Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 173 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2065–2076 / 3786 reports
Vimeo's Data Breach: A Cautionary Tale of Supply Chain Vulnerabilities
Entertainment/Movie Production6 months ago

Vimeo's Data Breach: A Cautionary Tale of Supply Chain Vulnerabilities

In April 2026, Vimeo disclosed a data breach resulting from a security incident at Anodot, a third-party analytics vendor. Unauthorized actors accessed certain Vimeo user and customer data, including technical data, video titles, metadata, and, in some cases, customer email addresses. The breach did not compromise video content, user login credentials, or payment information. The extortion group ShinyHunters claimed responsibility, threatening to publish the stolen data unless a ransom was paid. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/video-service-vimeo-confirms-anodot-breach-exposed-user-data/?utm_source=openai)) This incident underscores the critical importance of securing third-party integrations, as attackers increasingly exploit supply chain vulnerabilities to access sensitive data. Organizations must rigorously assess and monitor their vendors' security practices to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202
Computer Software/Engineering6 months ago

Microsoft Confirms Active Exploitation of Windows Shell CVE-2026-32202

In April 2026, Microsoft disclosed a spoofing vulnerability in Windows Shell, identified as CVE-2026-32202, with a CVSS score of 4.3. This flaw allows unauthorized attackers to perform network-based spoofing attacks, potentially leading to information disclosure. Exploitation requires user interaction, such as executing a malicious file. Microsoft addressed this vulnerability in its April Patch Tuesday update. The active exploitation of CVE-2026-32202 underscores the persistent threat posed by nation-state actors like APT28, who have previously exploited similar vulnerabilities. Organizations must remain vigilant, as attackers continually adapt their methods to bypass security measures, emphasizing the need for timely patching and robust security practices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Checkmarx 2026 LAPSUS$ Supply Chain Attack: A Detailed Analysis
Computer Software/Engineering6 months ago

Checkmarx 2026 LAPSUS$ Supply Chain Attack: A Detailed Analysis

In March 2026, application security firm Checkmarx experienced a significant security breach when the LAPSUS$ threat group exploited credentials obtained from the Trivy supply chain attack, attributed to TeamPCP. This access allowed the attackers to infiltrate Checkmarx's GitHub repositories, leading to the publication of malicious code and the subsequent leak of sensitive data. The compromised data, totaling 96GB, was later made available on both dark web and clearnet platforms. Checkmarx has confirmed that the leaked data originated from their GitHub repository and is actively investigating the incident to assess the full scope of the breach. This incident underscores the escalating threat posed by supply chain attacks, where compromising a single component can have cascading effects across multiple organizations. The Checkmarx breach highlights the critical need for robust security measures within development pipelines and the importance of securing third-party tools to prevent unauthorized access and data exfiltration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Inside an OPSEC Playbook: How Threat Actors Evade Detection
Financial Services6 months ago

Inside an OPSEC Playbook: How Threat Actors Evade Detection

In April 2026, cybersecurity researchers uncovered a detailed operational security (OPSEC) playbook authored by a threat actor specializing in high-volume carding operations. This playbook outlines a three-tier infrastructure model designed to evade detection: a public layer utilizing clean devices and rotating residential IPs, an operational layer with encrypted containers and dedicated infrastructure, and an extraction layer focused on isolated, air-gapped systems for monetization. The document also highlights common OPSEC failures, such as identity reuse and inadequate digital fingerprinting countermeasures, and recommends advanced techniques like time-delayed triggers and behavioral randomization to enhance operational resilience. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-an-opsec-playbook-how-threat-actors-evade-detection/amp/?utm_source=openai)) This revelation underscores a significant shift in cybercriminal strategies towards more structured and methodical approaches to maintain long-term operational security. For defenders, understanding these sophisticated OPSEC frameworks is crucial to developing more effective detection and mitigation strategies against evolving cyber threats.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Mandates Immediate Patching of 'BlueHammer' Vulnerability in Microsoft Defender
Government Administration6 months ago

CISA Mandates Immediate Patching of 'BlueHammer' Vulnerability in Microsoft Defender

In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) mandated that U.S. federal agencies patch a critical vulnerability in Microsoft Defender, known as 'BlueHammer' and tracked as CVE-2026-33825. This flaw allows low-privileged local attackers to escalate their privileges to SYSTEM level by exploiting insufficient access control mechanisms. The vulnerability was publicly disclosed by a researcher named 'Chaotic Eclipse' after expressing dissatisfaction with Microsoft's vulnerability disclosure process. Microsoft addressed the issue in their April 14, 2026, Patch Tuesday release. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-microsoft-defender-flaw-exploited-in-zero-day-attacks/?utm_source=openai)) The urgency of this directive underscores the increasing trend of zero-day vulnerabilities being exploited in the wild, highlighting the necessity for organizations to promptly apply security patches. The incident also brings attention to the challenges in vulnerability disclosure processes and the potential risks associated with public disclosures of unpatched vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Vercel Security Breach 2026: Context.ai OAuth Compromise
Computer Software/Engineering6 months ago

Vercel Security Breach 2026: Context.ai OAuth Compromise

In April 2026, Vercel, a cloud development platform, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this tool to gain unauthorized access to a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This intrusion led to the exposure of non-sensitive environment variables, including API keys and database credentials. The threat actor, identifying as ShinyHunters, has demanded a $2 million ransom for the stolen data. Vercel has engaged incident response experts, notified law enforcement, and advised affected customers to rotate credentials and audit deployments. The company's open-source projects, such as Next.js and Turbopack, remain unaffected. This incident underscores the critical importance of stringent third-party application security and the potential risks associated with OAuth permissions. Organizations are urged to review and tighten their third-party integrations and access controls to prevent similar supply chain attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Checkmarx KICS Supply Chain Breach: A 2026 Case Study
Computer Software/Engineering6 months ago

Checkmarx KICS Supply Chain Breach: A 2026 Case Study

In April 2026, Checkmarx's KICS analysis tool suffered a significant supply chain attack. Threat actors compromised Docker images and VS Code extensions associated with KICS, embedding malware designed to harvest sensitive data from developer environments. The malware targeted credentials such as GitHub tokens, cloud service keys, and SSH keys, exfiltrating them to domains mimicking legitimate Checkmarx infrastructure. The breach was active between April 22, 2026, 14:17:59 UTC and April 22, 2026, 15:41:31 UTC, during which malicious artifacts were distributed through official channels. This incident underscores the escalating trend of supply chain attacks targeting development tools, emphasizing the need for enhanced security measures in software distribution pipelines. Organizations must remain vigilant, as such attacks can lead to widespread credential theft and unauthorized access to critical systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerability in Breeze Cache WordPress Plugin (CVE-2026-3844)
Computer Software/Engineering6 months ago

Critical Vulnerability in Breeze Cache WordPress Plugin (CVE-2026-3844)

In April 2026, a critical vulnerability (CVE-2026-3844) was discovered in the Breeze Cache WordPress plugin, affecting versions up to 2.4.4. This flaw allows unauthenticated attackers to upload arbitrary files via the 'fetch_gravatar_from_remote' function, potentially leading to remote code execution and full site compromise. The issue is exploitable only when the 'Host Files Locally - Gravatars' feature is enabled, which is disabled by default. Cloudways, the plugin's developer, released version 2.4.5 to address this vulnerability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-exploit-file-upload-bug-in-breeze-cache-wordpress-plugin/?utm_source=openai)) The active exploitation of this vulnerability underscores the persistent targeting of WordPress plugins by threat actors. Website administrators are urged to promptly update to the latest plugin version or disable the affected feature to mitigate risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-exploit-file-upload-bug-in-breeze-cache-wordpress-plugin/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Bitwarden CLI npm Package Compromised in Supply Chain Attack
Computer Software/Engineering6 months ago

Bitwarden CLI npm Package Compromised in Supply Chain Attack

In April 2026, attackers compromised Bitwarden's CLI by uploading a malicious version (2026.4.0) to npm, available between 5:57 PM and 7:30 PM ET on April 22. The malicious package contained credential-stealing malware that harvested developer secrets, including npm tokens, GitHub authentication tokens, SSH keys, and cloud credentials. The malware exfiltrated this data by creating public GitHub repositories under the victim's account. Bitwarden confirmed the incident, stating that the breach was limited to the npm distribution channel for the CLI and did not affect end-user vault data or production systems. The company revoked compromised access, deprecated the malicious release, and initiated remediation steps immediately. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/bitwarden-cli-npm-package-compromised-to-steal-developer-credentials/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting developer tools and CI/CD pipelines. Organizations must enhance their security measures to protect against such vulnerabilities, as similar attacks have been linked to the threat actor known as TeamPCP, who previously targeted developer packages in other supply chain attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/bitwarden-cli-npm-package-compromised-to-steal-developer-credentials/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
GopherWhisper APT Exploits Go-Based Backdoors to Target Mongolian Government
Government Administration6 months ago

GopherWhisper APT Exploits Go-Based Backdoors to Target Mongolian Government

In January 2025, ESET researchers identified a previously undocumented China-aligned advanced persistent threat (APT) group named GopherWhisper targeting Mongolian governmental institutions. The group employs a suite of tools primarily written in Go, including injectors and loaders, to deploy various backdoors such as LaxGopher, RatGopher, and BoxOfFriends. GopherWhisper leverages legitimate services like Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control (C&C) communications and data exfiltration. The group's activities have been ongoing since at least November 2023, compromising at least 12 systems within a Mongolian government entity. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/04/23/3279634/0/en/ESET-Research-discovers-new-China-aligned-group-GopherWhisper-It-abuses-messaging-services-Discord-Slack-and-Outlook-to-spy.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who exploit widely used communication platforms to evade detection. The use of Go-based malware highlights a trend towards more versatile and cross-platform attack tools, posing significant challenges for traditional security measures. Organizations must adapt their defenses to address these sophisticated techniques.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Bitwarden CLI Compromised in Checkmarx Supply Chain Attack
Computer Software/Engineering6 months ago

Bitwarden CLI Compromised in Checkmarx Supply Chain Attack

In April 2026, Bitwarden's Command Line Interface (CLI) version 2026.4.0 was compromised through a supply chain attack linked to the Checkmarx campaign. Attackers exploited a GitHub Action within Bitwarden's CI/CD pipeline to inject malicious code into the npm package, specifically targeting the 'bw1.js' file. This code executed during installation, leading to the theft of sensitive information such as GitHub and npm tokens, SSH keys, environment variables, shell history, and cloud credentials. The malicious package was available between 5:57 PM and 7:30 PM ET on April 22, 2026, before being identified and removed. Bitwarden confirmed that no end-user vault data or production systems were compromised. ([community.bitwarden.com](https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting CI/CD pipelines, emphasizing the need for robust security measures in software development processes. Organizations are urged to review and fortify their CI/CD workflows to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
UNC6692's Deceptive Use of Microsoft Teams to Deploy SNOW Malware
Information Technology/IT6 months ago

UNC6692's Deceptive Use of Microsoft Teams to Deploy SNOW Malware

In April 2026, the threat group UNC6692 executed a sophisticated social engineering campaign targeting corporate employees via Microsoft Teams. By impersonating IT helpdesk staff, they convinced victims to accept chat invitations, leading to the deployment of a custom malware suite known as SNOW. This malware facilitated unauthorized access, data exfiltration, and potential ransomware deployment, significantly compromising organizational security. This incident underscores a growing trend of attackers exploiting trusted communication platforms like Microsoft Teams to bypass traditional security measures. The use of social engineering combined with custom malware highlights the need for enhanced vigilance and robust security protocols to protect against such evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports