Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Microsoft Teams Impersonation Campaign Exploits Remote Support Trust for Enterprise Access
Microsoft Threat Intelligence discovered a sophisticated social engineering campaign where threat actors impersonate IT support personnel through Microsoft Teams external collaboration to trick users into granting remote access. Once control is established via legitimate remote management tools, attackers deploy a malicious MSI package that stages a Node.js runtime and JavaScript implant for persistent command execution. The campaign progresses through extensive reconnaissance, Active Directory enumeration, and lateral movement via Windows Remote Management (WinRM) toward high-value assets including domain controllers, representing a precursor to ransomware deployment or data theft operations. This attack pattern demonstrates the evolving threat landscape where attackers leverage trusted enterprise collaboration platforms and legitimate administrative tools to bypass traditional security controls. The shift from commodity phishing to hands-on-keyboard operations targeting identity infrastructure reflects the increasing sophistication of modern threat actors seeking enterprise-wide access for high-impact cyberattacks.
2 weeks ago
Kill Chain
SANS Honeypot Captures Massive Automated Credential Attack Campaign
The SANS Internet Storm Center's Honeypot-Omaha deployment captured extensive automated credential attack campaigns targeting SSH and Telnet services. Threat actors from IP addresses associated with PPTECHNOLOGY LIMITED and other providers executed systematic brute-force attacks, successfully compromising honeypot systems through weak credentials. Once gaining access, attackers performed reconnaissance, system enumeration, and data exfiltration while attempting to cover their tracks using commands like 'rm -rf filter'. The analysis revealed over 400 file artifacts and multiple attack sessions showing coordinated botnet-style automation targeting vulnerable internet-facing services. This incident highlights the persistent threat landscape facing organizations with exposed SSH and Telnet services, demonstrating how attackers leverage automated tools and compromised infrastructure to systematically target weak authentication mechanisms across internet-connected systems.
2 weeks ago
Kill Chain
Critical Azure Privilege Escalation Flaw Exposes Hidden Risks in Cloud RBAC
In June 2026, NetSPI security researchers discovered a critical privilege escalation vulnerability in Microsoft Azure's Role-Based Access Control (RBAC) system. The vulnerability existed in the built-in 'Anyscale Platform Administrator Role' which contained unconstrained Microsoft.Authorization/roleAssignments/write permissions, allowing arbitrary escalation to Owner-level privileges without proper Attribute-Based Access Control (ABAC) restrictions. This finding highlighted broader security gaps in Azure's rapidly expanding attack surface, which now includes over 200 services, 897 built-in RBAC roles, and 22,018 different permissions. Microsoft addressed the issue within two weeks of disclosure by removing the problematic permissions from the affected role. This incident represents a critical trend in cloud security as organizations increasingly rely on complex cloud permission models that can contain hidden escalation paths, emphasizing the urgent need for granular permission auditing and zero-trust access controls in multi-cloud environments.
2 weeks ago
Kill Chain
Inside the Lazarus Group's Fake IT Worker Employment Scam: A 2024 Investigation
Security researchers from ANY.RUN conducted an extensive investigation into North Korean IT worker infiltration schemes by creating a fake company to attract fraudulent job applicants. The study revealed sophisticated operations where Lazarus Group affiliates use stolen identities, AI-generated profile photos, and elaborate cover stories to secure remote positions at legitimate organizations. These fake employees then establish persistent access to corporate networks, potentially enabling data theft, intellectual property exfiltration, and deployment of malware while generating revenue for North Korean state operations. The investigation documented multiple phases of the scam including initial contact, identity verification circumvention, and operational security measures used by the infiltrators. This represents a significant evolution in state-sponsored cyber operations, blending traditional espionage with employment fraud to achieve long-term network access and financial gain for the DPRK regime.
2 weeks ago
Kill Chain
Historic Federal Detention: Maine Teen First Minor Charged in 764 Extremist Case
In December 2024, a 17-year-old from Maine became the first minor to be federally charged and detained for crimes related to involvement in 764, a nihilistic violent extremist collective. The teenager was convicted of multiple federal crimes including conspiracy to sexually exploit children, distributing child sexual abuse material, cyberstalking, and identity theft. This case represents a significant shift in federal law enforcement policy, as authorities have historically avoided prosecuting minors for extremist activities, creating what experts called a dangerous loophole that encouraged maximum harm before age 18. This prosecution signals law enforcement's evolved approach to addressing violent online extremism that increasingly targets and recruits minors. With the FBI investigating over 500 subjects nationwide connected to 764 and affiliated groups, this case establishes precedent for holding juvenile perpetrators accountable while disrupting recruitment strategies that exploit legal protections for minors.
2 weeks ago
Kill Chain
How Law Enforcement Finally Defeated the 23-Year Sality Botnet Empire
The Sality botnet, a Russia-based peer-to-peer malware operation that infected over 11 million devices during its 23-year lifespan, was successfully dismantled in January 2025 through a coordinated effort by CrowdStrike, law enforcement agencies, and the Shadowserver Foundation. The botnet's decentralized architecture, which historically made it resilient against takedown attempts, was ultimately exploited by researchers who manipulated its peer-to-peer communication system to permanently sever operator control. The operation involved domain seizures coordinated by the FBI, Justice Department, and European authorities, marking the end of one of the longest-running criminal botnets in cybersecurity history. This takedown demonstrates the evolving capabilities of law enforcement and private security firms to dismantle sophisticated peer-to-peer botnets, signaling a shift in the cybercrime landscape where even decentralized criminal infrastructure is no longer immune to coordinated disruption efforts.
2 weeks ago
Kill Chain
Global Law Enforcement Dismantles 20-Year Sality Botnet in Coordinated Takedown
In September 2026, international law enforcement agencies including the FBI, DOJ, and European authorities successfully dismantled the Sality botnet infrastructure in a coordinated global operation. The peer-to-peer botnet, active for over two decades and controlled by the Russian cybercriminal group SALTY SPIDER, had infected more than 15,000 devices since 2003. The takedown involved seizing command and control domains across the US and Europe, while CrowdStrike's Counter Adversary Operations team executed a sinkhole operation to isolate infected machines and disrupt the botnet's communication backbone. This takedown reflects the growing effectiveness of international cybercrime cooperation and highlights the persistent threat of long-running botnets that adapt their payloads over time, most recently focusing on cryptocurrency clipjacking attacks through EggJagger malware.
2 weeks ago
Kill Chain
Russian Cybercriminal Charged in Massive Freelancer Phishing Campaign
Between June 2016 and November 2017, Russian national Searzhudin Tamirlanovich Aktulaev conducted a large-scale phishing campaign targeting freelance workers through a California-based employment platform. Using 255 fake accounts, Aktulaev sent malicious Excel attachments to 80,000 freelancers, deploying TVRAT and DarkVNC malware to gain remote access to victim systems. The malware enabled theft of e-commerce credentials and personally identifiable information, with half of all victims located in the United States. Aktulaev was arrested in Cyprus in May 2025 and extradited to face federal charges. This case demonstrates the persistent threat of credential theft operations targeting gig economy workers and the growing sophistication of Russian cybercriminals exploiting legitimate platforms for large-scale data harvesting campaigns.
2 weeks ago
Kill Chain
Critical JFrog Artifactory Flaw Enables Supply Chain Attacks Through Forged Admin Tokens
In September 2026, security researchers at watchTowr observed active exploitation of CVE-2026-82329, a critical authentication bypass vulnerability in JFrog Artifactory's default configuration. Attackers exploited this flaw to forge administrative access tokens without authentication, gaining full control over Artifactory instances used by organizations to manage software packages and artifacts. The vulnerability affected self-managed Artifactory deployments and allowed attackers to potentially poison trusted software packages, enumerate users and configurations, and compromise downstream systems that automatically pull artifacts from compromised repositories. This incident highlights the growing threat to software supply chains and the critical importance of securing development infrastructure components. As organizations increasingly rely on automated CI/CD pipelines and artifact repositories, attacks targeting these foundational systems can have cascading effects across entire development ecosystems.
2 weeks ago
Kill Chain
Active Exploitation of Sangoma Switchvox Flaw Enables Reverse Shell Attacks
Attackers are actively exploiting CVE-2026-9586, an unauthenticated SQL injection vulnerability in Sangoma Switchvox VoIP platforms that enables remote code execution. Horizon3 researchers discovered this critical flaw among 12 vulnerabilities reported in April 2026, with Sangoma releasing patches in July. Since August 2026, threat actors have systematically targeted the approximately 4,000 internet-exposed Switchvox systems, deploying reverse shells to establish persistent access and exfiltrate system information to remote command-and-control servers. This incident exemplifies the growing threat landscape targeting enterprise communication infrastructure, where VoIP systems have become prime targets for attackers seeking to establish footholds in corporate networks and potentially intercept sensitive communications.
2 weeks ago
Kill Chain
Critical WordPress Plugin Vulnerability Exposes 5 Million Sites to Complete Takeover
A critical SQL injection vulnerability (CVE-2026-19949) in the All-in-One WP Migration and Backup WordPress plugin exposed over 5 million websites to complete takeover attacks. Security researcher Jack Taylor discovered the second-order SQL injection flaw that allows unauthenticated attackers to plant malicious code through WordPress trackbacks, which executes when administrators perform routine backup operations. The vulnerability enables attackers to expose the plugin's secret import key and upload malicious archives containing executable code, potentially leading to full website compromise. While ServMask patched the issue in version 7.110 on August 20, 2026, approximately 3.25 million sites remain vulnerable as only 35% of users have updated. This incident highlights the growing trend of supply chain attacks targeting widely-used WordPress plugins, emphasizing the critical need for organizations to maintain rigorous plugin update procedures and implement comprehensive application security controls.
2 weeks ago
Kill Chain
Spring Ring Campaign: How Vishing Attacks Weaponized Microsoft Teams in 2026
Between January and April 2026, the "Spring Ring" threat operation targeted over 150 Microsoft Teams users across 10+ organizations using sophisticated voice phishing (vishing) attacks. Attackers impersonated internal IT support staff through Teams chats, then conducted voice calls to trick employees into installing remote access tools or executing malware. The most advanced variant employed NTLM relay attacks targeting domain controllers for full infrastructure compromise, demonstrating a significant evolution from traditional email phishing to real-time social engineering through trusted collaboration platforms. This incident reflects the accelerating shift toward platform-native attacks as threat actors exploit the inherent trust users place in enterprise collaboration tools. With vishing attacks doubling in the first half of 2026 according to CrowdStrike data, organizations face an urgent need to reassess security controls around identity verification and SaaS platform governance as traditional perimeter defenses prove inadequate against socially-engineered compromise vectors.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports