The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Critical RCE Vulnerability in F5 BIG-IP APM: Immediate Action Required
In October 2025, F5 disclosed a vulnerability (CVE-2025-53521) in its BIG-IP Access Policy Manager (APM), initially classified as a denial-of-service issue. In March 2026, this vulnerability was reclassified as a critical remote code execution (RCE) flaw after new information revealed that unauthenticated attackers could exploit it to execute arbitrary code on affected systems. This vulnerability affects BIG-IP APM versions 15.x, 16.x, and 17.x when an access policy is configured on a virtual server. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/03/28/big-ip-apm-vulnerability-cve-2025-53521-exploited/?utm_source=openai)) The reclassification underscores the evolving nature of cybersecurity threats and the importance of continuous monitoring and timely patching. Organizations using affected versions of BIG-IP APM are urged to apply the available patches immediately to mitigate the risk of exploitation. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/03/28/big-ip-apm-vulnerability-cve-2025-53521-exploited/?utm_source=openai))
5 months ago
Kill Chain
Anthropic's 2026 Claude Code Source Code Leak Exploited to Distribute Infostealer Malware
In March 2026, Anthropic inadvertently exposed over 500,000 lines of Claude Code's source code due to a packaging error, leading to its rapid dissemination on platforms like GitHub. Threat actors exploited this leak by creating malicious GitHub repositories that masqueraded as the leaked code, enticing users to download files that deployed Vidar infostealer malware upon execution. This incident underscores the critical need for robust internal security measures and vigilance against opportunistic cyber threats that capitalize on such exposures. The exploitation of this leak highlights a growing trend where cybercriminals swiftly leverage publicly disclosed vulnerabilities to distribute malware, emphasizing the importance of prompt incident response and comprehensive security protocols to mitigate potential damages.
5 months ago
Kill Chain
REF1695's 2023 Campaign: Unveiling the Threat of Fake Installers
In November 2023, a financially motivated threat actor, codenamed REF1695, initiated a campaign leveraging fake software installers to deploy remote access trojans (RATs) and cryptocurrency miners. The attackers utilized ISO files containing a .NET Reactor-protected loader and instructions guiding users to bypass Microsoft Defender SmartScreen protections. This method facilitated the installation of a previously undocumented .NET implant known as CNB Bot, enabling unauthorized access and resource exploitation on compromised systems. Beyond cryptomining, REF1695 monetized infections through Cost Per Action (CPA) fraud, directing victims to content locker pages under the guise of software registration. This multifaceted approach not only compromised system integrity but also led to financial losses for affected organizations. The incident underscores the evolving tactics of cybercriminals who combine traditional malware deployment with social engineering techniques to maximize their illicit gains. Organizations are urged to enhance their cybersecurity measures, including user education on recognizing phishing attempts and the importance of verifying software sources, to mitigate such threats.
5 months ago
Kill Chain
Urgent: Patch Critical RCE Vulnerabilities in Progress ShareFile
In March 2026, security researchers identified two critical vulnerabilities in Progress ShareFile, designated as CVE-2026-2699 and CVE-2026-2701. These flaws, when exploited in tandem, allow unauthenticated attackers to execute remote code by bypassing authentication mechanisms and uploading malicious web shells. Progress promptly addressed these issues by releasing Storage Zone Controller version 5.12.4 on March 10, 2026. Given the approximately 30,000 internet-facing instances of ShareFile, immediate patching is imperative to prevent potential exploitation. This incident underscores the persistent threat posed by chaining multiple vulnerabilities to achieve significant security breaches. Organizations must remain vigilant, ensuring timely updates and comprehensive security assessments to mitigate such risks.
5 months ago
Kill Chain
React2Shell Exploitation Leads to Massive Credential Harvesting in 2026
In early 2026, a large-scale credential harvesting operation exploited the React2Shell vulnerability (CVE-2025-55182) to compromise 766 Next.js hosts. Attackers leveraged this critical remote code execution flaw in React Server Components to gain unauthorized access to sensitive data, including database credentials, SSH private keys, AWS secrets, shell command history, Stripe API keys, and GitHub tokens. The breach underscores the severe risks associated with unpatched vulnerabilities in widely used web frameworks. The React2Shell vulnerability, disclosed in December 2025, has been actively exploited by threat actors, leading to significant data breaches and system compromises. This incident highlights the urgent need for organizations to promptly apply security patches and implement robust monitoring to detect and mitigate exploitation attempts.
5 months ago
Kill Chain
Cisco IMC Vulnerabilities: Authentication Bypass and Command Injection Risks in 2026
In April 2026, Cisco disclosed two critical vulnerabilities in its Integrated Management Controller (IMC): CVE-2026-20093 and CVE-2026-20094. CVE-2026-20093 is an authentication bypass flaw that allows unauthenticated, remote attackers to gain admin access by exploiting improper handling of password change requests. CVE-2026-20094 is a command injection vulnerability enabling authenticated users with read-only privileges to execute arbitrary commands as the root user due to inadequate input validation. Exploitation of these vulnerabilities could lead to full system compromise, including unauthorized access, data manipulation, and potential service disruptions. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cimc-auth-bypass-AgG2BxTn.html?utm_source=openai)) The disclosure of these vulnerabilities underscores the ongoing risks associated with out-of-band management interfaces. As organizations increasingly rely on such systems for remote administration, ensuring their security becomes paramount. This incident highlights the necessity for regular security assessments, prompt application of patches, and vigilant monitoring to mitigate potential threats.
5 months ago
Kill Chain
Understanding Cookie-Controlled PHP Web Shells in Linux Hosting
In early 2026, threat actors increasingly exploited PHP web shells on Linux servers, utilizing HTTP cookies as control channels. This method allowed malicious code to remain dormant during normal operations, activating only when specific cookie values were present, thereby evading traditional detection mechanisms. The attackers employed various obfuscation techniques, including layered encoding and dynamic function reconstruction, to conceal their activities. This approach enabled persistent access, often through scheduled tasks that reinstated the web shell if removed, complicating remediation efforts. The incidents underscored the need for enhanced monitoring of web server processes and stricter controls over scheduled tasks to prevent unauthorized access and maintain system integrity. The rise of cookie-controlled PHP web shells highlights a significant shift in attacker tactics, emphasizing stealth and persistence. Organizations must adapt by implementing advanced detection strategies, such as behavior-based monitoring and anomaly detection, to identify and mitigate these sophisticated threats effectively.
5 months ago
Kill Chain
Anthropic's 2026 Source Code Leak: Lessons in Software Security
In March 2026, Anthropic, an AI company, inadvertently exposed the complete source code of its proprietary coding assistant, Claude Code. The leak occurred when a routine software update mistakenly included a 60 MB source map file (`cli.js.map`) in the NPM package version 2.1.88, allowing reconstruction of approximately 1,900 files and 500,000 lines of TypeScript code. This exposure revealed internal architectures and unreleased features, providing competitors with insights into Anthropic's development roadmap. The company confirmed that no sensitive customer data or credentials were compromised and attributed the incident to human error in the release packaging process. ([theguardian.com](https://www.theguardian.com/technology/2026/apr/01/anthropic-claudes-code-leaks-ai?utm_source=openai)) This incident underscores the critical importance of stringent internal security and release management practices, especially for organizations handling proprietary and sensitive information. The rapid dissemination of the leaked code across platforms like GitHub highlights the challenges in containing such exposures once they occur. ([theguardian.com](https://www.theguardian.com/technology/2026/apr/01/anthropic-claudes-code-leaks-ai?utm_source=openai))
5 months ago
Kill Chain
Google Drive Enhances Security with AI-Powered Ransomware Detection
In April 2026, Google announced the general availability of its AI-powered ransomware detection feature for Google Drive, now enabled by default for all paying users. This feature, initially introduced in beta in September 2025, utilizes advanced AI models to monitor file synchronization activities. Upon detecting ransomware-like behavior, it automatically pauses file syncing, alerts users and IT administrators, and provides detailed instructions for restoring uncorrupted files. This proactive approach aims to minimize the impact of ransomware attacks by safeguarding documents stored in Google Drive and facilitating swift recovery processes. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/google-drive-ransomware-detection-now-on-by-default-for-paying-users/?utm_source=openai)) The release of this enhanced security feature underscores the growing threat of ransomware attacks targeting cloud storage services. By integrating AI-driven detection mechanisms, Google addresses the need for robust, automated defenses against increasingly sophisticated cyber threats, highlighting the importance of proactive security measures in protecting organizational data assets.
5 months ago
Kill Chain
Blackpoint Cyber's 2026 Report: Credential Abuse and RMM Tool Exploitation
In 2026, Blackpoint Cyber's annual threat report highlighted a significant shift in cyberattack methodologies, with a notable increase in the exploitation of legitimate access methods over traditional vulnerability exploits. The report revealed that 32.8% of incidents involved SSL VPN abuse, where attackers utilized valid but compromised credentials to establish seemingly legitimate sessions, facilitating rapid lateral movement within networks. Additionally, 30.3% of incidents featured the misuse of Remote Monitoring and Management (RMM) tools, particularly ScreenConnect, which was present in over 70% of rogue RMM cases. This trend underscores the evolving tactics of threat actors who are leveraging trusted IT tools to gain and maintain unauthorized access, thereby evading conventional security measures. The current relevance of this incident lies in the growing prevalence of identity-driven attacks and the strategic use of legitimate tools for malicious purposes. Organizations must recognize that traditional security controls may be insufficient against such tactics, necessitating enhanced monitoring of credential usage and the implementation of stringent access controls. The rise in these sophisticated methods highlights the urgent need for adaptive security strategies to effectively counteract the evolving threat landscape.
5 months ago
Kill Chain
CrystalX RAT: A New Era of Multifunctional Malware-as-a-Service
In early 2026, a new malware-as-a-service (MaaS) known as CrystalX RAT emerged, offering a comprehensive suite of malicious capabilities including remote access, data theft, keylogging, and clipboard hijacking. Promoted through private Telegram channels and YouTube, CrystalX RAT features a user-friendly control panel and an automated builder tool that supports customization options such as geoblocking and anti-analysis features. Notably, it also includes prankware functionalities designed to disrupt user activities, such as altering display orientation and remapping mouse buttons. The malware's infostealer component targets Chromium-based browsers and desktop applications like Steam, Discord, and Telegram, while its remote access module allows for command execution, file manipulation, and real-time control via VNC. ([securelist.com](https://securelist.com/crystalx-rat-with-prankware-features/119283/?utm_source=openai)) The emergence of CrystalX RAT underscores a growing trend in the cybercriminal ecosystem towards offering multifunctional MaaS platforms that lower the barrier to entry for threat actors. Its combination of traditional malware capabilities with prankware features highlights the evolving nature of cyber threats, emphasizing the need for robust cybersecurity measures and user awareness to mitigate such risks.
5 months ago
Kill Chain
UNC1069's Compromise of Axios npm Package: A 2026 Supply Chain Attack
In late March 2026, the widely used JavaScript library Axios, with approximately 100 million weekly downloads, was compromised in a supply chain attack attributed to the North Korean threat group UNC1069. The attackers gained control of a maintainer's npm account and published two malicious versions of Axios (1.14.1 and 0.30.4) that included a trojanized dependency named 'plain-crypto-js'. This dependency executed a post-installation script to deploy a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The malicious versions were available for about three hours before removal, but the potential impact is significant due to Axios's extensive use across various projects. ([thehackernews.com](https://thehackernews.com/2026/04/google-attributes-axios-npm-supply.html?utm_source=openai)) This incident underscores the growing trend of sophisticated supply chain attacks targeting open-source software, emphasizing the need for enhanced security measures in software development and distribution processes. Organizations are urged to audit their dependency trees, implement strict access controls, and monitor for unusual activities to mitigate such risks.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports