Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 149 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1777–1788 / 3786 reports
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Computer Software/Engineering5 months ago

CISA Adds Two Known Exploited Vulnerabilities to Catalog

On May 21, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-34291, an origin validation error in Langflow, and CVE-2026-34926, a directory traversal flaw in Trend Micro Apex One (on-premise). Both vulnerabilities have been actively exploited, posing significant risks to affected systems. ([thehackernews.com](https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched software flaws. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation and safeguard their systems against emerging cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds Langflow and Trend Micro Apex One Vulnerabilities to KEV Catalog
Computer/Network Security5 months ago

CISA Adds Langflow and Trend Micro Apex One Vulnerabilities to KEV Catalog

On May 21, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2025-34291, an origin validation error in Langflow with a CVSS score of 9.4, and CVE-2026-34926, a directory traversal flaw in on-premise versions of Trend Micro Apex One with a CVSS score of 6.7. Both vulnerabilities have been actively exploited, with CVE-2025-34291 being leveraged by the Iranian state-sponsored group MuddyWater to gain initial access to target networks. ([thehackernews.com](https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by state-sponsored actors and the critical need for organizations to promptly address known security flaws. Federal agencies are mandated to apply necessary fixes by June 4, 2026, highlighting the urgency of mitigating these risks to protect sensitive systems and data. ([thehackernews.com](https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Megalodon Attack: A Wake-Up Call for CI/CD Security
Computer Software/Engineering5 months ago

Megalodon Attack: A Wake-Up Call for CI/CD Security

In May 2026, a large-scale automated attack named 'Megalodon' compromised 5,561 GitHub repositories within a six-hour period. The attackers utilized disposable accounts and forged author identities to inject malicious GitHub Actions workflows into these repositories. These workflows contained base64-encoded bash scripts designed to exfiltrate continuous integration (CI) secrets, cloud credentials, SSH keys, and other sensitive information to a command-and-control server. The attack's rapid execution and extensive reach underscore the vulnerabilities present in CI/CD pipelines and the potential for widespread supply chain compromises. This incident highlights the escalating threat landscape targeting software supply chains, emphasizing the need for enhanced security measures in CI/CD processes. Organizations must prioritize the implementation of robust authentication mechanisms, regular audits of automated workflows, and comprehensive monitoring to detect and mitigate such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Cross-Platform NPM Stealer: A 2026 Supply Chain Threat
Computer Software/Engineering5 months ago

Cross-Platform NPM Stealer: A 2026 Supply Chain Threat

In May 2026, a sophisticated cross-platform malware targeting Node.js environments was discovered. This stealer malware, embedded within obfuscated JavaScript code, specifically aimed at Windows, macOS, and Linux systems. It was designed to extract sensitive information, including browser credentials and cryptocurrency wallet data, from various browsers such as Chrome, Brave, Edge, and others. The malware utilized Base64-encoded strings and obfuscation techniques to evade detection, with its payloads embedded in plain text. Notably, it established communication with a command-and-control server at IP address 216.126.225.243, known to be associated with the DPRK OtterCookie C2 infrastructure. This incident underscores the escalating threat posed by supply chain attacks within the npm ecosystem. The malware's ability to operate across multiple platforms and its focus on exfiltrating sensitive data highlight the need for enhanced vigilance among developers and organizations. The use of obfuscation and legitimate-looking code to mask malicious intent further complicates detection efforts, emphasizing the importance of robust security practices and continuous monitoring of software dependencies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Strengthening CI/CD Security: Enhancements to zizmor's GitHub Actions Analyzer
Computer Software/Engineering5 months ago

Strengthening CI/CD Security: Enhancements to zizmor's GitHub Actions Analyzer

In March 2026, attackers exploited a misconfiguration in the `aquasecurity/trivy-action` GitHub Action, leading to the exfiltration of organization and repository secrets. These credentials were subsequently used to backdoor LiteLLM on PyPI. The static analyzer `zizmor` is designed to detect such misconfigurations in GitHub Actions workflows. However, with GitHub Actions' introduction of YAML anchors in September 2025, `zizmor` faced challenges in analyzing workflows utilizing this feature. Over a three-month collaboration, Trail of Bits and `zizmor` maintainers enhanced `zizmor`'s support for YAML anchors, addressing parsing bugs and improving its expression evaluator. This effort involved testing against a corpus of 41,253 workflows from 6,612 high-value open-source repositories, resulting in 20 filed issues and 15 merged pull requests. The enhancements ensure `zizmor` can more effectively identify and prevent misconfigurations in GitHub Actions workflows, bolstering the security of CI/CD pipelines. This incident underscores the critical importance of securing CI/CD pipelines against supply chain attacks. As attackers increasingly target CI/CD automation, tools like `zizmor` play a vital role in identifying and mitigating vulnerabilities before they can be exploited. The collaboration between Trail of Bits and `zizmor` highlights the necessity of continuous improvement and vigilance in the face of evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Europol Dismantles 'First VPN' Used by Cybercriminals
Financial Services5 months ago

Europol Dismantles 'First VPN' Used by Cybercriminals

In May 2026, a coordinated international operation led by French and Dutch authorities, with support from Europol and Eurojust, successfully dismantled 'First VPN,' a virtual private network service extensively utilized by cybercriminals to conceal their identities and illicit activities. The operation resulted in the seizure of 33 servers, the shutdown of multiple domains, and the identification of thousands of users linked to cybercrime, including ransomware attacks and data theft. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-vpn-used-ransomware-actors-dismantled-in-global-crackdown?utm_source=openai)) The takedown of 'First VPN' underscores the increasing effectiveness of international law enforcement collaboration in targeting cybercriminal infrastructure. This action not only disrupts a critical tool for cybercriminals but also provides authorities with valuable intelligence to pursue ongoing investigations into various cyber offenses. ([eurojust.europa.eu](https://www.eurojust.europa.eu/news/eurojust-coordinated-investigation-shuts-down-criminal-vpn-network?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI Uncovers Critical macOS Kernel Vulnerability in Record Time
Computer Software/Engineering5 months ago

AI Uncovers Critical macOS Kernel Vulnerability in Record Time

In May 2026, cybersecurity firm Calif utilized Anthropic's advanced AI model, Mythos Preview, to identify and exploit a kernel memory corruption vulnerability in Apple's macOS 26.4.1 running on M5 silicon. This exploit enabled privilege escalation from an unprivileged user to root access by chaining two vulnerabilities, effectively bypassing Apple's Memory Integrity Enforcement (MIE) system, a hardware-assisted security feature introduced in 2025 to mitigate memory-based exploits. The discovery underscores the potential of AI in rapidly uncovering critical system vulnerabilities, as the exploit was developed within five days. ([9to5mac.com](https://9to5mac.com/2026/05/14/calif-team-details-how-anthropic-mythos-helped-build-a-working-macos-exploit-in-five-days/?utm_source=openai)) This incident highlights the evolving cybersecurity landscape where AI tools can both uncover and potentially exploit system vulnerabilities at unprecedented speeds. Organizations must reassess their security postures to address the dual-edged nature of AI in cybersecurity, balancing its defensive capabilities against the risks of adversarial use. ([techradar.com](https://www.techradar.com/pro/security/this-work-is-a-glimpse-of-what-is-coming-security-team-lays-out-how-anthropic-mythos-helped-build-a-working-macos-exploit-in-five-days?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Security Leak: A Wake-Up Call for Credential Management
Government Administration5 months ago

CISA Security Leak: A Wake-Up Call for Credential Management

In May 2026, a contractor for the U.S. Cybersecurity and Infrastructure Security Agency (CISA) inadvertently exposed highly sensitive credentials by maintaining a public GitHub repository named 'Private-CISA.' This repository contained plaintext passwords, AWS GovCloud keys, and internal documentation detailing CISA's software development and deployment processes. Security researcher Guillaume Valadon discovered the leak, describing it as the most severe government data exposure he had encountered. The repository had been publicly accessible since at least November 2025, raising significant concerns about operational security and potential unauthorized access to critical systems. This incident underscores the persistent risks associated with improper handling of sensitive credentials and the importance of stringent access controls. It highlights the need for organizations, especially those in critical infrastructure sectors, to enforce robust security practices, conduct regular audits, and ensure that contractors adhere to strict data protection protocols to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
GitHub's 2026 Security Breach: A Supply Chain Attack via Malicious Nx Console Extension
Computer Software/Engineering5 months ago

GitHub's 2026 Security Breach: A Supply Chain Attack via Malicious Nx Console Extension

In May 2026, GitHub experienced a significant security breach when an employee inadvertently installed a malicious version of the Nx Console Visual Studio Code extension. This compromised extension, linked to the TanStack npm supply-chain attack orchestrated by the TeamPCP threat group, granted unauthorized access to approximately 3,800 internal repositories. The attackers exfiltrated internal source code and sensitive operational data, subsequently offering the stolen data for sale at a minimum of $50,000. GitHub promptly responded by securing the compromised device, rotating critical secrets, and initiating a comprehensive investigation to assess the full impact of the breach. This incident underscores the escalating threat posed by sophisticated supply chain attacks targeting trusted development tools and platforms. The exploitation of widely used extensions like Nx Console highlights the necessity for heightened vigilance and robust security measures within the software development ecosystem to prevent similar breaches in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Defender Zero-Day Vulnerabilities: CVE-2026-41091 and CVE-2026-45498
Government Administration5 months ago

Microsoft Defender Zero-Day Vulnerabilities: CVE-2026-41091 and CVE-2026-45498

In May 2026, Microsoft disclosed two zero-day vulnerabilities in its Defender security platform: CVE-2026-41091 and CVE-2026-45498. CVE-2026-41091 is a privilege escalation flaw in the Microsoft Malware Protection Engine, allowing attackers to gain SYSTEM privileges through improper link resolution. CVE-2026-45498 is a denial-of-service vulnerability in the Microsoft Defender Antimalware Platform, enabling threat actors to disrupt Windows devices. Both vulnerabilities were actively exploited before patches were released. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities Catalog, mandating federal agencies to apply patches by June 3, 2026. This incident underscores the critical need for organizations to maintain up-to-date security measures and promptly address vulnerabilities in widely used security tools.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Chinese Hackers Deploy New Malware Targeting Telecom Providers
Telecommunications5 months ago

Chinese Hackers Deploy New Malware Targeting Telecom Providers

In mid-2022, the Chinese state-sponsored group Calypso, also known as Red Lamassu, initiated a cyber-espionage campaign targeting telecommunications providers across the Asia Pacific and parts of the Middle East. The attackers employed two newly discovered malware strains: Showboat, a modular Linux post-exploitation framework, and JMFBackdoor, a Windows-based espionage implant. Showboat facilitates long-term persistence, data exfiltration, and lateral movement within networks by acting as a SOCKS5 proxy. JMFBackdoor offers capabilities such as remote command execution, file management, and system manipulation. The initial infection vectors remain unknown, but the threat actors utilized telecom-themed domains to impersonate their targets. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinese-hackers-target-telcos-with-new-linux-windows-malware/amp/?utm_source=openai)) This incident underscores a growing trend of sophisticated cyber-espionage campaigns targeting critical infrastructure sectors, particularly telecommunications. The use of advanced malware like Showboat and JMFBackdoor highlights the evolving tactics of state-sponsored actors and the necessity for robust cybersecurity measures to protect sensitive information and maintain operational integrity.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
International Operation Dismantles 'First VPN' Used by Cybercriminals
Financial Services5 months ago

International Operation Dismantles 'First VPN' Used by Cybercriminals

In May 2026, an international law enforcement operation led by France and the Netherlands, with support from Europol and Eurojust, dismantled 'First VPN,' a virtual private network service extensively used by cybercriminals to conceal ransomware attacks, data theft, and other serious offenses. The operation resulted in the seizure of 33 servers across 27 countries, the shutdown of associated domains, and the identification of numerous users. The administrator of the service was interviewed during a house search in Ukraine. 'First VPN' had been promoted on Russian-speaking cybercrime forums as a tool for anonymity, offering services designed specifically for criminal use. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-vpn-used-ransomware-actors-dismantled-in-global-crackdown?utm_source=openai)) This takedown underscores the increasing effectiveness of international cooperation in combating cybercrime infrastructure. It highlights the critical need for organizations to remain vigilant against services that facilitate illicit activities and to ensure robust cybersecurity measures are in place to protect against such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports