Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
GlassWorm Returns: 2025 Supply Chain Attack on Developer Tool Extensions
In late 2025, the malicious campaign known as GlassWorm reemerged, infiltrating the Microsoft Visual Studio Marketplace and Open VSX with 24 rogue extensions disguised as legitimate developer tools such as Flutter, React, Tailwind, Vim, and Vue. By impersonating trusted tools, GlassWorm tricked developers into installing compromised extensions containing hidden payloads. Once embedded, these extensions established command-and-control communication over the Solana blockchain and enabled threat actors to perform code exfiltration, credential harvesting, and potentially insert backdoors into enterprise codebases, causing major risks for organizations leveraging these tools in their software supply chain. This incident underscores the ongoing and evolving risk of supply chain attacks targeting popular software development ecosystems. With developers as high-value targets, adversaries are increasingly sophisticated in exploiting marketplaces and open-source repositories to distribute malicious code, highlighting the urgent need for stronger validation, monitoring, and zero trust controls in software development lifecycles.
8 months ago
Kill Chain
Iranian APT Deploys MuddyViper Backdoor in Widespread Israeli Attacks (2025)
In late 2025, Iranian nation-state threat group MuddyWater launched a series of targeted cyberattacks against Israeli organizations spanning academia, engineering, local government, manufacturing, transportation, and utilities. Leveraging a newly identified malware backdoor dubbed MuddyViper, attackers infiltrated critical Israeli networks through spear-phishing and supply chain compromise, enabling persistent access and lateral movement across sensitive environments. The campaign was detected following unusual network activity and led to the exposure and disruption of operations, sparking concerns about the security of key national infrastructure. This incident highlights an ongoing evolution in APT tactics—particularly the development of custom malware for stealthy attacks on critical sectors tied to geopolitical tensions. The breach underscores the need for advanced detection, east-west traffic controls, and zero trust strategies to counter sophisticated nation-state actors.
8 months ago
Kill Chain
Malicious npm Package Outsmarts AI Security Tools in 2024 Supply Chain Breach
In February 2024, researchers identified a supply chain attack leveraging a malicious npm package named eslint-plugin-unicorn-ts-2, published under the guise of a TypeScript extension for ESLint by a user called "hamburgerisland." This package included hidden prompt injections and obfuscated scripts specifically designed to evade detection by AI-driven security scanners. Once integrated into a developer's project, it could execute unauthorized code, exfiltrate data, and potentially propagate laterally within developer environments. The attack highlighted how AI-oriented security tools can be manipulated through adversarial prompts and code concealment, putting countless downstream applications at risk in the dynamic JavaScript/Node.js ecosystem. The incident exemplifies sophisticated adversary adaptation, with attackers now actively engineering open-source supply chain threats to outsmart automated, AI-driven defenses. Organizations relying on package registries and automated code validation face urgent pressure to enhance both technical controls and threat intelligence around third-party dependencies.
8 months ago
Kill Chain
Lazarus APT’s Remote-Worker Ruse: How North Korean Hackers Infiltrated via Trusted IT Contractors
In late 2025, cybersecurity researchers from BCA LTD, NorthScan, and ANY.RUN captured an active infiltration by North Korea’s Lazarus Group (specifically the Famous Chollima division) leveraging remote IT workers implanted in Western organizations. This highly coordinated campaign used the appearance of legitimate remote workers—often hired via freelance and IT staffing platforms—to discreetly gain access to internal systems, exfiltrate sensitive data, and facilitate the deployment of malware directly through trusted accounts. The operation showcased sophisticated methods for circumventing east-west traffic controls and exploiting trusted relationships, posing a direct risk to organizations’ hybrid and cloud environments. This breach exemplifies the quick evolution of nation-state threat actors exploiting global remote work and cloud-native architectures. As the use of remote staff and contractors surges, organizations face mounting pressure to implement zero trust controls and granular segmentation to prevent well-resourced APTs from leveraging trusted credentials for deep access and stealthy lateral movement.
8 months ago
Kill Chain
Tomiris Unleashes 'Havoc': 2024 CIS Government Cyber-Espionage Explained
In early 2024, the Russian-speaking APT group Tomiris launched a sophisticated cyber-espionage campaign targeting government and diplomatic organizations in several CIS nations and Central Asia. Attackers leveraged new malware tools and refined tactics, initially gaining access via spear-phishing and malicious email attachments designed to exploit trust within diplomatic correspondence chains. Once inside, the group deployed covert tools for lateral movement, maintained persistence, and exfiltrated sensitive diplomatic communications and internal documents. The breach had significant operational security implications, exposing strategic discussions and potentially undermining ongoing government initiatives. This incident exemplifies the ongoing risk posed by advanced persistent threats in geopolitical hotspots, with Tomiris demonstrating evolving tradecraft and adaptability. Organizations are urged to review east-west security, segmentation, and monitoring practices as similar espionage campaigns are increasingly targeting public sector networks.
8 months ago
Kill Chain
North Korea’s ‘Contagious Interview’ npm Supply Chain Attack Disrupts Developer Ecosystem
In October 2023, North Korean state-sponsored threat actors launched an extensive supply chain attack by distributing over 197 malicious npm packages, collectively accumulating more than 31,000 downloads. These attackers, using tactics known as the 'Contagious Interview,' targeted software developers, especially those active in open-source environments, by delivering trojanized code through compromised npm modules. The campaign aimed to infiltrate developer systems, steal sensitive information, and establish persistent access to downstream enterprise networks, significantly raising the risk to downstream software supply chains and CI/CD pipelines. This incident is especially notable for its scale, rapid spread, and focus on highly trusted open-source ecosystems, underscoring an alarming trend in software supply chain attacks. Organizations are urged to strengthen controls around package management, implement zero trust principles, and increase monitoring of development infrastructure to defend against similar threats.
8 months ago
Kill Chain
Glassworm Malware Returns: Third Wave Targets VS Code with Supply-Chain Attack (2024)
In early 2024, a new wave of the Glassworm malware campaign was discovered infiltrating the Microsoft Visual Studio Code and OpenVSX marketplaces with 24 malicious packages. These supply-chain attacks targeted software developers by masquerading as legitimate extensions, but upon installation delivered trojans capable of stealing sensitive files, authentication tokens, and establishing persistence for command-and-control activities. The campaign began in October 2023, with this third and most extensive wave compromising both trusted VS Code ecosystems and potentially impacting thousands who unknowingly downloaded tainted packages. The threat actors have not been formally attributed but demonstrated sophisticated understanding of both developer environments and software supply chains. This incident is a striking example of the increasing shift toward attacking upstream dependencies, leveraging trusted developer tools to gain footholds deeper in organizations. With open-source and third-party marketplaces under continuous attack, businesses face growing pressure to implement better package vetting and monitoring along with zero-trust segmentation and detection capabilities.
8 months ago
Kill Chain
SmartTube Android TV App Breached via Supply Chain: Malicious Update Hits Users
In April 2024, the widely used open-source SmartTube YouTube client for Android TV suffered a significant supply chain attack when a malicious actor obtained the developer's signing keys. This access enabled the attacker to publish a trojanized version of the app as a seemingly legitimate update, which was downloaded by users through both official and unofficial channels. The compromise jeopardized user devices as the malicious update could facilitate data theft and other unauthorized activities, threatening the integrity of the SmartTube ecosystem and user trust in third-party app marketplaces. This breach exemplifies the increasing risk of supply chain attacks targeting open-source software and underscores the ongoing challenges around secure code signing and software distribution. As organizations and individuals increasingly depend on third-party applications, the incident highlights the urgent need for stronger controls and detection capabilities to protect software supply chains.
8 months ago
Kill Chain
Multi-Vector Breach: npm Worm, Firefox RCE, and M365 Email Raids Rock 2025
In December 2025, a coordinated multi-vector cyberattack was observed targeting organizations through the exploitation of critical zero-day vulnerabilities (CVEs), a resurgence of the npm InfoStealer Worm, a remote code execution flaw in Mozilla Firefox, and widespread credential compromise leading to Microsoft 365 email account takeovers. Attackers leveraged a blend of social engineering, poisoned open-source packages, and malicious links to infiltrate developer environments, gain access to corporate cloud accounts, and spread laterally via trusted supply chains. Impacted organizations faced the risk of sensitive data exfiltration, widespread internal compromise, and disruption of core IT services across software development and communications. This incident underscores the growing sophistication and scale of modern attack campaigns that blend supply chain, RCE, SaaS compromise, and worm tactics. The convergence of these vectors highlights the urgent need for zero trust segmentation, continuous threat detection, and cloud-specific defenses as attackers increasingly target developer and business collaboration tools.
8 months ago
Kill Chain
ShadyPanda: The 2024 Browser Extension Supply Chain Breach Impacting 4.3 Million Installs
In mid-2024, the threat actor group ShadyPanda executed a sophisticated supply chain attack by compromising five popular browser extensions, which had previously been legitimate and widely trusted. These extensions, with a cumulative total of over 4.3 million installs, were maliciously updated to include spyware functionality, enabling covert surveillance and data exfiltration from unsuspecting users. The malicious modifications went undetected for several months, enabling the attackers to harvest browser data, credentials, and potentially sensitive user files, impacting organizations and individuals globally before the extensions were finally removed following a report by Koi Security. This incident highlights the increasing trend of supply chain compromise via browser extension ecosystems, which often lack sufficient vetting and monitoring. The attack underscores growing regulatory and operational pressure to secure third-party components and software supply chains, especially as similar tactics proliferate across widely adopted digital platforms.
8 months ago
Kill Chain
Shai-hulud: npm Supply Chain Attack Hits Cloud Ecosystem
In early 2024, security researchers uncovered a major supply chain attack involving a new variant of the Shai-hulud malware worm, which propagated through poisoned npm packages targeting cloud-based development environments. The malware autonomously infiltrated thousands of systems, harvesting credentials and secrets from cloud infrastructure providers including AWS, Google Cloud Platform, and Azure. Attackers achieved persistence and lateral movement by exploiting weaknesses in east-west traffic controls, leveraging the npm ecosystem’s trust to escalate impact across enterprise CI/CD pipelines and critical workloads. The breach resulted in significant operational risks, requiring emergency remediation from affected organizations and cloud providers. This incident highlights the evolving sophistication of supply chain threats, especially in cloud-native environments where development speed often outpaces traditional security controls. Attackers are increasingly abusing open-source package repositories for automated, scalable attacks—raising concerns for both cloud security and compliance teams.
8 months ago
Kill Chain
November 2025 Cybersecurity Review: Akira, Operation Endgame, and AI Data Exposure
In November 2025, the cybersecurity landscape was rocked by a surge of major incidents spanning data exposure at leading AI companies, a high-profile ransomware campaign by the Akira gang, and an unprecedented law enforcement operation targeting prolific malware families. Attackers leveraged advanced lateral movement and encryption bypass techniques, with Akira exfiltrating critical business data and setting new records for ransom hauls. Meanwhile, Operation Endgame—an international collaborative effort—dismantled several prominent malware botnets, arresting key operators and seizing digital infrastructure, all while organizations scrambled to contain threats and patch vulnerabilities across multi-cloud and hybrid environments. This period highlights a convergence of advanced extortion, data privacy, and large-scale coordinated response, reflecting escalating threat sophistication and the increasing pressure on organizations to meet evolving compliance and security demands.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports