Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
STAC6565 & Gold Blade Exploit Recruitment Platforms in Canadian Ransomware Assault (2025)
Between February 2024 and August 2025, a financially-motivated threat group tracked as STAC6565 (with strong overlaps to the Gold Blade/RedCurl actor cluster) orchestrated a series of nearly 40 targeted cyberattacks, predominantly on Canadian organizations. The attackers utilized spear-phishing campaigns, delivering weaponized resumes via legitimate recruitment platforms to HR staff to gain initial access. Once inside, the group deployed a multi-stage attack chain using custom loaders and tools like RedLoader, RPivot, and Chisel, culminating in QWCrypt ransomware deployment on high-value endpoints including hypervisors. Data theft and extortion were observed, with a clear pattern of operational sophistication and periods of dormancy followed by refined attack waves. This incident highlights the increasing adoption of "hack-for-hire" models, hybrid attacks combining espionage and ransomware, and the innovative abuse of legitimate business platforms to sidestep conventional email security. Organizations globally—particularly those with HR exposures and reliance on virtualized infrastructure—face heightened risk as attackers rapidly iterate on TTPs to maximize impact and evade detection.
8 months ago
Kill Chain
GrayBravo's CastleLoader: 2025’s Multicluster MaaS Campaign Hits the Logistics Sector
In early to late 2025, the threat actor known as GrayBravo (formerly TAG-150) orchestrated multiple large-scale cyberattacks leveraging CastleLoader, a sophisticated malware loader distributed under a malware-as-a-service (MaaS) model. Four coordinated threat clusters exploited CastleLoader to compromise organizations—particularly in logistics—via phishing, malvertising, and credential harvesting. Attackers used fraudulent accounts on freight-matching platforms to enhance deception, delivering a range of information stealers and remote access trojans, including CastleRAT, RedLine Stealer, and NetSupport RAT. Multi-tiered infrastructure supported resilient operations and facilitated rapid malware deployment, leading to significant business and security disruption for targeted sectors. This incident illustrates an escalating threat trend: advanced MaaS tooling like CastleLoader rapidly proliferates across the cybercrime ecosystem, enabling both seasoned and novice criminals to launch complex, high-impact attacks. The campaign underscores attackers’ increasing industry expertise, adaptation to detection, and exploitation of legitimate business platforms to maximize credibility and impact.
8 months ago
Kill Chain
Docker Hub Credential Leak: How Over 10,000 Containers Exposed the Supply Chain
In early June 2024, security researchers discovered that over 10,000 publicly available Docker Hub container images were leaking sensitive credentials, authentication keys, and API secrets. The exposed data included valid keys for production systems, CI/CD pipelines, cloud services, and large language models. Attackers could potentially use these secrets to compromise cloud infrastructure, move laterally within enterprise environments, exfiltrate data, or execute supply chain attacks. The incident highlights the risks associated with supply chain components and improper secrets management in application build processes. This event is highly relevant as containerized workloads and DevOps toolchains continue to proliferate, making the exposure of embedded credentials a fast-growing avenue for cyberattacks. Increased regulatory scrutiny and high-profile breaches are raising awareness of the urgent need to secure supply chain assets.
8 months ago
Kill Chain
Spiderman Phishing Service: A 2024 Wakeup Call for European Banks
In early 2024, a sophisticated phishing-as-a-service platform known as Spiderman emerged, targeting customers of more than 50 European banks and cryptocurrency holders. The perpetrators leveraged pixel-perfect cloned websites and credential harvesting techniques to deceive users into divulging sensitive financial information. Attackers used advanced phishing kits capable of bypassing two-factor authentication and dynamically generating legitimate-looking web pages, resulting in significant financial losses and heightened concern among European financial institutions. This incident underscores a growing trend of increasingly accessible and effective phishing services, enabling even low-skill cybercriminals to launch large-scale, targeted attacks. Regulatory scrutiny and the evolving threat landscape demand that organizations bolster defenses against phishing service operations leveraging social engineering and real-time site cloning.
8 months ago
Kill Chain
2025 Cloud Security Breach: How AWS, Kubernetes, and AI Misconfigurations Opened the Door
In December 2025, cybersecurity investigators revealed a series of advanced attacks targeting cloud environments by exploiting common misconfigurations across AWS, AI production pipelines, and Kubernetes clusters. Threat actors leveraged identity and permissions gaps, as well as inadequate traffic segmentation, to gain initial access to cloud infrastructure without brute-forcing credentials. Once inside, they used stealthy techniques such as mimicking AI model naming conventions to mask malicious files and exploited overprivileged Kubernetes permissions to escalate privileges and take control of containers. This multifaceted approach allowed attackers to operate undetected and exfiltrate sensitive data, exposing gaps in traditional perimeter and monitoring solutions. The incident underscores a growing trend where sophisticated attackers bypass even well-known cloud security defenses by abusing legitimate service behaviors and automation. As enterprises increasingly migrate critical workloads to multicloud and AI-backed environments, these threats signal a pressing need for runtime visibility, audit logging, and zero trust architecture. Organizations must reevaluate existing security configurations to close these new attack pathways.
8 months ago
Kill Chain
.NET SOAPwn Flaw (2025): Remote Code Execution via Rogue WSDL
In December 2025, security researchers at WatchTowr Labs revealed the 'SOAPwn' vulnerability (CVE-2025-34392 and CVE-2025-13659) impacting .NET Framework applications, including Barracuda Service Center RMM and Ivanti Endpoint Manager. Exploiting unsafe Web Services Description Language (WSDL) imports and HTTP client proxies, attackers could achieve remote code execution and arbitrary file writes on affected enterprise-grade systems. The flaw enabled threat actors to upload web shells, execute PowerShell scripts, or exfiltrate NTLM credentials via rogue SMB shares, potentially compromising entire application environments. Despite responsible disclosure, Microsoft stated the vulnerability is an application-level issue, leaving many unpatched systems at risk—especially those using components now at end-of-life such as Umbraco 8. This incident underscores the widespread risks associated with dynamic SOAP and WSDL usage in legacy frameworks and highlights attackers' growing focus on exploiting insecure software supply chains and overlooked application behaviors. The public disclosure has intensified scrutiny of web service integrations and spurred new urgency around secure coding practices in software built atop widely adopted frameworks.
8 months ago
Kill Chain
How the Shai-Hulud Worm Exposed npm’s Supply-Chain Weaknesses in 2024
In May 2024, the Shai-Hulud worm re-emerged in a sophisticated supply-chain attack targeting the npm ecosystem. Attackers compromised popular npm packages to inject malicious code capable of propagating to developer environments globally. Once installed via npm, the worm enabled lateral movement, credential theft, and unauthorized access, significantly elevating the risk for organizations relying on open-source JavaScript components. Detection lag and incomplete remediation allowed the campaign to impact a broad swath of organizations and developers. This incident marks a resurgence of highly automated supply-chain malware targeting open source software, mirroring broader industry concerns around software dependencies and third-party risk. Increased attacker automation and stealthy propagation tactics underscore the critical need for vigilant dependency management and advanced detection.
8 months ago
Kill Chain
01flip Ransomware Strikes APAC Critical Infrastructure—Rust-Based Attacks Escalate
In June 2025, a financially motivated cybercrime group tracked as CL-CRI-1036 launched targeted ransomware attacks using a new cross-platform strain called 01flip—written in Rust—against select organizations in the Asia-Pacific region. Initial access appears to have been gained by exploiting known vulnerabilities in internet-facing applications, including CVE-2019-11580, followed by lateral movement and mass deployment of ransomware payloads across Windows and Linux systems. The attackers demanded payment in Bitcoin and posted evidence of stolen data on dark web forums, impacting at least one critical infrastructure operator and resulting in operational disruption and data exposure. This incident highlights the rapid evolution of ransomware, with threat actors increasingly adopting modern development languages for advanced evasion. The emergence of 01flip demonstrates the ongoing risk posed by zero-day exploitation, inadequate segmentation, and cross-platform malware, underscoring the need for organizations to prioritize proactive threat detection and incident response capabilities.
8 months ago
Kill Chain
North Korean Threat Actors Weaponize React2Shell to Deploy Stealthy EtherRAT in 2025 Supply Chain Campaign
In late 2025, North Korea-linked threat actors exploited the critical React2Shell (CVE-2025-55182) vulnerability in React Server Components to deploy an advanced remote access trojan named EtherRAT. The campaign, tracked under 'Contagious Interview', targeted blockchain and Web3 developers through sophisticated social engineering on platforms such as LinkedIn, Upwork, and GitHub. Attackers leveraged a fake recruitment ruse, ultimately delivering EtherRAT via malicious scripts. The malware exhibits persistent mechanisms across Linux environments, utilizes Ethereum smart contracts for resilient C2, and aggressively evades detection with self-updating, obfuscated payloads. This attack demonstrates how advanced actors are increasingly adapting novel supply chain and social engineering tactics to target cloud-native developer ecosystems. The incident foreshadows a shift in the threat landscape, underlining the urgent need for robust east-west traffic controls, zero trust segmentation, and advanced anomaly detection for organizations exposed to modern DevOps and open-source risks.
8 months ago
Kill Chain
CISA Flags New High-Risk Vulnerabilities in 2025 KEV Catalog
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited vulnerabilities—CVE-2025-6218 (RARLAB WinRAR Path Traversal) and CVE-2025-62221 (Microsoft Windows Use After Free)—to its Known Exploited Vulnerabilities (KEV) Catalog. These critical flaws are utilized by cyber attackers to gain unauthorized access, facilitate lateral movement, and potentially execute arbitrary code within federal and enterprise environments. CISA’s directive mandates that all Federal Civilian Executive Branch (FCEB) agencies remediate these vulnerabilities by specified dates to mitigate significant risk, reinforcing the growing threat from rapid exploitation of newly discovered CVEs. This incident illustrates the ongoing challenges faced by organizations, as adversaries increasingly exploit widely used software at scale. The timely identification and remediation of KEV Catalog vulnerabilities are vital for maintaining strong security postures amid an uptick in exploitation and regulatory pressure to close known gaps.
8 months ago
Kill Chain
U-Boot Bootloader Flaw Threatens Global Manufacturing and Critical Infrastructure
In December 2025, a critical vulnerability (CVE-2025-24857) was disclosed in U-Boot, a widely-used bootloader for embedded systems, impacting all versions prior to 2017.11 and several Qualcomm chipsets. The flaw—improper access control for volatile memory containing boot code—allowed an attacker with local access to execute arbitrary code at boot, posing significant risk to devices across essential sectors including energy, communications, manufacturing, healthcare, and more. No active exploitation has been reported, but the vulnerability could undermine device integrity and operational security in globally deployed critical infrastructure systems. Mitigations include upgrading to the latest U-Boot version and implementing strict physical and network isolation measures. This incident underlines the persistent risk posed by supply chain and firmware vulnerabilities in critical infrastructure. With IoT and embedded device ubiquity rising, attackers are increasingly targeting low-level firmware to achieve persistence or bypass security, heightening regulatory scrutiny and emphasizing the need for proactive vulnerability management and secure device lifecycle practices.
8 months ago
Kill Chain
React2Shell: Exploitation Surge Hits Businesses in 2025
In June 2025, attackers began widespread exploitation of CVE-2025-55182, a critical vulnerability known as React2Shell, shortly after it was publicly disclosed. Threat actors rapidly leveraged the unauthenticated remote code execution flaw to gain access to vulnerable web servers running the React2Shell component, allowing lateral movement, data exfiltration, and in some cases, ransomware deployment. The initial wave targeted a range of businesses, exploiting the window between disclosure and patch adoption, thus exposing organizations to operational disruption and compliance risks. The surge in React2Shell exploitation underscores an ongoing trend: cybercriminals are taking advantage of zero-day and recently publicized vulnerabilities with renewed speed and sophistication. Security teams must deal with shrinking patch windows, automated exploit tools, and increasing pressure from regulators to secure internet-facing applications.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports