Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 160 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 1909–1920 / 3786 reports
Critical cPanel and WHM Vulnerabilities Require Immediate Attention
Internet6 months ago

Critical cPanel and WHM Vulnerabilities Require Immediate Attention

In May 2026, cPanel and Web Host Manager (WHM) disclosed three critical vulnerabilities: CVE-2026-29201, CVE-2026-29202, and CVE-2026-29203. These flaws allowed for arbitrary file read, code execution, and potential privilege escalation. Exploiting these vulnerabilities, attackers could gain unauthorized access to servers, compromising the security of hosted websites and data. cPanel promptly released patches to address these issues, urging users to update to the latest versions to mitigate risks. This incident underscores the persistent threat posed by software vulnerabilities in widely used web hosting platforms. The rapid exploitation of such flaws highlights the importance of timely patch management and proactive security measures to protect against unauthorized access and potential data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Former Government Contractors Convicted for Deleting Federal Databases
Government Administration6 months ago

Former Government Contractors Convicted for Deleting Federal Databases

In February 2025, twin brothers Muneeb and Sohaib Akhter, both 34 and former federal contractors, were terminated from their positions after their prior felony convictions for unauthorized access to U.S. State Department systems were discovered. Immediately following their dismissal, they accessed their employer's systems without authorization, deleting approximately 96 government databases containing sensitive information, including investigative documents and Freedom of Information Act records. They also attempted to cover their tracks by seeking guidance from an AI assistant on clearing system logs and wiping company-issued laptops before returning them. This incident underscores the critical need for stringent access controls and monitoring mechanisms to prevent insider threats, especially from individuals with prior offenses. The case highlights the potential risks associated with rehiring individuals with a history of cyber offenses and the importance of comprehensive background checks and continuous monitoring to safeguard sensitive government data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Urgent: Patch Ivanti EPMM Zero-Day Vulnerability CVE-2026-6973 Now
Government Administration6 months ago

Urgent: Patch Ivanti EPMM Zero-Day Vulnerability CVE-2026-6973 Now

In May 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch a high-severity vulnerability in Ivanti Endpoint Manager Mobile (EPMM), identified as CVE-2026-6973. This flaw allows authenticated users with administrative privileges to execute arbitrary code remotely on affected systems. Ivanti released patches for versions 12.6.1.1, 12.7.0.1, and 12.8.0.1 to address this issue. At the time of disclosure, exploitation was reported to be limited, but the potential for significant impact necessitated immediate action. The urgency of this directive underscores the critical nature of timely vulnerability management. With over 800 Ivanti EPMM appliances exposed online, unpatched systems remain susceptible to exploitation, highlighting the importance of proactive security measures in safeguarding organizational infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
NVIDIA GeForce NOW Data Breach in Armenia: What You Need to Know
Computer Games6 months ago

NVIDIA GeForce NOW Data Breach in Armenia: What You Need to Know

In early May 2026, NVIDIA confirmed a data breach affecting its GeForce NOW service in Armenia, managed by regional partner GFN.am. The breach, occurring between March 20 and 26, exposed user data including full names, email addresses, phone numbers, dates of birth, and usernames. NVIDIA's own infrastructure remained unaffected, and GFN.am has initiated notifications to impacted users. The threat actor, identified as ShinyHunters, claimed responsibility and attempted to sell the stolen data online. This incident underscores the persistent threat posed by cybercriminal groups like ShinyHunters, known for targeting high-profile organizations. It highlights the critical need for robust security measures and vigilant monitoring of third-party partnerships to safeguard user data against sophisticated cyberattacks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2025-68670: Critical Remote Code Execution Vulnerability in xrdp Server
Information Technology/IT6 months ago

CVE-2025-68670: Critical Remote Code Execution Vulnerability in xrdp Server

In December 2025, Kaspersky identified a critical remote code execution (RCE) vulnerability, CVE-2025-68670, in the xrdp server—a widely used open-source implementation of the Remote Desktop Protocol (RDP) for Linux systems. The flaw resides in the xrdp_wm_parse_domain_information function, which processes domain names during the Secure Settings Exchange phase of an RDP connection. By sending a specially crafted domain name, an unauthenticated attacker can exploit this vulnerability to execute arbitrary code on the target server, potentially leading to full system compromise. The xrdp maintainers promptly addressed the issue by releasing patches in versions 0.10.5, 0.9.27, and 0.10.4.1, accompanied by a security bulletin detailing the vulnerability and mitigation steps. This incident underscores the critical importance of regular security assessments and timely patch management, especially for widely used open-source software. Organizations relying on xrdp for remote desktop services should ensure they have applied the necessary updates to protect against potential exploitation of this vulnerability.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CallPhantom Scam: Unveiling the Deception of Fake Call History Apps
Consumer Electronics6 months ago

CallPhantom Scam: Unveiling the Deception of Fake Call History Apps

In May 2026, cybersecurity researchers uncovered a fraudulent campaign involving 28 Android applications, collectively known as 'CallPhantom,' on the Google Play Store. These apps falsely claimed to provide access to call histories, SMS records, and WhatsApp call logs for any phone number. Users were prompted to pay subscription fees, ranging from €5 to $80, only to receive randomly generated data instead of the promised information. The apps amassed over 7.3 million downloads before being removed from the store. ([eset.com](https://www.eset.com/us/about/newsroom/research/eset-research-callphantom-scam-google-play/?utm_source=openai)) This incident highlights the persistent threat of deceptive applications infiltrating official app stores, exploiting user trust, and causing financial harm. It underscores the necessity for continuous vigilance, robust app vetting processes, and user education to mitigate the risks associated with such fraudulent schemes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ShinyHunters Breach Canvas: 275 Million Users' Data Exposed
Higher Education/Acadamia6 months ago

ShinyHunters Breach Canvas: 275 Million Users' Data Exposed

In early May 2026, the cybercriminal group ShinyHunters executed a data extortion attack on Instructure's Canvas learning management system, compromising personal information of approximately 275 million users across nearly 9,000 educational institutions worldwide. The breach exposed names, email addresses, student ID numbers, and private messages between students and faculty. The attackers defaced Canvas login pages with ransom demands, leading to widespread disruptions during critical academic periods, including final exams. ([apnews.com](https://apnews.com/article/446c240d5aeb1b1a1e3795fb92237563?utm_source=openai)) This incident underscores the escalating threat of cyberattacks targeting educational platforms, highlighting the urgent need for robust cybersecurity measures in the education sector. The timing of the attack, coinciding with final exams, emphasizes the potential for significant operational impact and the importance of proactive defense strategies against such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Karakurt Ransomware Negotiator Sentenced to 102 Months in Prison
Financial Services6 months ago

Karakurt Ransomware Negotiator Sentenced to 102 Months in Prison

In May 2026, Latvian national Deniss Zolotarjovs was sentenced to 102 months in U.S. federal prison for his role as a negotiator in the Karakurt ransomware group. Operating between June 2021 and August 2023, Zolotarjovs was instrumental in extorting over 54 companies, leading to more than $56 million in losses. He employed aggressive tactics, including leveraging sensitive data such as children's health records, to pressure victims into paying ransoms. This sentencing marks a significant milestone in the fight against international cybercrime, highlighting the global reach of law enforcement agencies in apprehending and prosecuting cybercriminals. The case underscores the persistent threat posed by ransomware groups and the importance of robust cybersecurity measures to protect sensitive information.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PCPJack Malware: A New Threat to Cloud Security
Computer Software/Engineering6 months ago

PCPJack Malware: A New Threat to Cloud Security

In May 2026, cybersecurity researchers identified a sophisticated malware named PCPJack, designed to infiltrate cloud environments by exploiting exposed services and harvesting sensitive credentials. The malware initiates its attack through a 'bootstrap' module that establishes persistence and downloads additional components. It then employs a 'monitor' script to collect system metrics and exfiltrate configuration files, cloud service credentials, and cryptocurrency wallets. Notably, PCPJack targets services such as AWS, GitHub, Slack, and popular email platforms, posing significant risks to organizations' cloud infrastructures. PCPJack's unique approach includes utilizing parquet files from Common Crawl for stealthy, pre-validated target discovery, allowing it to efficiently identify and exploit vulnerable cloud services. This method underscores the evolving tactics of threat actors in leveraging open-source data for malicious purposes. The incident highlights the critical need for organizations to implement robust cloud security measures, including the use of credential vaults and multifactor authentication, to safeguard against such advanced threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical 'Dirty Frag' Vulnerability in Linux Kernel Grants Root Access
Information Technology/IT6 months ago

Critical 'Dirty Frag' Vulnerability in Linux Kernel Grants Root Access

A critical local privilege escalation (LPE) vulnerability, dubbed 'Dirty Frag,' has been identified in the Linux kernel, affecting major distributions such as Ubuntu 24.04 LTS, Amazon Linux 2023, RHEL 10.1, and SUSE 16. This flaw allows unprivileged local users to gain root access by exploiting a logic error in the kernel's cryptographic module. The vulnerability has been actively exploited in the wild, with a publicly available proof-of-concept demonstrating its reliability across affected systems. Immediate patching is essential to mitigate the risk of unauthorized system control. The disclosure of 'Dirty Frag' underscores the persistent challenges in securing widely used open-source software. Organizations must prioritize timely updates and consider implementing additional security measures, such as disabling vulnerable modules or restricting access, to protect against potential exploits targeting this and similar vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PamDOORa: A New Threat to Linux Authentication Security
Information Technology/IT6 months ago

PamDOORa: A New Threat to Linux Authentication Security

In May 2026, cybersecurity researchers uncovered a new Linux backdoor named PamDOORa, advertised on the Rehub Russian cybercrime forum for $1,600 by a threat actor known as "darkworm." PamDOORa is a Pluggable Authentication Module (PAM)-based post-exploitation toolkit that enables persistent SSH access through a magic password and specific TCP port combination. Additionally, it can harvest credentials from all legitimate users who authenticate through the compromised system. The backdoor also incorporates anti-forensic capabilities to tamper with authentication logs, effectively erasing traces of malicious activity. The emergence of PamDOORa highlights a growing trend of sophisticated Linux-based malware targeting authentication mechanisms to establish persistent access and exfiltrate sensitive credentials. This development underscores the need for organizations to implement robust monitoring and auditing of authentication processes to detect and mitigate such threats.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Critical Vulnerability in MAXHUB Pivot Client Application: CVE-2025-53704
Higher Education/Acadamia6 months ago

Critical Vulnerability in MAXHUB Pivot Client Application: CVE-2025-53704

In December 2025, a critical vulnerability (CVE-2025-53704) was identified in the MAXHUB Pivot client application versions prior to v1.36.2. This flaw involved a weak password recovery mechanism, allowing remote attackers to request password resets and gain unauthorized access to user accounts without prior authentication. The vulnerability posed significant risks, including potential data breaches and unauthorized control over affected systems. The incident underscores the importance of robust authentication mechanisms and timely software updates. Organizations are advised to upgrade to version 1.36.2 or newer to mitigate this risk. This case highlights the ongoing need for vigilance against authentication vulnerabilities in widely used applications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports