Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3797 threat reports
Page 223 of 317
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2665–2676 / 3797 reports
Unveiling the Rublevka Team: A Deep Dive into the 2023 Crypto Wallet Draining Operation
Financial Services9 months ago

Unveiling the Rublevka Team: A Deep Dive into the 2023 Crypto Wallet Draining Operation

In 2023, the cybercriminal group known as 'Rublevka Team' orchestrated large-scale cryptocurrency thefts, amassing over $10 million through affiliate-driven wallet draining campaigns. Operating as a 'traffer team,' they utilized a network of social engineering specialists to direct victims to malicious landing pages. These pages, impersonating legitimate crypto services, deployed custom JavaScript scripts that tricked users into connecting their wallets and authorizing fraudulent transactions. The group's fully automated infrastructure provided affiliates with tools such as Telegram bots, landing page generators, and support for over 90 wallet types, enabling high-volume scams with minimal oversight. This incident underscores the evolving threat landscape in the cryptocurrency sector, highlighting the shift towards scalable, service-based cybercrime models. The Rublevka Team's operations pose significant risks to cryptocurrency platforms, fintech providers, and brands, emphasizing the need for proactive monitoring and defense strategies to protect customers and maintain trust.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
GlassWorm Malware Compromises Open VSX Registry in 2026 Supply Chain Attack
Computer Software/Engineering9 months ago

GlassWorm Malware Compromises Open VSX Registry in 2026 Supply Chain Attack

In late January 2026, a sophisticated supply chain attack compromised the Open VSX Registry, an open-source marketplace for Visual Studio Code extensions. Threat actors gained unauthorized access to a trusted developer's account, 'oorzc,' and injected malicious code into four widely-used extensions: FTP/SFTP/SSH Sync Tool, I18n Tools, vscode mindmap, and scss to css. These extensions, collectively downloaded over 22,000 times, delivered the GlassWorm malware, which targeted macOS systems to exfiltrate sensitive data, including browser credentials, cryptocurrency wallets, and developer secrets. The malware employed advanced evasion techniques, such as locale checks to avoid Russian systems and utilizing the Solana blockchain for command-and-control communications. ([thehackernews.com](https://thehackernews.com/2026/02/open-vsx-supply-chain-attack-used.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within the developer ecosystem. The exploitation of trusted extensions highlights the need for enhanced security measures in open-source platforms. Organizations must prioritize the integrity of their development tools and implement robust monitoring to detect unauthorized modifications promptly.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Security Flaws in Google Looker: A Wake-Up Call for Cloud Security
Financial Services9 months ago

Critical Security Flaws in Google Looker: A Wake-Up Call for Cloud Security

In late 2025, critical vulnerabilities were discovered in Google Looker, a widely used business intelligence platform. These flaws allowed attackers to execute remote code and exfiltrate sensitive data across different Google Cloud Platform (GCP) tenants. The most severe issue enabled unauthorized users to gain full control over Looker instances, potentially leading to data manipulation and deeper network infiltration. Google promptly patched these vulnerabilities in its cloud-hosted services; however, organizations using self-hosted Looker instances were required to manually apply the updates to mitigate the risks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/04/google-looker-vulnerabilities-cve-2025-12743/?utm_source=openai)) This incident underscores the growing threat landscape targeting cloud-based business intelligence tools. As organizations increasingly rely on such platforms, ensuring robust security measures and timely patch management becomes imperative to prevent unauthorized access and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CISA Highlights Four Actively Exploited Vulnerabilities in February 2026
Government Administration9 months ago

CISA Highlights Four Actively Exploited Vulnerabilities in February 2026

In February 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. These vulnerabilities include CVE-2019-19006 and CVE-2025-64328 in Sangoma FreePBX, CVE-2021-39935 in GitLab Community and Enterprise Editions, and CVE-2025-40551 in SolarWinds Web Help Desk. The vulnerabilities range from improper authentication and OS command injection to server-side request forgery and deserialization of untrusted data, posing significant risks to affected systems. The inclusion of these vulnerabilities in the KEV Catalog underscores the persistent threat posed by unpatched software. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation, as these vulnerabilities are actively targeted by malicious actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Unauthenticated API Leads to OAuth Token Exposure in 2025
Financial Services9 months ago

Unauthenticated API Leads to OAuth Token Exposure in 2025

In April 2025, a critical security vulnerability was discovered during a bug bounty program hosted by YesWeHack. An unauthenticated API endpoint exposed OAuth client credentials, allowing unauthorized access to sensitive personal and business data. This misconfiguration enabled attackers to impersonate trusted applications and retrieve confidential information without any authentication barriers. The flaw was promptly reported and addressed, mitigating potential exploitation. ([cyberpress.org](https://cyberpress.org/oauth-misconfiguration-enables-researchers-to-access-sensitive-data/?utm_source=openai)) This incident underscores the importance of securing API endpoints and properly managing OAuth credentials. As organizations increasingly rely on APIs for business operations, ensuring robust authentication and authorization mechanisms is crucial to prevent unauthorized data access and potential breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
XWorm Malware Resurgence in 2025: Advanced Threats Unveiled
Financial Services9 months ago

XWorm Malware Resurgence in 2025: Advanced Threats Unveiled

In mid-2025, cybersecurity researchers identified a resurgence of the XWorm Remote Access Trojan (RAT), notably with the release of version 6.0. This variant introduced advanced plugins, enhanced persistence mechanisms, and a ransomware module, significantly increasing its threat level. Attackers distributed XWorm V6 through sophisticated phishing campaigns, utilizing malicious JavaScript droppers that executed PowerShell scripts to deliver injector DLLs. The malware's modular design allowed for extensive data theft, system control, and file encryption, posing substantial risks to organizations across various sectors. The re-emergence of XWorm underscores the evolving nature of cyber threats, highlighting the necessity for organizations to adopt proactive and adaptive cybersecurity measures. The malware's advanced evasion techniques and modular capabilities reflect a broader trend of increasingly sophisticated attack vectors, emphasizing the importance of continuous monitoring, employee training, and robust security protocols to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Zero-Day Vulnerabilities in Ivanti EPMM Exploited: Immediate Action Required
Information Technology/IT9 months ago

Critical Zero-Day Vulnerabilities in Ivanti EPMM Exploited: Immediate Action Required

In January 2026, Ivanti disclosed two critical zero-day vulnerabilities, CVE-2026-1281 and CVE-2026-1340, in its Endpoint Manager Mobile (EPMM) software. Both vulnerabilities, with a CVSS score of 9.8, allow unauthenticated remote code execution. Prior to disclosure, a limited number of customers were exploited, enabling attackers to execute arbitrary commands, access sensitive data, and potentially establish persistence through web shells. Ivanti released interim patches and plans a permanent fix in version 12.8.0.0. Organizations are urged to apply patches promptly and review logs for signs of compromise. ([cyberscoop.com](https://cyberscoop.com/ivanti-endpoint-manager-mobile-zero-day-vulnerabilities-exploit/?utm_source=openai)) This incident underscores the persistent targeting of network edge devices by threat actors, highlighting the critical need for timely patch management and vigilant monitoring of security advisories to mitigate risks associated with zero-day vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical React Native Metro Vulnerability Exploited in 2025
Computer Software/Engineering9 months ago

Critical React Native Metro Vulnerability Exploited in 2025

In late 2025, a critical vulnerability (CVE-2025-11953) was discovered in the Metro Development Server used by React Native. This flaw allowed unauthenticated attackers to execute arbitrary OS commands on developer systems via a POST request to the server's /open-url endpoint. The vulnerability affected versions 4.8.0 through 20.0.0-alpha.2 of the @react-native-community/cli-server-api package and was patched in version 20.0.0. Exploitation was observed in December 2025 and January 2026, with attackers delivering advanced payloads on both Windows and Linux platforms, leading to potential system compromise and data exfiltration. This incident underscores the critical importance of securing development environments and promptly applying patches to known vulnerabilities. The ease of exploitation and the widespread use of React Native in the development community highlight the need for vigilant security practices to prevent similar supply-chain attacks in the future.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Iron Mountain's 2026 Data Breach: A Closer Look
Information Services9 months ago

Iron Mountain's 2026 Data Breach: A Closer Look

In February 2026, Iron Mountain, a global leader in information management services, experienced a security incident involving unauthorized access to a single folder on a public-facing file-sharing site. The Everest ransomware group claimed responsibility, alleging the theft of 1.4 TB of internal documents containing client information. However, Iron Mountain clarified that the breach was limited to marketing materials, accessed through a compromised login credential, with no evidence of ransomware deployment or further system compromise. This incident underscores the persistent threat posed by ransomware groups like Everest, which have increasingly targeted organizations across various sectors. Their tactics often involve exploiting compromised credentials to gain unauthorized access, emphasizing the need for robust access controls and vigilant monitoring to prevent such breaches.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Notepad++ Supply Chain Attack: Lessons Learned from the 2025 Breach
Computer Software/Engineering9 months ago

Notepad++ Supply Chain Attack: Lessons Learned from the 2025 Breach

Between June and December 2025, the Notepad++ text editor's update infrastructure was compromised by the Chinese state-sponsored hacking group Lotus Blossom. The attackers exploited vulnerabilities at the hosting provider level, redirecting update requests from targeted users to malicious servers. This allowed them to deliver a custom backdoor named Chrysalis, enabling unauthorized access to users' systems. The breach was addressed in December 2025 with the release of Notepad++ version 8.8.9, which enhanced update verification processes. ([thehackernews.com](https://thehackernews.com/2026/02/notepad-hosting-breach-attributed-to.html?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where trusted software updates are manipulated to distribute malware. Organizations must prioritize securing their software supply chains and implement robust verification mechanisms to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Citrix NetScaler Reconnaissance Campaign Highlights Evolving Attacker Tactics
Financial Services9 months ago

Citrix NetScaler Reconnaissance Campaign Highlights Evolving Attacker Tactics

Between January 28 and February 2, 2026, a coordinated reconnaissance campaign targeted Citrix NetScaler infrastructure, utilizing over 63,000 distinct IP addresses to conduct more than 111,000 scanning sessions. Approximately 64% of this traffic originated from residential proxies, allowing attackers to masquerade as legitimate users and evade traditional security measures. The primary focus was on identifying exposed Citrix login panels and enumerating product versions, indicating a systematic effort to map vulnerable systems for potential exploitation. This incident underscores a growing trend where attackers leverage residential proxies to conduct large-scale reconnaissance, complicating detection efforts. The specific targeting of Citrix NetScaler devices suggests a heightened interest in exploiting known vulnerabilities within these systems, emphasizing the need for organizations to implement robust monitoring and timely patching strategies to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Step Finance's $40M Crypto Theft: A Wake-Up Call for Endpoint Security
Financial Services9 months ago

Step Finance's $40M Crypto Theft: A Wake-Up Call for Endpoint Security

In late January 2026, Step Finance, a prominent Solana-based DeFi platform, suffered a significant security breach resulting in the theft of approximately $40 million worth of digital assets. The attackers gained unauthorized access to the company's treasury wallets by compromising devices belonging to its executive team. This breach led to the unauthorized transfer of 261,854 SOL tokens, valued at around $29 million at the time, and caused the platform's native STEP token to plummet over 80% within 24 hours. ([ainvest.com](https://www.ainvest.com/news/step-finance-treasury-theft-27m-sol-outflow-step-token-collapse-2602/?utm_source=openai)) This incident underscores the critical importance of robust endpoint security measures, especially for individuals with access to substantial organizational assets. The breach highlights the growing trend of targeting high-level personnel through device compromises, emphasizing the need for comprehensive security protocols and regular audits to safeguard against such sophisticated attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports