Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 174 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2077–2088 / 3786 reports
Chinese APT GopherWhisper Exploits Cloud Services in Mongolian Cyber Espionage
Government Administration6 months ago

Chinese APT GopherWhisper Exploits Cloud Services in Mongolian Cyber Espionage

In April 2026, ESET researchers uncovered a Chinese advanced persistent threat (APT) group named GopherWhisper targeting Mongolian government institutions. Active since at least November 2023, GopherWhisper deployed multiple custom backdoors—LaxGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor—each utilizing different cloud services like Slack, Discord, Microsoft Outlook, and file.io for command-and-control communications and data exfiltration. This campaign compromised at least 12 systems within a Mongolian governmental institution, with indications of broader impact across the region. This incident underscores a growing trend of APT groups leveraging legitimate cloud services to evade detection and maintain persistent access. Organizations must enhance their monitoring of cloud-based communications and implement robust security measures to detect and mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Anthropic's Claude Code Memory Vulnerability: A Wake-Up Call for AI Security
Computer Software/Engineering6 months ago

Anthropic's Claude Code Memory Vulnerability: A Wake-Up Call for AI Security

In March 2026, Cisco researchers identified a critical vulnerability in Anthropic's Claude Code AI coding assistant, where compromised memory files allowed attackers to persistently infect projects and sessions. This flaw enabled the insertion of hard-coded secrets into production code, selection of insecure packages, and propagation of these changes to other development team members. Anthropic has since addressed the issue, but the incident underscores the inherent risks associated with AI memory files and context data. The exploitation of AI memory files highlights a growing trend where attackers target the persistent state of AI systems to manipulate outputs and maintain unauthorized access. This incident serves as a cautionary tale for organizations integrating AI tools, emphasizing the need for robust security measures to protect against such vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Zealot AI: A Glimpse into Autonomous Cloud Attacks
Financial Services6 months ago

Zealot AI: A Glimpse into Autonomous Cloud Attacks

In April 2026, Palo Alto Networks' Unit 42 unveiled 'Zealot,' an AI-driven, multi-agent system capable of autonomously executing end-to-end cloud attacks. In a controlled environment, Zealot rapidly identified and exploited vulnerabilities within a misconfigured Google Cloud Platform, achieving data exfiltration in mere minutes. This proof-of-concept underscores the potential for AI to accelerate cyberattacks beyond human response capabilities. The demonstration highlights the urgent need for organizations to enhance their security postures. As AI technologies evolve, they not only offer defensive advantages but also equip adversaries with tools to conduct swift and sophisticated attacks, emphasizing the importance of proactive and automated defense mechanisms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft Releases Emergency Patch for Critical ASP.NET Core Vulnerability CVE-2026-40372
Computer Software/Engineering6 months ago

Microsoft Releases Emergency Patch for Critical ASP.NET Core Vulnerability CVE-2026-40372

In April 2026, Microsoft identified a critical vulnerability (CVE-2026-40372) in ASP.NET Core's Data Protection API, which could allow unauthenticated attackers to escalate privileges to SYSTEM level by forging authentication cookies. This flaw, present in versions 10.0.0 through 10.0.6, stemmed from improper verification of cryptographic signatures, enabling attackers to bypass authentication mechanisms and gain unauthorized access to sensitive data. Microsoft promptly released an out-of-band update (version 10.0.7) to address this issue and advised users to update their systems immediately. This incident underscores the importance of timely patch management and vigilance in monitoring for security updates. The rapid response by Microsoft highlights the evolving nature of software vulnerabilities and the necessity for organizations to stay informed about potential threats to maintain robust security postures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Harvester's Linux GoGra Backdoor Exploits Microsoft Graph API
Telecommunications6 months ago

Harvester's Linux GoGra Backdoor Exploits Microsoft Graph API

In April 2026, the state-sponsored Harvester group deployed a Linux variant of its GoGra backdoor, utilizing the Microsoft Graph API and Outlook mailboxes for covert command-and-control communications. This sophisticated malware exploits legitimate Microsoft infrastructure to evade detection, targeting telecommunications, government, and IT organizations in South Asia. The Linux GoGra backdoor shares significant code similarities with its Windows counterpart, indicating a concerted effort by Harvester to expand its cross-platform capabilities. The emergence of this Linux variant underscores a growing trend among threat actors to develop multi-platform malware that leverages trusted cloud services for stealthy operations. Organizations must enhance their monitoring of cloud API interactions and implement robust security measures to detect and mitigate such advanced threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Attacks
Government Administration6 months ago

Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Attacks

In April 2026, Microsoft disclosed a spoofing vulnerability (CVE-2026-32201) in SharePoint Server, affecting versions 2016, 2019, and Subscription Edition. This flaw allows unauthenticated attackers to perform network-based spoofing attacks due to improper input validation. Despite the release of patches on April 14, over 1,300 internet-exposed SharePoint servers remain unpatched, leaving organizations vulnerable to unauthorized access and data manipulation. The continued exploitation of CVE-2026-32201 underscores the critical need for timely patch management. Organizations must prioritize updating their SharePoint servers to mitigate potential breaches and maintain data integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Critical npm Supply Chain Attack Exposes Developer Credentials
Computer Software/Engineering6 months ago

Critical npm Supply Chain Attack Exposes Developer Credentials

In April 2026, a sophisticated supply chain attack targeted the Node Package Manager (npm) ecosystem, compromising multiple packages from Namastex Labs, a company specializing in AI-based solutions. The attackers injected malicious code into these packages, enabling the theft of developer credentials, API keys, SSH keys, and other sensitive data. The malware exhibited worm-like behavior by identifying npm publishing tokens on compromised systems and propagating itself by injecting malicious code into other packages that the stolen tokens could access, leading to a rapid spread across the npm ecosystem. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems. The attackers' ability to compromise trusted packages and leverage them to distribute malware highlights the critical need for enhanced security measures in software development pipelines. Organizations must prioritize the implementation of robust security practices, including regular audits of dependencies, strict access controls, and continuous monitoring, to mitigate the risks associated with such attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Inside Caller-as-a-Service Fraud: The Scam Economy Has a Hiring Process
Banking/Mortgage6 months ago

Inside Caller-as-a-Service Fraud: The Scam Economy Has a Hiring Process

In April 2026, cybersecurity researchers uncovered a sophisticated 'Caller-as-a-Service' (CaaS) fraud operation, where cybercriminals have structured their activities to mirror legitimate call centers. These operations involve specialized roles such as malware developers, phishing kit builders, infrastructure operators, and scam callers, all working in concert to execute large-scale social engineering attacks. This professionalization has led to a significant increase in the efficiency and impact of fraudulent phone calls, resulting in substantial financial losses and emotional distress for victims. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-caller-as-a-service-fraud-the-scam-economy-has-a-hiring-process/?utm_source=openai)) The emergence of CaaS highlights a critical evolution in cybercrime, emphasizing the need for enhanced security measures and public awareness. As these fraudulent operations become more organized and effective, individuals and organizations must adopt proactive strategies to detect and prevent such sophisticated social engineering attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Mirai Botnet Exploits D-Link Router Vulnerability CVE-2025-29635
Telecommunications6 months ago

Mirai Botnet Exploits D-Link Router Vulnerability CVE-2025-29635

In March 2026, Akamai's Security Intelligence and Response Team (SIRT) identified active exploitation of CVE-2025-29635, a command injection vulnerability in D-Link DIR-823X routers, by a new Mirai-based malware campaign. Attackers are sending POST requests to the vulnerable endpoint, executing remote commands to download and install a Mirai variant named "tuxnokill," which enables the compromised devices to perform distributed denial-of-service (DDoS) attacks. This marks the first observed in-the-wild exploitation of this vulnerability since its disclosure in March 2025. ([akamai.com](https://www.akamai.com/blog/security-research/cve-2025-29635-mirai-campaign-targets-d-link-devices?utm_source=openai)) The exploitation of end-of-life (EoL) devices underscores the critical need for organizations to replace outdated hardware and apply security patches promptly. The resurgence of Mirai variants targeting unpatched IoT devices highlights the ongoing threat posed by botnets leveraging known vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-mirai-campaign-exploits-rce-flaw-in-eol-d-link-routers/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Kyber Ransomware's 2026 Attacks: A New Era of Post-Quantum Encryption Threats
Defense/Space6 months ago

Kyber Ransomware's 2026 Attacks: A New Era of Post-Quantum Encryption Threats

In March 2026, the Kyber ransomware group launched attacks targeting Windows systems and VMware ESXi endpoints. The Windows variant, written in Rust, implemented Kyber1024 post-quantum encryption for key protection, while the ESXi variant utilized ChaCha8 for file encryption and RSA-4096 for key wrapping. Both variants shared the same campaign ID and Tor-based ransom infrastructure, indicating coordinated efforts to maximize impact by encrypting all servers simultaneously. The attacks led to significant operational disruptions, particularly affecting a multi-billion-dollar American defense contractor and IT services provider. The adoption of post-quantum cryptographic techniques by ransomware operators marks a significant evolution in cyber threats, highlighting the need for organizations to stay ahead of emerging encryption methods used by adversaries. This incident underscores the importance of robust cybersecurity measures and continuous monitoring to detect and mitigate such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CanisterWorm: A Self-Propagating Supply Chain Attack on the npm Ecosystem
Computer Software/Engineering6 months ago

CanisterWorm: A Self-Propagating Supply Chain Attack on the npm Ecosystem

In April 2026, a sophisticated supply chain attack targeted the npm ecosystem, compromising multiple packages to deploy a self-propagating worm known as CanisterWorm. The attack began with the exploitation of a GitHub Actions misconfiguration in the Trivy vulnerability scanner, allowing the threat group TeamPCP to steal a Personal Access Token (PAT). This token was used to publish malicious versions of Trivy, which, when installed, harvested sensitive credentials including npm authentication tokens. The worm then utilized these stolen tokens to automatically publish infected versions of other packages accessible with the compromised credentials, facilitating rapid and widespread propagation across the npm ecosystem. ([anuragnandi.com](https://www.anuragnandi.com/blog/npm-supply-chain-attack-canisterworm-2026?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the need for enhanced security measures in package management and CI/CD pipelines. The use of decentralized command-and-control infrastructure, as seen with CanisterWorm's utilization of an Internet Computer Protocol (ICP) canister, presents new challenges in threat mitigation and emphasizes the importance of adopting zero-trust principles and robust monitoring practices to safeguard against such evolving threats. ([anuragnandi.com](https://www.anuragnandi.com/blog/npm-supply-chain-attack-canisterworm-2026?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Checkmarx Supply Chain Breach: Malicious KICS Docker Images and VS Code Extensions Detected
Computer Software/Engineering6 months ago

Checkmarx Supply Chain Breach: Malicious KICS Docker Images and VS Code Extensions Detected

In April 2026, Checkmarx's supply chain was compromised when attackers uploaded malicious images to the official 'checkmarx/kics' Docker Hub repository. These images, including versions v2.1.20 and a fraudulent v2.1.21, contained modified KICS binaries with unauthorized data collection and exfiltration capabilities. Additionally, certain Visual Studio Code extensions were altered to execute remote code without user consent. Organizations using these compromised tools to scan infrastructure-as-code files risked exposing sensitive credentials and configurations. ([thehackernews.com](https://thehackernews.com/2026/04/malicious-kics-docker-images-and-vs.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools. It highlights the necessity for organizations to implement stringent security measures, such as verifying the integrity of third-party software and continuously monitoring for unauthorized modifications, to safeguard against similar vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports