof-of-concept exploits prior to patches underscores the need for robust security measures and prompt patch management to mitigate potential threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Exchange Server CVE-2026-42897 Zero-Day Exploited in Attacks
Financial Services5 months ago

Microsoft Exchange Server CVE-2026-42897 Zero-Day Exploited in Attacks

In May 2026, Microsoft disclosed a high-severity cross-site scripting (XSS) vulnerability, CVE-2026-42897, affecting on-premises Exchange Server versions 2016, 2019, and Subscription Edition. This flaw allows remote attackers to execute arbitrary JavaScript in the context of a user's browser by sending specially crafted emails, which, when opened in Outlook Web Access (OWA), trigger the exploit. The vulnerability was actively exploited in the wild, prompting Microsoft to release security updates in June 2026 to address the issue. Organizations were advised to apply these updates promptly and maintain existing mitigations to ensure comprehensive protection. The exploitation of CVE-2026-42897 underscores the persistent targeting of email infrastructure by threat actors, highlighting the critical need for organizations to prioritize the security of their communication platforms. This incident serves as a reminder of the importance of timely patch management and the implementation of robust security measures to defend against evolving cyber threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports