Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 177 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2113–2124 / 3786 reports
Microsoft Releases Emergency Updates to Resolve Windows Server April 2026 Issues
Information Technology/IT6 months ago

Microsoft Releases Emergency Updates to Resolve Windows Server April 2026 Issues

In April 2026, Microsoft released security updates for Windows Server systems, including KB5082063 for Windows Server 2025. Post-installation, administrators reported installation failures and domain controllers entering restart loops due to Local Security Authority Subsystem Service (LSASS) crashes. These issues disrupted authentication and directory services, potentially rendering domains unavailable. Microsoft responded by releasing out-of-band updates to address these problems across affected Windows Server versions. This incident underscores the critical importance of thorough testing and prompt remediation in software updates. Organizations must remain vigilant, ensuring that security patches do not inadvertently disrupt essential services, and be prepared to implement emergency updates when necessary.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Scattered Spider Leader Pleads Guilty to Multi-Million Dollar Crypto Theft
Financial Services6 months ago

Scattered Spider Leader Pleads Guilty to Multi-Million Dollar Crypto Theft

In April 2026, Tyler Robert Buchanan, a British national and alleged leader of the Scattered Spider cybercrime group, pleaded guilty in the United States to charges of wire fraud and aggravated identity theft. Between September 2021 and April 2023, Buchanan and his co-conspirators executed SMS phishing attacks targeting employees of various companies across industries such as entertainment, telecommunications, and technology. By impersonating legitimate entities, they obtained confidential information, enabling them to hijack email accounts through SIM swapping and steal over $8 million in cryptocurrency. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/british-scattered-spider-hacker-pleads-guilty-to-crypto-theft-charges/?utm_source=openai)) This case underscores the persistent threat posed by sophisticated social engineering tactics employed by cybercriminal groups like Scattered Spider. Organizations must remain vigilant against such methods, as the group's activities have led to significant financial losses and operational disruptions across multiple sectors. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-shares-tactics-of-notorious-scattered-spider-hacker-collective/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Surge in Microsoft Teams Helpdesk Impersonation Attacks in 2026
Information Technology/IT6 months ago

Surge in Microsoft Teams Helpdesk Impersonation Attacks in 2026

In April 2026, Microsoft reported a surge in cyberattacks where threat actors impersonated IT helpdesk personnel via Microsoft Teams. These attackers initiated cross-tenant chats, convincing employees to grant remote access under the guise of resolving account issues or performing security updates. Utilizing legitimate tools like Quick Assist and Rclone, they conducted reconnaissance, moved laterally across networks, and exfiltrated sensitive data to external cloud storage, effectively blending malicious activities with routine IT operations. This incident underscores a significant shift in cyberattack strategies, highlighting the exploitation of trusted collaboration platforms for social engineering. The increasing sophistication of such attacks necessitates heightened vigilance and robust security measures to protect against unauthorized access and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Gentlemen Ransomware's Strategic Use of SystemBC Botnet in April 2026
Oil/Energy/Solar/Greentech6 months ago

Gentlemen Ransomware's Strategic Use of SystemBC Botnet in April 2026

In April 2026, the Gentlemen ransomware-as-a-service (RaaS) operation was found to be utilizing the SystemBC proxy malware to enhance its attack capabilities. This collaboration led to the creation of a botnet comprising over 1,570 compromised hosts, primarily targeting corporate environments. The attackers gained initial access, escalated privileges to Domain Admin, and deployed Cobalt Strike payloads for lateral movement. They then used SystemBC to establish covert command-and-control channels, facilitating the deployment of ransomware payloads across the network. This sophisticated attack chain resulted in significant operational disruptions and data encryption for the affected organizations. The integration of SystemBC into ransomware operations signifies a concerning evolution in cybercriminal tactics, emphasizing the need for organizations to bolster their defenses against such multifaceted threats. The incident underscores the importance of comprehensive security measures, including network segmentation, regular patching, and advanced threat detection systems, to mitigate the risks posed by increasingly sophisticated ransomware campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FakeWallet Crypto Stealer: A New Threat in the Apple App Store
Financial Services6 months ago

FakeWallet Crypto Stealer: A New Threat in the Apple App Store

In March 2026, over twenty phishing apps masquerading as popular cryptocurrency wallets were discovered on the Apple App Store. These malicious applications redirected users to browser pages resembling the App Store, distributing trojanized versions of legitimate wallets designed to steal recovery phrases and private keys. Metadata indicates this campaign has been active since at least late 2025. ([securelist.com](https://securelist.com/fakewallet-cryptostealer-ios-app-store/119482/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals targeting cryptocurrency users, highlighting the need for enhanced vigilance and security measures within app marketplaces to prevent such deceptive practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical RCE Vulnerability in SGLang via Malicious GGUF Model Files
Computer Software/Engineering6 months ago

Critical RCE Vulnerability in SGLang via Malicious GGUF Model Files

In April 2026, a critical vulnerability (CVE-2026-5760) was identified in SGLang, an open-source framework for serving large language models. The flaw resides in the reranking endpoint (/v1/rerank), where unsandboxed Jinja2 template rendering allows remote code execution (RCE) when processing malicious GPT-Generated Unified Format (GGUF) model files. Exploitation enables attackers to execute arbitrary code on the server, potentially leading to data exfiltration, system manipulation, or denial-of-service attacks. ([kb.cert.org](https://kb.cert.org/vuls/id/915947?utm_source=openai)) This incident underscores the importance of secure template rendering practices in AI model serving frameworks. Organizations utilizing SGLang should promptly update to a patched version and implement recommended mitigations to prevent exploitation. ([thehackernews.com](https://thehackernews.com/2026/04/sglang-cve-2026-5760-cvss-98-enables.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Anthropic MCP Design Flaw Enables Remote Code Execution
Computer Software/Engineering6 months ago

Anthropic MCP Design Flaw Enables Remote Code Execution

In April 2026, security researchers identified a critical design flaw in Anthropic's Model Context Protocol (MCP) that enables remote code execution (RCE) across systems utilizing vulnerable MCP implementations. This systemic vulnerability affects over 7,000 publicly accessible servers and software packages with more than 150 million downloads. The flaw arises from unsafe defaults in MCP's configuration over the STDIO transport interface, allowing attackers to execute arbitrary OS commands and access sensitive data. Despite the disclosure of multiple CVEs, including CVE-2025-49596 and CVE-2026-22252, Anthropic has stated that the protocol's behavior is "expected," leaving the core issue unaddressed. ([thehackernews.com](https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html?utm_source=openai)) This incident underscores the escalating risks within the AI supply chain, as AI-powered integrations inadvertently expand the attack surface. Organizations are advised to implement mitigations such as blocking public IP access to sensitive services, monitoring MCP tool invocations, running MCP-enabled services in a sandbox, treating external MCP configuration input as untrusted, and installing MCP servers only from verified sources. ([thehackernews.com](https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Vercel's 2026 Security Breach: Lessons in Third-Party Integration Risks
Computer Software/Engineering6 months ago

Vercel's 2026 Security Breach: Lessons in Third-Party Integration Risks

In April 2026, Vercel, a prominent web infrastructure provider, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this vulnerability to gain unauthorized access to a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This intrusion led to the exposure of certain environment variables not marked as 'sensitive,' potentially affecting a limited subset of customers. Vercel has since engaged incident response experts and notified law enforcement to address the situation. ([vercel.com](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and the necessity for robust security measures. The breach highlights the importance of vigilant monitoring and management of OAuth applications to prevent unauthorized access and protect sensitive data.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Vercel's April 2026 Security Breach: Lessons in Third-Party Integration Risks
Computer Software/Engineering6 months ago

Vercel's April 2026 Security Breach: Lessons in Third-Party Integration Risks

In April 2026, Vercel, a prominent cloud platform, experienced a security breach originating from a compromised third-party AI tool, Context AI. An attacker exploited OAuth tokens from Context AI to access a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This intrusion led to unauthorized access to certain customer data, including non-sensitive environment variables such as API keys and database credentials. Vercel promptly engaged external incident response experts, notified law enforcement, and advised affected customers to rotate potentially exposed credentials. The company's open-source projects, Next.js and Turbopack, were confirmed unaffected. ([techcrunch.com](https://techcrunch.com/2026/04/20/app-host-vercel-confirms-security-incident-says-customer-data-was-stolen-via-breach-at-context-ai/?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and OAuth token management. As attackers increasingly target supply chain vulnerabilities, organizations must reassess and fortify their security postures to mitigate potential breaches stemming from trusted external tools.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the Axios npm Supply Chain Attack and Its Implications
Government Administration6 months ago

Understanding the Axios npm Supply Chain Attack and Its Implications

In late March 2026, attackers compromised the npm account of Axios's lead maintainer, publishing malicious versions 1.14.1 and 0.30.4 of the widely-used JavaScript HTTP client library. These versions included a hidden dependency, 'plain-crypto-js@4.2.1', which executed a post-install script to deploy a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The RAT connected to a command-and-control server to download platform-specific payloads, granting attackers remote control over infected machines. The malicious packages were available for approximately three hours before removal, during which they were downloaded and potentially installed by numerous developers and CI/CD pipelines. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks, particularly those targeting widely-used open-source libraries. The rapid deployment and sophisticated nature of the attack highlight the need for enhanced security measures in software development pipelines, including stringent access controls, continuous monitoring, and prompt incident response capabilities. ([infoq.com](https://www.infoq.com/news/2026/04/axios-supply-chain/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Apple Account Change Alerts Abused in Sophisticated Phishing Scheme
Financial Services6 months ago

Apple Account Change Alerts Abused in Sophisticated Phishing Scheme

In April 2026, cybercriminals exploited Apple's account change notification system to distribute phishing emails that appeared to originate from Apple's legitimate servers. These emails falsely informed recipients of an $899 iPhone purchase via PayPal and provided a phone number to cancel the transaction. The attackers manipulated the account's personal information fields to embed the phishing message, leading to the dispatch of authentic-looking emails from Apple. This tactic increased the credibility of the scam and enhanced its chances of bypassing spam filters. Victims who called the provided number were at risk of being deceived into installing remote access software or divulging sensitive financial information, potentially resulting in financial theft or data breaches. This incident underscores the evolving sophistication of phishing attacks, where threat actors leverage legitimate system features to enhance the authenticity of their scams. Organizations and individuals must remain vigilant against such tactics, as similar methods have been observed in other platforms, including Microsoft Azure Monitor alerts being abused for callback phishing attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Vercel Security Breach April 2026: Lessons in Third-Party Integration Security
Computer Software/Engineering6 months ago

Vercel Security Breach April 2026: Lessons in Third-Party Integration Security

In April 2026, Vercel, a prominent cloud development platform, disclosed a security incident involving unauthorized access to certain internal systems. The breach was traced back to a compromised third-party AI tool's Google Workspace OAuth application, which allowed attackers to infiltrate Vercel's infrastructure. A threat actor, claiming affiliation with the ShinyHunters group, alleged possession of sensitive data, including access keys, source code, and employee information, and attempted to sell this data for $2 million. Vercel has engaged incident response experts, notified law enforcement, and is actively investigating the incident. The company has advised customers to review and rotate environment variables and secrets as a precautionary measure. This incident underscores the growing risks associated with third-party integrations and the importance of securing OAuth applications. Organizations are reminded to implement robust security measures for all third-party tools and to regularly audit their access permissions to prevent similar breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports