Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
CentOS Web Panel Suffers Wide Scale Attacks Via Remote Command Execution Flaw
In early 2024, a critical remote command execution (RCE) vulnerability in CentOS Web Panel (CWP) was actively exploited by threat actors, as publicly warned by the U.S. Cybersecurity & Infrastructure Security Agency (CISA). Attackers leveraged this flaw, tracked as CVE-2022-44877, to gain unauthorized access to servers running CWP, enabling them to execute arbitrary commands and potentially take full control of affected systems. This exploitation campaign targeted internet-facing CWP instances, presenting significant risks to organizations relying on the popular Linux-based server management tool. The fallout included possible data compromise, deployment of additional malware, and interruption of web services. This incident highlights a growing trend in mass exploitation of critical web application vulnerabilities, with attackers increasingly focusing on widely-adopted open-source platforms. High-profile government advisories and the prevalence of ransomware toolkits leveraging RCE flaws have driven organizations to reinforce patch management and incident response as regulatory and operational priorities.
8 months ago
Kill Chain
CISA Adds Gladinet and CWP Flaws to KEV After Confirmed Exploitation
In November 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added critical vulnerabilities impacting Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. Attackers have leveraged CVE-2025-11371 and similar flaws, which expose sensitive files or directories, enabling unauthorized code execution and unauthorized access to critical business data. Exploitation techniques include remote access and privilege escalation, with incidents observed in both enterprise and cloud environments. The exploited weaknesses have led to compromised systems and elevated business risk for affected organizations. This incident highlights an escalating trend in the exploitation of web-facing management panels and software supply chain components, making east-west traffic security and timely vulnerability management crucial for defenders. Regulatory and industry pressure is mounting as the pace and sophistication of attacks accelerate.
8 months ago
Kill Chain
US Sanctions North Korean Network for $12.7M Crypto Laundering and IT Fraud
In November 2025, the U.S. Treasury Department sanctioned ten North Korean individuals and entities after uncovering a multi-year scheme involving crypto laundering and IT-related financial fraud totaling $12.7 million. These actors, linked to North Korea’s state-sponsored cyber operations, leveraged encrypted and unencrypted channels to move illicit funds across international financial systems. Their activities supported North Korea’s nuclear weapons ambitions and exploited gaps in network segmentation, egress controls, and threat detection processes. This incident underscores an escalation in nation-state cryptocurrency laundering methods and demonstrates continued exploitation of global IT workforce outsourcing, heightening regulatory focus and increasing the cyber risk to organizations transacting digitally or hiring remote technical staff.
8 months ago
Kill Chain
Google Uncovers PROMPTFLUX: AI-Driven Malware Raises the Stakes for 2025 Security
In November 2025, Google’s threat intelligence team identified a novel malware campaign involving PROMPTFLUX, a Visual Basic Script (VBScript) threat that leverages the Gemini AI model API for rapid self-obfuscation and evasion. Unattributed attackers deployed PROMPTFLUX to rewrite its own source code hourly using AI-driven prompts, significantly complicating detection and dismantling efforts. The malware infiltrated enterprise endpoints using social engineering and malicious email attachments before laterally propagating within corporate environments, thus undermining traditional endpoint and network defense measures. As a result, organizations faced heightened risk of data exfiltration, operational disruption, and increased response complexity. This incident highlights an emerging class of threats that weaponize generative AI models for polymorphic malware development. The ability to dynamically morph malicious code in real time increases attacker agility and strains legacy detection and compliance controls, reflecting a wider shift toward autonomous, AI-powered cyberattacks.
8 months ago
Kill Chain
ChatGPT 2025 Vulnerabilities: How AI Memory Leaks Put Data at Risk
In November 2025, cybersecurity researchers uncovered and disclosed a set of seven critical vulnerabilities affecting OpenAI's ChatGPT, specifically the GPT-4o and GPT-5 models. The vulnerabilities allowed attackers to exploit memory and chat history mechanisms, enabling the unauthorized extraction of sensitive user information—including personal data and confidential conversation content—without user awareness. The flaws could be triggered remotely through crafted prompts and API calls, presenting a considerable risk both to individuals and enterprises leveraging ChatGPT in production environments. OpenAI has issued patches and advisories, but the revelations highlight the rapid evolution and complexity of securing AI models at scale. This incident is especially significant given the increasing reliance on generative AI in business workflows and the concurrent surge in attacks targeting AI-powered infrastructure. With regulatory scrutiny intensifying around AI data handling and the advent of new compliance frameworks, protecting AI systems against data leakage has become a board-level imperative.
8 months ago
Kill Chain
Pro-Russian APT Uses Linux VMs to Evade Windows Security in 2024
In early 2024, the pro-Russian threat group known as Curly Comrades leveraged Linux virtual machines within Windows environments to bypass security controls and evade detection. By deploying Linux VMs on compromised Windows hosts, the attackers concealed their activities, used native tools for lateral movement, and exfiltrated sensitive data without triggering traditional endpoint or network monitoring. This novel cross-OS technique allowed extended dwell time and left organizations vulnerable to espionage, data loss, and operational disruption. This incident is especially relevant given the continuing evolution of threat actor tactics, including living-off-the-land and virtualization abuse. Organizations must adapt defenses to anticipate adversaries' creative use of multi-platform infrastructures and strengthen their east-west visibility to prevent stealthy attacks.
8 months ago
Kill Chain
Proliance Surgeons Breach: Ransomware Exposes Hidden Supply Chain Risks
In January 2024, Proliance Surgeons, a major US healthcare provider, suffered a significant data breach after ransomware group Midas targeted its third-party vendor, PJ&A, which provides medical transcription services. The attackers exploited insufficient east-west traffic segmentation and leveraged VPN credentials to move laterally through Proliance’s environment, encrypting data and exfiltrating files containing patient names, addresses, dates of birth, medical record numbers, and clinical details. Business operations were disrupted for days, and regulatory investigations are underway, posing severe operational and reputational risks for both Proliance and its downstream partners. This breach underscores the ongoing vulnerability of healthcare organizations to supply chain ransomware attacks. With ransomware groups shifting tactics to exploit third-party vendors and focusing on lateral movement for maximum damage, healthcare organizations must modernize network segmentation, enhance detection capabilities, and achieve compliance with stricter data protection mandates.
8 months ago
Kill Chain
Major Supply-Chain Exposure Discovered in Popular Software Update Tool – 2024
In early 2024, a critical supply-chain vulnerability was identified in a widely used software update tool, threatening some of the world's largest technology enterprises. Attackers exploited insecure update mechanisms within this tool, enabling the potential injection of malware directly into production software across multiple organizations. The breach exposed businesses to risks including unauthorized access, lateral movement, and possible data theft. While no confirmed exploitation has been publicly reported to date, the threat mirrors the scale and impact of the infamous SolarWinds compromise, underscoring the profound risks inherent in trusted third-party code dependencies. This incident highlights the urgent and growing threat from software supply-chain attacks, which have rapidly increased in frequency and sophistication over the past two years. It spotlights the cybersecurity community’s intensified focus on software bill of materials (SBOM), continuous monitoring, and robust supply-chain controls as regulatory and industry expectations tighten.
8 months ago
Kill Chain
U.S. Treasury Sanctions North Korean Firms for Cryptocurrency Crime and IT Fraud (2024)
In June 2024, the U.S. Treasury Department sanctioned eight individuals and two companies linked to North Korea for laundering proceeds from cybercrime and IT worker schemes. These sanctioned parties allegedly funneled over $3 billion in stolen cryptocurrency and hundreds of millions in illicitly earned IT wages to the North Korean regime, supporting its weapons programs. Entities sanctioned include North Korean banking officials, an IT company operating in China, and financial institution representatives in both China and Russia, all accused of violating international sanctions, managing illicit funds, and enabling large-scale money laundering through sophisticated cyber and identity subterfuge. This incident underscores the advanced capabilities of North Korea’s cyber operations and their direct link to geopolitical threats, as well as the ongoing shift towards state-sponsored cryptocurrency theft and IT fraud as major funding sources for sanctioned regimes.
8 months ago
Kill Chain
Curly COMrades: Russian Hackers Hide Malware in Hyper-V Linux VMs to Evade Detection
In early 2024, threat intelligence analysts uncovered a sophisticated campaign by the Russian-backed group Curly COMrades, wherein attackers abused Microsoft's Hyper-V virtualization feature to bypass endpoint detection on target Windows systems. The attackers covertly deployed an Alpine Linux virtual machine, invisible to conventional security tools, and used it as a persistent foothold to run malware, facilitate lateral movement, and exfiltrate sensitive data. This technique allowed them to mask malicious processes and evade established EDR and antivirus solutions, posing serious risks to affected organizations. This incident highlights an alarming evolution in advanced persistent threat tactics, with adversaries exploiting virtualization infrastructure to evade modern security controls. As virtualized environments and cloud workloads proliferate, organizations must harden hypervisors, enhance east-west security, and advance detection capabilities to fend off similar stealthy threats.
8 months ago
Kill Chain
Top Browser Sandbox Threats: How Attackers Slip Past Security in 2024
In early 2024, a surge of browser-based attacks demonstrated the ability of sophisticated threat actors to bypass modern browser sandboxing, leveraging native browser features and vulnerable extensions to conduct credential theft, lateral movement, and data exfiltration. According to insights from Keep Aware and BleepingComputer, attackers exploit browser quirks and weaknesses such as unsanctioned extension access, credential harvesting via phishing overlays, and abuse of session tokens, often evading signature-based detection tools. Organizations affected by such campaigns have faced unauthorized data access, exposure of credentials, and in some cases, secondary compromise of internal systems. This incident highlights the evolving attack surface at the browser layer, where traditional endpoint and network protections may no longer suffice. As browser usage grows in enterprise settings and attackers refine tactics to evade sandboxing controls, security teams must re-examine their strategy for real-time browser-layer visibility and enforcement.
8 months ago
Kill Chain
Nikkei’s 2024 Slack Breach: How 17,000 Identities Were Compromised
In early June 2024, Japanese media giant Nikkei disclosed a significant data breach after its Slack messaging platform was compromised, exposing the personal information of more than 17,000 employees and business partners. Attackers gained unauthorized access to sensitive data such as names, email addresses, and potentially other details linked through Slack integration, by exploiting the company’s internal communications environment. The breach’s impact is broad, affecting both staff and partners, with Nikkei reporting the incident promptly to authorities and commencing investigation and notification processes. This incident highlights the growing risks posed by attacks on SaaS collaboration platforms like Slack, as organizations increasingly rely on these tools for internal and external communication. Threat actors are exploiting identity-based and third-party platform vulnerabilities, underlining the critical need for robust access controls and proactive monitoring of cloud communication systems.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports