Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 151 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1801–1812 / 3786 reports
Critical Windows Zero-Day Vulnerabilities Uncovered: 'YellowKey' and 'GreenPlasma'
Financial Services5 months ago

Critical Windows Zero-Day Vulnerabilities Uncovered: 'YellowKey' and 'GreenPlasma'

In May 2026, a security researcher known as 'Nightmare Eclipse' disclosed multiple zero-day vulnerabilities affecting Windows systems, including 'YellowKey' and 'GreenPlasma'. 'YellowKey' allows attackers with physical access to bypass BitLocker encryption using a USB device, while 'GreenPlasma' enables local privilege escalation to SYSTEM level by exploiting the Windows CTFMON input service. These vulnerabilities expose critical weaknesses in Windows security mechanisms, potentially leading to unauthorized data access and system control. The rapid disclosure of these zero-days, some of which are actively exploited, underscores the urgency for organizations to implement robust security measures beyond patching, such as enforcing physical security controls, applying the principle of least privilege, and enhancing monitoring for anomalous activities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Verizon DBIR 2026 Highlights AI-Driven Surge in Vulnerability Exploitation
Financial Services5 months ago

Verizon DBIR 2026 Highlights AI-Driven Surge in Vulnerability Exploitation

In 2026, Verizon's Data Breach Investigations Report (DBIR) revealed a significant shift in cyberattack vectors, with vulnerability exploitation accounting for 31% of breaches, surpassing stolen credentials for the first time. This surge is attributed to threat actors leveraging artificial intelligence (AI) to rapidly identify and exploit software flaws, reducing the window for defense from months to mere hours. ([verizon.com](https://www.verizon.com/about/news/breach-industry-wide-dbir-finds?utm_source=openai)) The report also highlights a concerning decline in vulnerability remediation, with only 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalog fully addressed in 2025, down from 38% the previous year. This trend underscores the urgent need for organizations to enhance their patch management processes and adopt proactive security measures to mitigate the evolving threat landscape. ([cyberscoop.com](https://cyberscoop.com/verizon-data-breach-investigations-report-2026/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Grafana Labs GitHub Breach: A Wake-Up Call for Supply Chain Security
Computer Software/Engineering5 months ago

Grafana Labs GitHub Breach: A Wake-Up Call for Supply Chain Security

In May 2026, Grafana Labs experienced a security breach when attackers exploited a stolen GitHub token to access and download the company's codebase. The breach was detected on May 11, 2026, and the attackers subsequently issued a ransom demand, threatening to release the stolen code. Grafana Labs refused to pay the ransom, emphasizing that no customer data or production systems were compromised. The company has since revoked the compromised credentials and implemented additional security measures to prevent future incidents. This incident underscores the growing threat of supply chain attacks targeting development environments. Organizations are increasingly vulnerable to such breaches, highlighting the need for robust security practices, including regular credential audits and enhanced monitoring of CI/CD pipelines.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Axios npm Package Compromise: A 2026 Supply Chain Attack
Computer Software/Engineering5 months ago

Axios npm Package Compromise: A 2026 Supply Chain Attack

In late March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library. They published two malicious versions, `axios@1.14.1` and `axios@0.30.4`, which included a trojanized dependency named `plain-crypto-js`. This dependency executed a `postinstall` script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malicious packages were available for approximately three hours before being removed by npm. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting open-source software repositories. The rapid deployment and removal of the malicious packages highlight the need for vigilant monitoring and swift response mechanisms within the software development community.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Mini Shai-Hulud 2026: Unveiling TeamPCP's npm Supply Chain Attack
Computer Software/Engineering5 months ago

Mini Shai-Hulud 2026: Unveiling TeamPCP's npm Supply Chain Attack

In May 2026, the self-replicating malware campaign known as Mini Shai-Hulud resurfaced, compromising hundreds of npm packages. The threat actor, TeamPCP, utilized this campaign to autonomously spread malware, install persistent OS-level backdoors, and harvest sensitive credentials such as GitHub tokens, npm tokens, SSH keys, and cloud provider credentials. The malware executed upon package installation, affecting both local development environments and CI/CD pipelines, and propagated by republishing infected packages under legitimate maintainers' names. ([cyberscoop.com](https://cyberscoop.com/mini-shai-hulud-malware-npm-packages-compromised-again/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The ability of such malware to persist beyond standard remediation efforts, like package removal, highlights the need for comprehensive security measures, including thorough auditing of developer tools and CI/CD environments, to prevent unauthorized access and data exfiltration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Verizon's 2026 DBIR: A Wake-Up Call on Exploited Vulnerabilities and Ransomware
Financial Services5 months ago

Verizon's 2026 DBIR: A Wake-Up Call on Exploited Vulnerabilities and Ransomware

In 2025, Verizon's Data Breach Investigations Report (DBIR) analyzed over 22,000 breaches, revealing that exploited vulnerabilities became the primary initial access vector, accounting for 31% of incidents—up from 20% the previous year. This surge underscores the challenges organizations face in timely vulnerability management, with the median time to fully patch a vulnerability increasing to 43 days from 32 days in 2024. Additionally, ransomware incidents rose to 48% of breaches, highlighting the persistent threat posed by financially motivated cybercriminals. The report also noted a decline in the remediation of critical vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog, with only 26% fully addressed by organizations in 2025, down from 38% in 2024. This trend emphasizes the need for enhanced vulnerability management practices and proactive security measures to mitigate the evolving cyber threat landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Credential Leak 2026: Lessons in Cybersecurity
Government Administration5 months ago

CISA Credential Leak 2026: Lessons in Cybersecurity

In May 2026, a significant security lapse was discovered involving the Cybersecurity and Infrastructure Security Agency (CISA). A contractor inadvertently exposed a public GitHub repository named 'Private-CISA,' containing sensitive credentials such as AWS GovCloud administrative keys, plaintext passwords, and SAML certificates. This repository was accessible for approximately six months, from November 2025 until its discovery in May 2026. The exposure posed substantial risks, including unauthorized access to CISA's internal systems and potential exploitation by malicious actors. ([techcrunch.com](https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/?utm_source=openai)) This incident underscores the critical importance of stringent access controls and vigilant monitoring of code repositories. It highlights the necessity for organizations to implement robust security practices, including regular audits and the use of automated tools to detect and prevent the exposure of sensitive information. The event serves as a stark reminder of the vulnerabilities associated with misconfigured repositories and the potential consequences of credential leaks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
GitHub Breach: 3,800 Internal Repositories Exfiltrated via Malicious VS Code Extension
Computer Software/Engineering5 months ago

GitHub Breach: 3,800 Internal Repositories Exfiltrated via Malicious VS Code Extension

In May 2026, GitHub experienced a security breach where approximately 3,800 internal repositories were exfiltrated. The breach occurred after an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. The attackers, identified as TeamPCP, gained access to GitHub's internal systems via this poisoned extension. GitHub has stated that there is no evidence of customer data being affected and has initiated incident response measures, including rotating critical secrets and monitoring for further activity. This incident highlights the increasing threat posed by supply chain attacks targeting developer tools and environments. Malicious extensions in widely used platforms like VS Code can serve as entry points for attackers, emphasizing the need for enhanced security measures and vigilance in software development practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Microsoft Vulnerabilities Doubled in 2025: A Call to Action
Financial Services5 months ago

Critical Microsoft Vulnerabilities Doubled in 2025: A Call to Action

In 2025, Microsoft disclosed 1,273 vulnerabilities, a slight decrease from the previous year. However, critical vulnerabilities surged from 78 to 157, reversing a multi-year downward trend. Notably, Elevation of Privilege vulnerabilities accounted for 40% of all CVEs, and Information Disclosure flaws rose by 73%, indicating attackers' focus on stealth and reconnaissance. Cloud platforms like Azure and Dynamics 365 saw critical vulnerabilities jump from 4 to 37, highlighting the increasing risk in these environments. This trend underscores the need for organizations to prioritize vulnerabilities that enable privilege escalation, identity abuse, and lateral movement. Traditional patch management is insufficient; a comprehensive approach addressing excessive privileges, misconfigurations, and weak identity controls is essential to mitigate these evolving threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Shai-Hulud Malware Compromises 600+ npm Packages in May 2026
Computer Software/Engineering5 months ago

Shai-Hulud Malware Compromises 600+ npm Packages in May 2026

In May 2026, a significant supply chain attack known as the Shai-Hulud campaign compromised over 600 npm packages, primarily targeting the @antv ecosystem. Threat actors infiltrated developer accounts to publish malicious versions of popular JavaScript libraries, including echarts-for-react, @antv/g2, and timeago.js. The malware harvested sensitive information from developer environments and CI/CD pipelines, exfiltrating data via encrypted channels to evade detection. This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the need for enhanced security measures in software development pipelines. The attackers' use of valid Sigstore provenance attestations to lend credibility to malicious packages represents a concerning evolution in attack methodologies, emphasizing the urgency for developers and organizations to implement robust verification processes and maintain vigilance against such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Storm-2949's Exploitation of SSPR in Microsoft 365 and Azure Breach
Financial Services5 months ago

Storm-2949's Exploitation of SSPR in Microsoft 365 and Azure Breach

In May 2026, the threat actor known as Storm-2949 executed a sophisticated attack targeting Microsoft 365 and Azure environments. Utilizing social engineering tactics, they impersonated IT support to exploit the Self-Service Password Reset (SSPR) feature, gaining unauthorized access to privileged accounts. This access enabled them to exfiltrate sensitive data from OneDrive, SharePoint, and Azure resources, including virtual machines, storage accounts, key vaults, app services, and SQL databases. The attackers leveraged legitimate administrative tools to blend into normal operations, complicating detection efforts. This incident underscores the evolving threat landscape where attackers increasingly exploit identity management systems and cloud services. Organizations must enhance their security protocols, particularly around identity verification and access controls, to mitigate such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical ChromaDB Vulnerability (CVE-2026-45829) Exposes AI Servers to Remote Code Execution
Computer Software/Engineering5 months ago

Critical ChromaDB Vulnerability (CVE-2026-45829) Exposes AI Servers to Remote Code Execution

In May 2026, a critical vulnerability identified as CVE-2026-45829 was discovered in ChromaDB's Python FastAPI server, affecting versions 1.0.0 and later. This flaw allows unauthenticated attackers to execute arbitrary code on exposed servers by sending crafted requests that exploit the server's handling of model repositories. The vulnerability arises from improper authentication checks, enabling attackers to load and execute malicious models from external sources like Hugging Face before any authentication is performed. This can lead to full server compromise, data exfiltration, and disruption of AI/ML workflows. The incident underscores the growing risks associated with AI infrastructure vulnerabilities, especially as AI applications become more integrated into critical business operations. Organizations must prioritize securing their AI systems by implementing robust authentication mechanisms, conducting regular security audits, and staying vigilant against emerging threats targeting AI platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports