Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 172 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2053–2064 / 3786 reports
Sentencing in $230M Cryptocurrency Heist Highlights Social Engineering Threats
Financial Services6 months ago

Sentencing in $230M Cryptocurrency Heist Highlights Social Engineering Threats

In April 2026, Evan Tangeman, a 22-year-old from Newport Beach, California, was sentenced to 70 months in prison for laundering at least $3.5 million in stolen cryptocurrency. This was part of a larger criminal enterprise that, between October 2023 and May 2025, stole over $263 million through social engineering tactics, including impersonating customer support to gain access to victims' cryptocurrency wallets. The stolen funds financed extravagant lifestyles, with expenditures on luxury cars, high-end real estate, and lavish parties. ([justice.gov](https://www.justice.gov/usao-dc/pr/california-money-launderer-sentenced-dc-70-months-role-scheme-stole-263-million?utm_source=openai)) This case underscores the growing sophistication of cybercriminals in exploiting social engineering techniques to execute large-scale financial thefts. It highlights the urgent need for enhanced security measures and user education to prevent such attacks, especially as the cryptocurrency market continues to expand and attract both legitimate investors and malicious actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Deepfake Voice Attacks: The Rising Threat in 2025
Financial Services6 months ago

Deepfake Voice Attacks: The Rising Threat in 2025

In March 2025, a finance director at a multinational firm in Singapore participated in a Zoom call with individuals appearing as her senior leadership team, including the CFO. Unbeknownst to her, all participants were AI-generated deepfakes. She authorized a $499,000 transfer before the fraud was detected. This incident mirrors a 2024 attack on Arup, where $25.6 million was stolen using similar deepfake techniques. The proliferation of deepfake technology has led to a 680% increase in voice deepfake incidents in 2025, with over 100,000 attacks recorded in the United States alone. The accessibility of these tools, which require minimal audio samples and no technical expertise, underscores the urgent need for organizations to implement robust verification protocols and employee training to mitigate such sophisticated social engineering threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Navigate360 P3 Global Intel Data Breach: A Wake-Up Call for Educational Cybersecurity
Primary/Secondary Education6 months ago

Navigate360 P3 Global Intel Data Breach: A Wake-Up Call for Educational Cybersecurity

In March 2026, Navigate360's P3 Global Intel platform, an anonymous tip line used by over 30,000 schools and 5,000 public safety agencies, was reportedly breached by a hacker group known as Internet Yiff Machine. The attackers claimed to have exfiltrated approximately 93 gigabytes of data, including over 8 million law enforcement tips containing sensitive personally identifiable information (PII) of students and informants. This incident has raised significant concerns about the platform's security measures and the anonymity it promises to its users. The breach underscores the growing trend of cyberattacks targeting educational institutions, which have become increasingly frequent and sophisticated. The exposure of sensitive student data not only compromises individual privacy but also erodes trust in systems designed to enhance school safety. This incident highlights the urgent need for robust cybersecurity practices and compliance with data protection regulations within the education sector.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
VECT 2.0 Ransomware: A New Threat to Data Integrity
Health Care / Life Sciences6 months ago

VECT 2.0 Ransomware: A New Threat to Data Integrity

In April 2026, the VECT 2.0 ransomware emerged, targeting Windows, Linux, and ESXi systems. Due to a critical flaw in its encryption implementation, files larger than 131KB are irreversibly destroyed, rendering recovery impossible even for the attackers. This flaw effectively transforms VECT 2.0 into a data wiper rather than traditional ransomware. ([gixtools.net](https://gixtools.net/feeds/items/vect-2-0-ransomware-irreversibly-destroys-files-over-131kb-on-windows-linux-esxi/?utm_source=openai)) The incident underscores the evolving nature of cyber threats, where flawed ransomware can lead to permanent data loss. Organizations must prioritize robust backup strategies and incident response plans to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Critical Vulnerability in Hugging Face's LeRobot Exposes Systems to Remote Code Execution
Computer Software/Engineering6 months ago

Critical Vulnerability in Hugging Face's LeRobot Exposes Systems to Remote Code Execution

In April 2026, a critical vulnerability (CVE-2026-25874) was identified in Hugging Face's open-source robotics platform, LeRobot. This flaw, stemming from unsafe deserialization practices using Python's pickle module over unauthenticated gRPC channels, allows unauthenticated attackers to execute arbitrary code on both policy servers and robot clients. Exploitation can lead to full system compromise, data theft, and potential physical safety risks due to the nature of robotic operations. This incident underscores the persistent risks associated with deserializing untrusted data, especially in AI and robotics platforms. It highlights the necessity for secure coding practices, robust authentication mechanisms, and the importance of timely patching to mitigate such vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UNC6692's 'Snow' Malware: A New Era of Social Engineering Attacks
Financial Services6 months ago

UNC6692's 'Snow' Malware: A New Era of Social Engineering Attacks

In December 2025, the threat actor UNC6692 initiated a sophisticated attack combining social engineering, cloud service exploitation, and custom malware. The campaign began with a flood of spam emails to targets, followed by impersonation of IT helpdesk staff via Microsoft Teams. Victims were deceived into downloading a fake 'Mailbox Repair Utility,' which installed the 'Snow' malware suite, including Snowbelt, Snowglaze, and Snowbasin. This malware facilitated unauthorized access, credential theft, and lateral movement within enterprise networks. The attackers leveraged AWS S3 buckets for payload delivery and command-and-control infrastructure, effectively bypassing traditional security measures. ([darkreading.com](https://www.darkreading.com/cloud-security/unc6692-social-engineering-malware-cloud-abuse/?utm_source=openai)) This incident underscores the evolving tactics of cyber adversaries who exploit trusted cloud services and communication platforms to infiltrate organizations. The use of legitimate cloud infrastructure for malicious purposes highlights the need for enhanced monitoring of cloud-based activities and user education to recognize sophisticated social engineering attempts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
GlassWorm Campaign Escalates with Malicious VS Code Extensions
Computer Software/Engineering6 months ago

GlassWorm Campaign Escalates with Malicious VS Code Extensions

In April 2026, the GlassWorm campaign escalated by deploying 73 malicious Visual Studio (VS) Code extensions on the Open VSX marketplace. These extensions, initially appearing benign, were later updated to deliver self-replicating malware, compromising developer environments and potentially poisoning the software supply chain. The malware utilized techniques such as external payload retrieval and bundled native binaries, acting as thin loaders to evade detection. This approach allowed attackers to access sensitive information, including source code, credentials, and internal systems, posing significant risks to organizations relying on these tools. The resurgence of GlassWorm highlights the evolving nature of supply chain attacks, emphasizing the need for continuous monitoring of software dependencies. Organizations must implement stringent security measures, such as verifying the authenticity of extensions, auditing installed tools for recent updates, and educating developers on the risks associated with third-party software. This incident underscores the critical importance of securing the software development lifecycle to prevent widespread compromise.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Understanding the 2026 AWS Cognito Refresh Token Abuse Incident
Financial Services6 months ago

Understanding the 2026 AWS Cognito Refresh Token Abuse Incident

In March 2026, AWS updated its Threat Technique Catalog to highlight a significant security concern: the abuse of Amazon Cognito refresh tokens. Threat actors have been exploiting long-lived refresh tokens to maintain unauthorized access to AWS environments. By obtaining a valid refresh token—through methods like credential theft or compromised client-side storage—attackers can continuously generate new access and ID tokens without re-authentication, effectively establishing a persistent foothold in the system. This technique allows them to operate undetected, as the legitimate user's session remains unaffected. The default lifespan of these tokens is 30 days, but they can be configured for up to 10 years, amplifying the potential risk. ([aws-samples.github.io](https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1098.A006.html?utm_source=openai)) This incident underscores the evolving tactics of cyber adversaries who leverage legitimate cloud service functionalities to evade detection. Organizations must reassess their security postures, particularly concerning token management and monitoring, to mitigate such stealthy persistence mechanisms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Security Breach: Unauthorized Access to Anthropic's Claude Mythos AI Model
Computer Software/Engineering6 months ago

Security Breach: Unauthorized Access to Anthropic's Claude Mythos AI Model

In April 2026, Anthropic's advanced AI model, Claude Mythos, designed for cybersecurity applications, was accessed without authorization through a third-party vendor environment. The breach occurred on the same day the model was announced, with individuals from an online forum exploiting the access. Anthropic is investigating the incident and has not found evidence of broader system compromise. This incident underscores the challenges in securing powerful AI models, especially when third-party vendors are involved. It highlights the need for stringent access controls and monitoring to prevent unauthorized access to sensitive technologies.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Remote Code Execution Vulnerability in GitHub Enterprise Server (CVE-2026-3854)
Computer Software/Engineering6 months ago

Critical Remote Code Execution Vulnerability in GitHub Enterprise Server (CVE-2026-3854)

In March 2026, a critical vulnerability (CVE-2026-3854) was identified in GitHub Enterprise Server, allowing authenticated users with push access to execute arbitrary code on the server through a crafted 'git push' command. The flaw stemmed from improper sanitization of user-supplied push option values, which were incorporated into internal service headers without adequate validation. This oversight enabled attackers to inject malicious metadata fields, leading to remote code execution. GitHub promptly addressed the issue by releasing patches for affected versions, including 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, and 3.19.4. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-3854?utm_source=openai)) This incident underscores the critical importance of rigorous input validation and prompt patch management in safeguarding software supply chains. As organizations increasingly rely on platforms like GitHub for code collaboration and deployment, ensuring the security of these infrastructures is paramount to prevent potential exploitation and maintain trust in software development processes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical LiteLLM SQL Injection Vulnerability Exploited - CVE-2026-42208
Computer Software/Engineering6 months ago

Critical LiteLLM SQL Injection Vulnerability Exploited - CVE-2026-42208

In April 2026, a critical pre-authentication SQL injection vulnerability, identified as CVE-2026-42208, was discovered in LiteLLM, an open-source large-language model gateway. This flaw allowed unauthenticated attackers to send specially crafted Authorization headers to any LLM API route, enabling them to read and modify the proxy's database, including sensitive information such as API keys and provider credentials. Exploitation of this vulnerability began approximately 36 hours after its public disclosure, with attackers demonstrating targeted knowledge by directly accessing tables containing API keys, provider credentials, and configuration data. The maintainers addressed the issue by releasing LiteLLM version 1.83.7, which replaced string concatenation with parameterized queries to prevent such attacks. Organizations using LiteLLM were advised to upgrade immediately and rotate all stored credentials to mitigate potential compromises. This incident underscores the critical importance of prompt vulnerability management and the need for robust security practices in managing AI infrastructure. The rapid exploitation of CVE-2026-42208 highlights the increasing sophistication of threat actors and the necessity for organizations to stay vigilant against emerging vulnerabilities in widely used open-source tools.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
VECT 2.0 Ransomware's Flaw Turns It into a Data Wiper
Health Care / Life Sciences6 months ago

VECT 2.0 Ransomware's Flaw Turns It into a Data Wiper

In April 2026, researchers identified a critical flaw in the VECT 2.0 ransomware that causes it to irreversibly destroy files larger than 128 KB instead of encrypting them. This flaw affects Windows, Linux, and ESXi systems, rendering recovery impossible even if a ransom is paid. The VECT operators had partnered with TeamPCP, known for recent supply-chain attacks, aiming to deploy ransomware payloads in compromised environments. The flaw stems from improper handling of encryption nonces, leading to permanent data loss for larger files. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/broken-vect-20-ransomware-acts-as-a-data-wiper-for-large-files/?utm_source=openai)) This incident underscores the importance of robust backup strategies and highlights the potential for ransomware to cause irreversible damage due to coding errors. Organizations must prioritize resilience and ensure their data protection measures can withstand such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports