The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
SolarWinds Web Help Desk 2025 AjaxProxy RCE Vulnerability
In September 2025, a critical vulnerability (CVE-2025-26399) was identified in SolarWinds Web Help Desk, allowing unauthenticated remote attackers to execute arbitrary code on affected systems. This flaw, rooted in insecure deserialization within the AjaxProxy component, enables attackers to run commands on the host machine without authentication. Despite previous patches for related vulnerabilities (CVE-2024-28986 and CVE-2024-28988), this issue persisted, leading to active exploitation in the wild. Organizations using versions up to 12.8.7 are at significant risk and should apply the latest hotfix immediately. The recurrence of such vulnerabilities underscores the importance of comprehensive security reviews and prompt patch management. As attackers increasingly exploit deserialization flaws, organizations must prioritize securing their software supply chains and implementing robust monitoring to detect and respond to such threats promptly.
6 months ago
Kill Chain
Sednit's Resurgence: Advanced Cyber Espionage Targeting Ukrainian Military (2024-2026)
Between April 2024 and March 2026, the Russian state-sponsored group Sednit (also known as APT28 or Fancy Bear) reactivated its advanced development team, deploying sophisticated implants named BeardShell and Covenant to conduct prolonged surveillance on Ukrainian military personnel. These tools, leveraging legitimate cloud services for command and control, demonstrate a direct code lineage to Sednit's earlier malware from the 2010s, indicating a resurgence in their cyber espionage capabilities. This resurgence underscores the persistent threat posed by nation-state actors employing advanced techniques to infiltrate and monitor critical military infrastructures, highlighting the need for continuous vigilance and adaptive cybersecurity measures.
6 months ago
Kill Chain
APT28's Exploitation of Microsoft Office Vulnerability: A Deep Dive
In early 2026, the Russian state-sponsored hacking group APT28, also known as Fancy Bear, exploited a newly disclosed Microsoft Office vulnerability (CVE-2026-21509) to target Ukrainian government agencies. The attackers distributed malicious documents via phishing emails, leading to the deployment of the COVENANT malware framework and the BEARDSHELL backdoor, facilitating long-term surveillance and data exfiltration. This campaign underscores the rapid weaponization of zero-day vulnerabilities by nation-state actors and highlights the persistent cyber threats facing governmental institutions. Organizations are urged to promptly apply security patches and enhance their cybersecurity measures to mitigate such sophisticated attacks.
6 months ago
Kill Chain
Critical Ivanti EPM Vulnerability Exploited: Immediate Action Required
In February 2026, a critical authentication bypass vulnerability (CVE-2026-1603) was identified in Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5. This flaw allows remote, unauthenticated attackers to access stored credential data by exploiting improper authentication mechanisms, specifically through malformed header concatenation in the WSAuth.dll component. Successful exploitation enables attackers to retrieve encrypted credential blobs for high-privilege accounts, potentially compromising the entire endpoint management trust model and facilitating lateral movement within networks. ([dbugs.ptsecurity.com](https://dbugs.ptsecurity.com/vulnerability/CVE-2026-1603?utm_source=openai)) The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-1603 to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. Organizations are urged to upgrade to Ivanti EPM 2024 SU5 immediately to mitigate this risk. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-recently-patched-ivanti-epm-flaw-now-actively-exploited/?utm_source=openai))
6 months ago
Kill Chain
KadNap Botnet: A New Threat Targeting ASUS Routers in 2026
In August 2025, cybersecurity researchers identified a new malware strain named KadNap, which primarily targets ASUS routers and other edge networking devices. The malware infiltrates these devices, transforming them into nodes within a botnet that proxies malicious traffic. KadNap employs a customized version of the Kademlia Distributed Hash Table (DHT) protocol, enabling decentralized communication and complicating efforts to detect and disrupt its command-and-control (C2) infrastructure. By March 2026, the botnet had expanded to over 14,000 infected devices, with approximately 60% located in the United States. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-kadnap-botnet-hijacks-asus-routers-to-fuel-cybercrime-proxy-network/?utm_source=openai)) The emergence of KadNap underscores a growing trend of sophisticated malware leveraging decentralized protocols to enhance resilience against traditional network monitoring and takedown efforts. This incident highlights the critical need for robust security measures in consumer-grade networking equipment, as such devices are increasingly exploited to facilitate large-scale cybercriminal operations.
6 months ago
Kill Chain
CISA Adds SolarWinds, Ivanti, and Workspace One Vulnerabilities to KEV Catalog
In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. These include CVE-2021-22054, a server-side request forgery in Omnissa Workspace One UEM; CVE-2025-26399, a deserialization flaw in SolarWinds Web Help Desk; and CVE-2026-1603, an authentication bypass in Ivanti Endpoint Manager. Exploitation of these vulnerabilities allows unauthorized access to sensitive information and remote code execution on affected systems. ([thehackernews.com](https://thehackernews.com/2026/03/cisa-flags-solarwinds-ivanti-and.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by unpatched software flaws. Organizations are urged to apply the necessary patches promptly to mitigate potential risks associated with these actively exploited vulnerabilities.
6 months ago
Kill Chain
BlackSanta EDR Killer: A New Threat to HR Departments in 2026
In March 2026, a sophisticated cyberattack campaign was uncovered targeting human resources (HR) departments. Russian-speaking threat actors distributed malware via spear-phishing emails containing ISO image files disguised as resumes. Upon execution, these files initiated a multi-stage infection chain, culminating in the deployment of 'BlackSanta,' an Endpoint Detection and Response (EDR) killer. BlackSanta disabled security solutions by terminating antivirus processes, shutting down EDR agents, and suppressing system logging, allowing attackers to exfiltrate sensitive data undetected. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blacksanta-edr-killer-spotted-targeting-hr-departments/?utm_source=openai)) This incident underscores a growing trend of cybercriminals exploiting HR workflows to infiltrate organizations. The use of advanced evasion techniques, such as steganography and DLL sideloading, highlights the increasing sophistication of these attacks. Organizations must enhance security measures within HR processes to mitigate such threats. ([darkreading.com](https://www.darkreading.com/threat-intelligence/blacksanta-edr-killer-hr-workflows?utm_source=openai))
6 months ago
Kill Chain
Microsoft SharePoint 2025 ToolShell Zero-Day Exploitation
In July 2025, a critical zero-day vulnerability, CVE-2025-53770, was discovered in Microsoft SharePoint, allowing unauthenticated remote code execution. Dubbed 'ToolShell,' this exploit enabled attackers to gain full control over affected servers, leading to data exfiltration and deployment of ransomware. The vulnerability stemmed from an incomplete fix of a 2020 issue, CVE-2020-1147, and was actively exploited by Chinese state-affiliated groups, including Storm-2603, Linen Typhoon, and Violet Typhoon. Over 400 organizations worldwide, including U.S. federal agencies and the National Nuclear Security Administration, were compromised. Microsoft released emergency patches for SharePoint Server 2019 and SharePoint Subscription Edition, but SharePoint Enterprise Server 2016 remained unpatched at the time. Organizations were urged to apply patches, rotate machine keys, and implement additional security measures to mitigate the threat. ([windowscentral.com](https://www.windowscentral.com/software-apps/were-witnessing-an-urgent-and-active-threat-microsoft-sharepoint-toolshell-vulnerability-is-being-attacked-globally?utm_source=openai)) This incident underscores the escalating risk of zero-day vulnerabilities and the rapid exploitation timelines by sophisticated threat actors. The 'ToolShell' attacks highlight the critical need for organizations to maintain vigilant patch management, continuous monitoring, and robust incident response strategies to defend against evolving cyber threats.
6 months ago
Kill Chain
APT28's Stealthy Cyber-Espionage Tactics Target Ukrainian Military in 2026
In April 2024, the Russian state-sponsored hacking group APT28 initiated a cyber-espionage campaign targeting Ukrainian military personnel. Utilizing spear-phishing messages sent via the Signal messaging app, attackers distributed malicious Microsoft Word documents embedded with macros. Once enabled, these macros triggered a multi-stage infection chain, deploying the COVENANT framework and the BEARDSHELL backdoor. The malware leveraged legitimate cloud services like Icedrive and Koofr for command-and-control communications, facilitating long-term surveillance and data exfiltration. ([thehackernews.com](https://thehackernews.com/2026/03/apt28-uses-beardshell-and-covenant.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored actors, who increasingly exploit trusted platforms and sophisticated obfuscation techniques to evade detection. The use of legitimate cloud services for command-and-control highlights the challenges in distinguishing malicious activity from normal network traffic, emphasizing the need for advanced threat detection mechanisms. ([scworld.com](https://www.scworld.com/news/fancy-bear-attacks-abuse-office-macros-legitimate-cloud-services?utm_source=openai))
6 months ago
Kill Chain
LeakyLooker Vulnerabilities: A Wake-Up Call for Cloud Security
In March 2026, Tenable Research disclosed nine critical cross-tenant vulnerabilities, collectively termed 'LeakyLooker,' in Google Looker Studio. These flaws allowed attackers to execute arbitrary SQL queries on victims' databases, leading to potential data exfiltration, insertion, and deletion across Google Cloud Platform (GCP) services. The vulnerabilities affected organizations utilizing connectors such as Google Sheets, BigQuery, Spanner, PostgreSQL, MySQL, and Cloud Storage. Google addressed these issues following responsible disclosure in June 2025. The 'LeakyLooker' vulnerabilities underscore the evolving threat landscape in cloud environments, highlighting the necessity for robust security measures and continuous monitoring. Organizations must remain vigilant against cross-tenant vulnerabilities to safeguard sensitive data and maintain compliance with industry standards.
6 months ago
Kill Chain
FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials
In early 2026, threat actors exploited vulnerabilities and weak credentials in FortiGate Next-Generation Firewall (NGFW) appliances to breach networks across healthcare, government, and managed service providers. By accessing these devices, attackers extracted configuration files containing service account credentials and network topology information, enabling unauthorized access to Active Directory environments and the enrollment of rogue workstations. The breaches were detected during lateral movement phases, preventing further escalation. ([sentinelone.com](https://www.sentinelone.com/blog/fortigate-edge-intrusions/?utm_source=openai)) This incident underscores the critical importance of securing network infrastructure devices, as their compromise can lead to significant data breaches and operational disruptions. The exploitation of such devices highlights the evolving tactics of threat actors targeting essential security appliances to gain deeper access into organizational networks. ([sentinelone.com](https://www.sentinelone.com/blog/fortigate-edge-intrusions/?utm_source=openai))
6 months ago
Kill Chain
Odido's 2026 Data Breach: A Case Study in Social Engineering Attacks
In February 2026, Dutch telecom provider Odido experienced a significant data breach affecting over 6 million customer accounts. Attackers employed social engineering tactics, including phishing emails and impersonation of IT staff, to gain unauthorized access to Odido's customer relationship management system. This breach exposed sensitive personal information such as names, addresses, telephone numbers, bank account details, dates of birth, and government-issued ID numbers. The incident underscores the critical need for robust employee training and advanced security measures to prevent similar attacks. ([cybernews.com](https://cybernews.com/security/odido-hackers-phishing-attack/?utm_source=openai)) This breach highlights a growing trend of cybercriminals leveraging sophisticated social engineering techniques to infiltrate organizations. As these methods become more prevalent, companies must enhance their security protocols and employee awareness programs to mitigate the risk of such attacks.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports