Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 155 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1849–1860 / 3786 reports
FrostyNeighbor's 2026 Cyberattack on Ukrainian Government: A Detailed Analysis
Government Administration5 months ago

FrostyNeighbor's 2026 Cyberattack on Ukrainian Government: A Detailed Analysis

In March 2026, the Belarus-aligned cyberespionage group FrostyNeighbor launched a sophisticated spear-phishing campaign targeting Ukrainian governmental organizations. The attackers distributed malicious PDF documents impersonating the Ukrainian telecommunications company Ukrtelecom. These PDFs contained links that, upon clicking, led to a multi-stage infection chain. If the victim's IP address was identified as Ukrainian, the server delivered a malicious RAR archive containing a JavaScript-based downloader known as PicassoLoader. This downloader collected system information and, upon validation, deployed a Cobalt Strike beacon, granting the attackers remote control over the compromised systems. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/frostyneighbor-fresh-mischief-digital-shenanigans/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors in Eastern Europe, highlighting the increasing sophistication of phishing campaigns and the use of geofencing to target specific regions. Organizations must remain vigilant against such targeted attacks, especially those employing multi-stage infection chains and advanced payloads like Cobalt Strike.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files
Financial Services5 months ago

Gremlin Stealer's Evolved Tactics: Hiding in Plain Sight With Resource Files

In May 2026, Palo Alto Networks' Unit 42 identified a new variant of the Gremlin Stealer malware, which has evolved from a basic credential harvester into a sophisticated modular toolkit. This variant employs advanced obfuscation techniques, including concealing malicious payloads within embedded resource files and utilizing instruction virtualization to evade detection. Gremlin Stealer targets sensitive information such as payment card details, browser cookies, session tokens, cryptocurrency wallet data, and FTP and VPN credentials, exfiltrating this data to attacker-controlled servers for potential exploitation. The rapid evolution of Gremlin Stealer underscores a broader trend in the cyber threat landscape, where infostealers are becoming more sophisticated and harder to detect. This development highlights the urgent need for organizations to enhance their cybersecurity measures, particularly in monitoring and defending against advanced malware that employs complex evasion tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Fragnesia (CVE-2026-46300): Critical Linux Kernel Privilege Escalation Vulnerability
Information Technology/IT5 months ago

Fragnesia (CVE-2026-46300): Critical Linux Kernel Privilege Escalation Vulnerability

In May 2026, a critical vulnerability known as Fragnesia (CVE-2026-46300) was discovered in the Linux kernel's XFRM ESP-in-TCP subsystem. This flaw allows unprivileged local attackers to gain root privileges by writing arbitrary bytes to the kernel page cache of read-only files. Security researcher William Bowling identified this issue and released a proof-of-concept exploit demonstrating its potential impact. The vulnerability affects all Linux kernels released before May 13, 2026, and is part of the broader 'Dirty Frag' class of vulnerabilities. The disclosure of Fragnesia underscores the ongoing challenges in securing the Linux kernel against privilege escalation attacks. With public exploits available and patches being rolled out, organizations must prioritize updating their systems to mitigate potential threats. This incident highlights the importance of proactive vulnerability management and the need for continuous monitoring of emerging security flaws.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
NGINX Vulnerability CVE-2026-42945: What You Need to Know
Internet5 months ago

NGINX Vulnerability CVE-2026-42945: What You Need to Know

In May 2026, a critical vulnerability (CVE-2026-42945) was discovered in NGINX's ngx_http_rewrite_module, affecting versions 0.6.27 through 1.30.0. This heap buffer overflow flaw can be exploited by unauthenticated attackers using specially crafted HTTP requests, leading to denial-of-service conditions and, under certain configurations, remote code execution. The issue arises when NGINX configurations utilize both 'rewrite' and 'set' directives, a common pattern in API gateways and reverse proxy setups. The discovery of this 18-year-old vulnerability underscores the importance of regular code audits and timely patching. Given NGINX's widespread use across various industries, organizations are urged to update to the latest versions to mitigate potential risks associated with this flaw.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
KongTuke's Innovative Use of Microsoft Teams to Deploy ModeloRAT Malware
Financial Services5 months ago

KongTuke's Innovative Use of Microsoft Teams to Deploy ModeloRAT Malware

In April 2026, the threat actor KongTuke initiated a campaign leveraging Microsoft Teams to impersonate internal IT support staff. By contacting employees through external Teams chats, they persuaded victims to execute a malicious PowerShell command, leading to the deployment of ModeloRAT malware. This tactic enabled KongTuke to establish persistent access to corporate networks within minutes, facilitating data exfiltration and potential ransomware attacks. This incident underscores a significant shift in cybercriminal strategies, highlighting the exploitation of trusted communication platforms for social engineering. The rapid execution and effectiveness of this method emphasize the need for organizations to reassess and strengthen their security protocols, particularly concerning collaboration tools.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
TeamPCP Hackers Advertise Mistral AI Code Repositories for Sale
Computer Software/Engineering5 months ago

TeamPCP Hackers Advertise Mistral AI Code Repositories for Sale

In May 2026, the TeamPCP hacker group infiltrated Mistral AI's codebase management system, exfiltrating nearly 5 gigabytes of internal repositories and source code. This breach was part of the broader 'Mini Shai-Hulud' supply-chain attack, which compromised official packages from TanStack and Mistral AI through stolen CI/CD credentials and legitimate workflows. The attackers are now demanding $25,000 for the stolen data, threatening to leak it publicly if a buyer isn't found within a week. This incident underscores the escalating threat of supply-chain attacks targeting software development processes. Organizations must prioritize securing their CI/CD pipelines and implement robust monitoring to detect unauthorized access promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
May 2026 Cybersecurity Incidents: PAN-OS RCE Exploitation and AI's Role in Vulnerability Detection
Computer/Network Security5 months ago

May 2026 Cybersecurity Incidents: PAN-OS RCE Exploitation and AI's Role in Vulnerability Detection

In May 2026, multiple critical cybersecurity incidents emerged, notably the exploitation of a buffer overflow vulnerability (CVE-2026-0300) in Palo Alto Networks' PAN-OS User-ID Authentication Portal, allowing unauthenticated attackers to execute arbitrary code with root privileges. Additionally, Anthropic's AI model, Mythos, identified a low-severity vulnerability in the widely-used cURL tool, sparking debates about the efficacy of AI in vulnerability detection. These incidents underscore the persistent challenges in securing network infrastructure and the evolving role of AI in cybersecurity. The active exploitation of the PAN-OS vulnerability highlights the urgency for organizations to apply patches promptly and reassess their exposure to untrusted networks. Simultaneously, the discourse surrounding Mythos's findings emphasizes the need for a balanced approach to integrating AI tools in security workflows, ensuring they complement human expertise without overreliance.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Malicious 'node-ipc' Versions Compromise Developer Credentials
Computer Software/Engineering5 months ago

Malicious 'node-ipc' Versions Compromise Developer Credentials

On May 14, 2026, malicious versions of the widely used npm package 'node-ipc' were published, specifically versions 9.1.6, 9.2.3, and 12.0.1. These versions contained obfuscated backdoor code designed to steal developer credentials, including cloud service keys, SSH keys, and other sensitive information. The malware executed upon requiring the package, exfiltrating data to an attacker-controlled server. The compromised versions were published by an unauthorized account, indicating a potential maintainer account takeover. ([thehackernews.com](https://thehackernews.com/2026/05/stealer-backdoor-found-in-3-node-ipc.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Developers and organizations must remain vigilant, implementing robust security measures to detect and prevent such compromises. The event highlights the necessity for continuous monitoring and verification of third-party dependencies to safeguard against unauthorized code injections.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Inside the Breach: Unveiling 'The Gentlemen' Ransomware Group's Operations
Financial Services5 months ago

Inside the Breach: Unveiling 'The Gentlemen' Ransomware Group's Operations

In early May 2026, the ransomware group known as 'The Gentlemen' suffered a significant data breach when an anonymous entity compromised their internal backend database. This breach exposed approximately 16GB of internal communications, tools, and operational data, which were subsequently offered for sale on underground forums. The leaked information provided unprecedented insight into the group's organizational structure, revealing a hierarchical system led by an individual known as 'zeta88,' who oversees operations, target selection, and ransom negotiations. The group employs a generous affiliate model, offering a 90/10 payout split, and utilizes a variety of tools and techniques, including AI-assisted coding, to enhance their ransomware development and deployment processes. ([darkreading.com](https://www.darkreading.com/threat-intelligence/gentlemen-raas-gang-data-leak?utm_source=openai)) This incident underscores the evolving landscape of cyber threats, highlighting the increasing sophistication and organizational complexity of ransomware groups. The exposure of 'The Gentlemen's' internal operations offers valuable intelligence for cybersecurity professionals, enabling the development of more effective defense strategies against similar threats. Additionally, the breach serves as a reminder of the potential vulnerabilities within cybercriminal organizations themselves, which can be exploited to disrupt their activities. ([blog.checkpoint.com](https://blog.checkpoint.com/research/when-the-ransomware-gang-gets-hacked-what-the-gentlemen-leak-reveals-about-modern-ransomware-risk/?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GemStuffer: A New Frontier in Supply Chain Attacks Exploiting RubyGems
Computer Software/Engineering5 months ago

GemStuffer: A New Frontier in Supply Chain Attacks Exploiting RubyGems

In May 2026, a campaign named 'GemStuffer' exploited over 150 RubyGems packages to exfiltrate data scraped from UK local government portals. Unlike typical supply chain attacks that aim to distribute malware to developers, this operation utilized the RubyGems registry as a storage and retrieval channel for the exfiltrated data. The attackers published numerous packages containing scripts that collected public data from government websites and then uploaded this data back to RubyGems, effectively using the platform as a 'dead drop' for data storage. This method allowed the threat actors to bypass traditional command-and-control infrastructures, making detection more challenging. ([thecodingzebra.com](https://www.thecodingzebra.com/cybersecurity/gemstuffer-abuses-150-rubygems/?utm_source=openai)) This incident underscores a novel abuse of software package registries, highlighting the need for enhanced monitoring and security measures within these ecosystems. The use of legitimate platforms for data exfiltration represents an evolution in threat actor tactics, emphasizing the importance of vigilance in software supply chain security. ([cyberleveling.com](https://cyberleveling.com/blog/rubygems-gemstuffer-supply-chain-2026?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(low)
Read report
NGINX Rift: Unveiling the 18-Year-Old CVE-2026-42945 Vulnerability
Internet5 months ago

NGINX Rift: Unveiling the 18-Year-Old CVE-2026-42945 Vulnerability

In May 2026, a critical vulnerability (CVE-2026-42945) was discovered in NGINX's ngx_http_rewrite_module, present since 2008. This heap buffer overflow flaw allows unauthenticated attackers to send crafted HTTP requests, potentially causing worker process crashes or remote code execution, especially on systems with Address Space Layout Randomization (ASLR) disabled. The issue affects NGINX Plus and NGINX Open Source versions up to 1.30.0 and has been patched in subsequent releases. The disclosure of this 18-year-old vulnerability underscores the importance of regular code audits and timely patching. With NGINX's widespread use across the internet, organizations are urged to update their systems promptly to mitigate potential exploitation risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Fragnesia (CVE-2026-46300): Critical Linux Kernel Vulnerability Grants Root Access
Information Technology/IT5 months ago

Fragnesia (CVE-2026-46300): Critical Linux Kernel Vulnerability Grants Root Access

On May 13, 2026, security researcher William Bowling of the V12 security team disclosed a critical local privilege escalation vulnerability in the Linux kernel, dubbed 'Fragnesia' and tracked as CVE-2026-46300. This flaw resides in the XFRM ESP-in-TCP subsystem and allows unprivileged local attackers to modify read-only files in the kernel page cache, leading to root access without requiring race conditions. A proof-of-concept exploit has been released, and patches are currently being developed by major Linux distributions. ([almalinux.org](https://almalinux.org/blog/2026-05-13-fragnesia-cve-2026-46300/?utm_source=openai)) This vulnerability is particularly concerning as it follows two similar high-severity Linux kernel flaws—'Copy Fail' and 'Dirty Frag'—disclosed within the past two weeks, indicating a troubling trend of critical vulnerabilities in core kernel components. ([threataft.com](https://threataft.com/articles/fragnesia-linux-kernel-local-privilege-escalation?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports