Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 185 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2209–2220 / 3786 reports
Hims & Hers Data Breach: Lessons in Third-Party Security
Outsourcing/Offshoring7 months ago

Hims & Hers Data Breach: Lessons in Third-Party Security

In early February 2026, telehealth company Hims & Hers Health experienced a data breach when unauthorized individuals accessed support tickets through their third-party customer service platform, Zendesk. The breach, occurring between February 4 and February 7, exposed personal information such as names and contact details of customers. Importantly, no medical records or doctor communications were compromised. The company promptly secured the platform and initiated an investigation upon discovering the suspicious activity on February 5. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hims-and-hers-warns-of-data-breach-after-zendesk-support-ticket-breach/?utm_source=openai)) This incident underscores the vulnerabilities associated with third-party service providers and the critical need for robust security measures. As cyber threats targeting support systems increase, organizations must enhance their security protocols to protect sensitive customer data and maintain trust.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
North Korean Hackers Deploy 1,700 Malicious Packages in Unprecedented Supply Chain Attack
Computer Software/Engineering7 months ago

North Korean Hackers Deploy 1,700 Malicious Packages in Unprecedented Supply Chain Attack

In early April 2026, North Korean state-sponsored hackers, identified as the Contagious Interview group, executed a sophisticated supply chain attack by publishing over 1,700 malicious packages across multiple open-source ecosystems, including npm, PyPI, Go, Rust, and PHP. These packages impersonated legitimate developer tools but functioned as malware loaders, deploying platform-specific payloads capable of data theft and remote access. The attack underscores the persistent threat to software supply chains and the need for vigilant security practices among developers and organizations. ([thehackernews.com](https://thehackernews.com/2026/04/n-korean-hackers-spread-1700-malicious.html?utm_source=openai)) This incident highlights a concerning trend of state-sponsored actors targeting open-source ecosystems to infiltrate developer environments. The scale and coordination of this attack demonstrate the evolving tactics of threat actors and the critical importance of securing software supply chains to prevent widespread compromise.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
APT28's PRISMEX Malware Campaign: A 2026 Cyber-Espionage Threat
Government Administration7 months ago

APT28's PRISMEX Malware Campaign: A 2026 Cyber-Espionage Threat

In early 2026, the Russian state-sponsored group APT28 (also known as Fancy Bear and Pawn Storm) initiated a sophisticated cyber-espionage campaign targeting Ukraine and its NATO allies. The operation employed a newly developed malware suite named PRISMEX, which utilizes advanced steganography, Component Object Model (COM) hijacking, and the exploitation of legitimate cloud services for command-and-control (C2) communications. The campaign began in September 2025 and intensified in January 2026, focusing on sectors such as defense, emergency services, and logistics across multiple countries, including Poland, Romania, Slovenia, Turkey, Slovakia, and the Czech Republic. ([thehackernews.com](https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html?utm_source=openai)) This campaign underscores the rapid weaponization of newly disclosed vulnerabilities by APT28, notably CVE-2026-21509 and CVE-2026-21513, to infiltrate target systems. The use of PRISMEX highlights a strategic shift towards more covert and resilient attack methodologies, posing significant challenges for detection and mitigation. ([thehackernews.com](https://thehackernews.com/2026/04/apt28-deploys-prismex-malware-in.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Anthropic's Claude Mythos AI Model Uncovers Critical Software Vulnerabilities
Computer Software/Engineering7 months ago

Anthropic's Claude Mythos AI Model Uncovers Critical Software Vulnerabilities

In April 2026, Anthropic unveiled its advanced AI model, Claude Mythos, which autonomously identified thousands of high-severity vulnerabilities across major operating systems and web browsers. This unprecedented capability led to the launch of Project Glasswing, a collaborative initiative with tech giants like Amazon, Apple, and Microsoft, aiming to address these security flaws before potential exploitation. The discovery of such extensive vulnerabilities underscores the critical need for proactive cybersecurity measures in the face of rapidly advancing AI technologies. As AI models become more sophisticated, they present both opportunities for enhancing security and risks of being weaponized by malicious actors. Organizations must stay vigilant and adapt their defenses to counteract these evolving threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Chaos Malware's New Variant Exploits Cloud Misconfigurations in 2026
Information Technology/IT7 months ago

Chaos Malware's New Variant Exploits Cloud Misconfigurations in 2026

In March 2026, cybersecurity researchers identified a new variant of the Chaos malware targeting misconfigured cloud deployments, particularly 64-bit Linux servers. Previously known for compromising routers and edge devices, this evolution signifies a strategic shift by attackers to exploit cloud infrastructure vulnerabilities. The malware gains access through misconfigurations, establishes persistence via systemd services, and introduces a SOCKS5 proxy feature, enabling attackers to route malicious traffic through compromised servers. This development underscores the critical need for organizations to secure cloud environments against evolving threats. The inclusion of proxy capabilities in Chaos malware reflects a broader trend of botnets expanding functionalities beyond traditional DDoS attacks, facilitating more complex cybercriminal activities. This shift highlights the importance of robust security configurations and continuous monitoring in cloud deployments to mitigate emerging risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
GrafanaGhost: Unveiling the AI Vulnerability Exposing Enterprise Data
Information Technology/IT7 months ago

GrafanaGhost: Unveiling the AI Vulnerability Exposing Enterprise Data

In April 2026, a critical vulnerability named 'GrafanaGhost' was discovered in Grafana's AI components, allowing attackers to exfiltrate sensitive enterprise data through indirect prompt injection. By embedding malicious instructions within external web content, attackers could manipulate Grafana's AI to process these prompts as legitimate, leading to unauthorized data exposure without user interaction. This flaw was promptly patched by Grafana following responsible disclosure. The GrafanaGhost incident underscores the growing risks associated with integrating AI into enterprise systems. It highlights the necessity for robust security measures to prevent AI-specific vulnerabilities, as attackers increasingly exploit such weaknesses to access sensitive information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Understanding the Rise of Web Shell Attacks in 2026
Computer Software/Engineering7 months ago

Understanding the Rise of Web Shell Attacks in 2026

In early 2026, a significant surge in web shell attacks was observed, targeting vulnerabilities in web servers and applications. Attackers exploited these weaknesses to deploy malicious scripts, enabling remote control over compromised systems. This escalation led to unauthorized data access, service disruptions, and substantial financial losses for affected organizations. The rapid deployment and stealthy nature of web shells posed significant challenges to traditional security measures. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/02/cookie-controlled-php-webshells-tradecraft-linux-hosting-environments/?utm_source=openai)) This trend underscores the evolving tactics of cyber adversaries, emphasizing the need for enhanced monitoring and proactive defense strategies. Organizations must prioritize the detection and mitigation of web shell threats to safeguard their digital assets and maintain operational integrity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Driven Ransomware Attack 2026: Lessons Learned
Financial Services7 months ago

AI-Driven Ransomware Attack 2026: Lessons Learned

In early 2026, a sophisticated AI-driven ransomware attack targeted multiple organizations, exploiting vulnerabilities in AI systems to gain unauthorized access. The attackers utilized autonomous AI agents to conduct reconnaissance, escalate privileges, and deploy ransomware, significantly reducing the time from initial breach to full system encryption. This rapid progression left organizations with minimal time to detect and respond, resulting in substantial operational disruptions and financial losses. This incident underscores the escalating threat posed by AI-enhanced cyberattacks, highlighting the need for organizations to adopt advanced, AI-driven defense mechanisms. The convergence of AI and cybercrime necessitates a proactive approach to cybersecurity, emphasizing rapid detection, response, and recovery strategies to mitigate the impact of such attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
LiteLLM Supply Chain Compromise: A Wake-Up Call for Open-Source Security
Computer Software/Engineering7 months ago

LiteLLM Supply Chain Compromise: A Wake-Up Call for Open-Source Security

In March 2026, the LiteLLM Python package, widely used for routing large language model (LLM) API calls, was compromised through a supply chain attack. Malicious versions 1.82.7 and 1.82.8 were uploaded to the Python Package Index (PyPI) after attackers gained access to the maintainer's credentials via a compromised Trivy security scanner in LiteLLM's CI/CD pipeline. These versions contained a credential-stealing payload that executed automatically on Python startup, exfiltrating sensitive information such as SSH keys, cloud provider credentials, and Kubernetes secrets to an attacker-controlled server. The malicious packages were available for approximately three hours before being removed from PyPI. ([snyk.io](https://snyk.io/blog/poisoned-security-scanner-backdooring-litellm/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid propagation of malicious code through widely used packages highlights the need for enhanced security measures in software development pipelines, including stringent credential management, regular security audits, and the implementation of tools like Software Bill of Materials (SBOMs) and SigStore for verifying package integrity. ([ionix.io](https://www.ionix.io/threat-center/litellm-supply-chain-compromise-backdoored-pypi-packages-1-82-7-1-82-8/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FBI's 2025 Internet Crime Report: A 26% Surge in Cybercrime Losses
Health Care / Life Sciences7 months ago

FBI's 2025 Internet Crime Report: A 26% Surge in Cybercrime Losses

In 2025, the FBI's Internet Crime Complaint Center (IC3) reported a significant surge in cybercrime, with total losses reaching $20.9 billion—a 26% increase from the previous year. The center received over one million complaints, marking a 17% rise compared to 2024. Investment-related fraud led to losses of nearly $8.65 billion, while business email compromise accounted for almost $3.05 billion. Phishing remained the most reported cybercrime, followed by extortion and personal data breaches. ([cyberscoop.com](https://cyberscoop.com/fbi-internet-crime-complaint-center-annual-cybercrime-report/?utm_source=openai)) This escalation underscores the growing sophistication of cybercriminals, who are increasingly leveraging artificial intelligence to enhance their attacks. The trend highlights the urgent need for organizations to bolster their cybersecurity measures and stay vigilant against evolving threats. ([forbes.com](https://www.forbes.com/sites/timkeary/2026/04/07/fbi-reports-208-billion-lost-to-cybercrime-as-hackers-turn-to-ai/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Anthropic's Project Glasswing: Revolutionizing Cybersecurity with AI
Computer Software/Engineering7 months ago

Anthropic's Project Glasswing: Revolutionizing Cybersecurity with AI

In April 2026, Anthropic launched Project Glasswing, a collaborative initiative with major technology companies including Amazon, Apple, Microsoft, and Cisco, to enhance cybersecurity defenses using advanced AI. Central to this project is Claude Mythos Preview, an unreleased AI model that has identified thousands of previously undetected vulnerabilities across critical software systems, including a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg. To mitigate potential misuse, Anthropic has restricted access to this powerful model to select partners and has committed significant resources to support open-source security organizations. ([anthropic.com](https://www.anthropic.com/project/glasswing?utm_source=openai)) This initiative underscores the growing importance of AI in cybersecurity, highlighting both its potential to fortify defenses and the risks associated with its misuse. As AI capabilities advance, the industry faces the dual challenge of leveraging these tools for protection while preventing their exploitation by malicious actors. ([cyberscoop.com](https://cyberscoop.com/project-glasswing-anthropic-ai-open-source-software-vulnerabilities/?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Forest Blizzard 2026: Unveiling and Neutralizing a Global Espionage Threat
Government Administration7 months ago

Forest Blizzard 2026: Unveiling and Neutralizing a Global Espionage Threat

In early 2026, the Russian state-sponsored group Forest Blizzard (APT28) compromised over 18,000 routers across 120 countries, exploiting known vulnerabilities in TP-Link and MikroTik devices. By hijacking DNS settings, they conducted adversary-in-the-middle attacks, intercepting credentials and tokens for services like Microsoft Outlook Web Access. This extensive espionage campaign targeted more than 200 organizations, including government agencies and critical infrastructure sectors. A collaborative effort led by the FBI, known as Operation Masquerade, successfully neutralized the threat by resetting DNS settings and preventing further exploitation. This incident underscores the persistent threat posed by state-sponsored cyber actors and highlights the critical need for robust network security measures. Organizations must remain vigilant, regularly update and patch network devices, and implement comprehensive monitoring to detect and mitigate such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports