Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3797 threat reports
Page 229 of 317
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2737–2748 / 3797 reports
HoneyMyte 2025 Cyberespionage Hits: Updated CoolClient and Credential Theft Campaigns
Government Administration9 months ago

HoneyMyte 2025 Cyberespionage Hits: Updated CoolClient and Credential Theft Campaigns

Between 2024 and 2025, the advanced persistent threat group HoneyMyte (aka Mustang Panda, Bronze President) orchestrated advanced espionage campaigns targeting government entities across Southeast Asia, Mongolia, Malaysia, Myanmar, and Europe. Using updated CoolClient backdoors, custom browser credential stealers, and sophisticated prying scripts, HoneyMyte achieved persistent access, broad network infiltration, and the theft of sensitive documents, credentials, and operational intelligence. Attackers exploited signed DLL sideloading, launched post-exploitation scripts, and used public file-sharing services for covert exfiltration, successfully bypassing traditional defense layers and maintaining long-term surveillance on official targets. This incident highlights the evolving techniques of APT campaigns with growing reliance on multi-stage malware, encrypted traffic, and cloud-based exfiltration channels. The sophistication and persistence demonstrated by HoneyMyte reflect a broader rise in state-sponsored cyber espionage, posing continuing challenges for organizations' detection and regulatory compliance efforts in 2025.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Cellbreak: Critical Grist-Core Vulnerability Enables Remote Code Execution
Financial Services9 months ago

Cellbreak: Critical Grist-Core Vulnerability Enables Remote Code Execution

In January 2026, a critical vulnerability (CVE-2026-24002, codename Cellbreak, CVSS 9.1) was disclosed in Grist-Core, an open-source spreadsheet-database platform. The flaw enabled attackers to leverage malicious spreadsheet formulas for remote code execution (RCE) on self-hosted Grist-Core servers. This vulnerability could grant adversaries full foothold on affected systems, leading to potential data exfiltration, lateral movement, and operational disruption for organizations running vulnerable deployments. Security researchers at Cyera Research Labs made the discovery public after coordinated disclosure and a patch release by Grist developers. The incident is particularly relevant due to the sharp increase in attacks targeting spreadsheet and application logic vulnerabilities—especially in open-source business tools. As attackers pivot toward supply chain and SaaS entry points, control weaknesses involving user-supplied formulas and embedded code in collaborative apps persist as a high-risk vector.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Pakistan-Linked APT Launches Gopher Strike & Sheet Attack Against Indian Government in 2025
Government Administration9 months ago

Pakistan-Linked APT Launches Gopher Strike & Sheet Attack Against Indian Government in 2025

In September 2025, cybersecurity researchers uncovered coordinated cyber campaigns—dubbed Gopher Strike and Sheet Attack—targeting Indian government entities. Attributed to a Pakistan-linked Advanced Persistent Threat (APT) group, the operations leveraged novel, undocumented tactics involving phishing and multi-stage malware to compromise government networks. Attackers exploited existing security gaps, conducted lateral movement, and exfiltrated sensitive data, threatening the confidentiality and integrity of official communications. The campaigns remained undetected for an extended period, highlighting the advanced tradecraft and persistent nature of the threat actor. These incidents underscore the growing risk posed by state-aligned actors employing increasingly sophisticated tactics to target critical government infrastructure. The discovery of new tools and techniques in these attacks signals an escalation in South Asian regional cyber conflict and emphasizes the need for updated security controls and rapid detection capabilities.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
CISA Flags Five Actively Exploited Vulnerabilities in 2026 KEV Catalog Update
Government Administration9 months ago

CISA Flags Five Actively Exploited Vulnerabilities in 2026 KEV Catalog Update

In January 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added five high-risk vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. These include flaws in the Linux Kernel, SmarterTools SmarterMail, Microsoft Office, and GNU InetUtils. Threat actors exploited these vulnerabilities through methods such as authentication bypass, unrestricted file upload, security feature bypass, and argument injection, targeting both federal and private sector networks. Rapid exploitation can lead to unauthorized access, data exfiltration, or further compromise of organizational systems if not promptly remediated. This evolving threat landscape highlights an ongoing wave of opportunistic and targeted attacks leveraging widely used enterprise, email, and infrastructure software. The addition of these CVEs to the KEV Catalog underscores regulatory pressure and the increased urgency for organizations of all sizes to prioritize patch management and mitigate exposure to active threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
VMware vCenter RCE Flaw Actively Exploited: What Security Teams Need to Know
Information Technology/IT9 months ago

VMware vCenter RCE Flaw Actively Exploited: What Security Teams Need to Know

In January 2026, a critical vulnerability (CVE-2024-37079) in VMware vCenter Server was confirmed as actively exploited in the wild. This heap overflow flaw within the DCERPC protocol implementation enables unauthenticated remote attackers with network access to execute arbitrary code on vulnerable vCenter Server systems. The compromise does not require user interaction or elevated privileges, making attacks relatively low-effort and high-impact. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive mandating all federal agencies to remediate the issue within three weeks, underscoring its urgency and operational risk. No temporary mitigations exist, leaving patching as the sole defense for affected environments. This incident highlights a continued trend of attackers targeting management and orchestration layers in hybrid-cloud and virtualized infrastructures. The lack of workarounds, combined with rapid weaponization, points to increasing risks for organizations who delay patching and underlines regulatory pressure on timely remediation for critical zero-day vulnerabilities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
NPM Supply Chain Bypass: PackageGate and Shai-Hulud Exploits Expose Open-Source Risks in 2026
Computer Software/Engineering9 months ago

NPM Supply Chain Bypass: PackageGate and Shai-Hulud Exploits Expose Open-Source Risks in 2026

In January 2026, critical vulnerabilities dubbed "PackageGate" were revealed in NPM and several popular JavaScript package managers, exposing gaps in defenses against supply chain attacks like last year's Shai-Hulud incidents. Despite previous security improvements, attackers could still bypass NPM's safeguard against malicious package scripts by leveraging Git dependencies and malicious .npmrc configuration files, leading to unauthorized code execution—even when script blocking features were enabled. The flaws, discovered by Koi Security researchers, allowed full code compromise and had potential for massive developer credential and secret exfiltration, threatening tens of thousands of projects and their downstream users. These findings highlight the persistent risks in open-source supply chains and the accelerating pace of software supply chain attacks. As threat actors become more adept at exploiting package management tools, organizations face renewed urgency to bolster visibility, enforce granular access controls, and adopt defense-in-depth measures to protect development workflows and critical assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Malicious AI-Powered VS Code Extensions Trigger Global Supply Chain Breach (2026)
Computer Software/Engineering9 months ago

Malicious AI-Powered VS Code Extensions Trigger Global Supply Chain Breach (2026)

In January 2026, cybersecurity researchers uncovered that two widely-distributed AI-powered Microsoft Visual Studio Code extensions, with over 1.5 million combined installs, were covertly exfiltrating developer source code and sensitive project data to servers based in China. The malicious extensions masqueraded as legitimate AI coding tools, enticing developers globally through the official VS Code marketplace. Once installed, these extensions surreptitiously uploaded confidential code and intellectual property, potentially endangering enterprise software assets and customer data. Investigators highlighted the supply chain risk, noting the threat’s scalability via trusted software distribution channels and the delays in detecting such activity. This incident underscores the escalating risks associated with third-party development tools, particularly those leveraging AI branding. The popularity and trust in official marketplaces can allow sophisticated advanced persistent threats (APTs) or criminal groups to exploit developers and organizations, necessitating enhanced scrutiny and continuous security monitoring of supply chain dependencies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Exposed Environment Files: The $(pwd) Webserver Reconnaissance Surge of Jan 2026
Computer Software/Engineering9 months ago

Exposed Environment Files: The $(pwd) Webserver Reconnaissance Surge of Jan 2026

In January 2026, multiple sensors and the SANS Internet Storm Center reported a wave of targeted web application scans probing for exposed environment and configuration files on webservers using the /$(pwd)/ path pattern. Attackers, active since at least January 13th, systematically searched for sensitive files such as .env, docker-compose.yml, and terraform.tfstate, potentially exposing credentials and secrets. Two identified IP addresses (185.177.72.52, 185.177.72.23) led these scans, illustrating an automated approach likely leveraging misconfigured servers. While no confirmed breaches have been disclosed, such activity significantly raises the risk of follow-on exploitation or credential theft if vulnerable files are found. This incident highlights growing attacker sophistication in discovering misconfigurations and automating reconnaissance. The use of predictable directory traversal patterns and attempts to surface hidden files underscore the need for robust web application hardening and monitoring, especially as threat actors increasingly leverage similar tactics to bypass traditional defenses.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
ShinyHunters 2026: SSO Vishing Attacks Trigger Major SaaS Data Breaches
Financial Services9 months ago

ShinyHunters 2026: SSO Vishing Attacks Trigger Major SaaS Data Breaches

In January 2026, the cybercriminal group ShinyHunters orchestrated a series of sophisticated voice-phishing (vishing) attacks targeting corporate Single Sign-On (SSO) platforms, including Okta, Microsoft Entra, and Google. The attackers posed as IT support staff, manipulated employees into entering their credentials and multi-factor authentication tokens on fake login pages, and subsequently gained unauthorized access to SSO accounts. Leveraging these credentials, ShinyHunters accessed numerous connected SaaS applications such as Salesforce, Microsoft 365, and Slack, harvesting sensitive corporate data that was later used for extortion demands. High-profile organizations like SoundCloud, Betterment, and Crunchbase reported breaches and data losses as a result. This incident underscores a significant evolution in social engineering tactics, with attackers combining real-time phishing kits and vishing to bypass MFA and access a wide swath of corporate resources. As threat actors increasingly exploit identity-driven weaknesses and leverage SSO misconfigurations, organizations face greater risks of multi-system compromise and regulatory fallout.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Russian Organizations Hit by Advanced Multi-Stage Phishing with Amnesia RAT and Ransomware
Financial Services9 months ago

Russian Organizations Hit by Advanced Multi-Stage Phishing with Amnesia RAT and Ransomware

In January 2026, a sophisticated multi-stage phishing campaign targeted Russian organizations, leveraging social engineering emails that contained tampered business documents. These lures delivered a remote access trojan (Amnesia RAT) alongside ransomware, allowing attackers to establish stealthy persistence and ultimately encrypt sensitive data for extortion. The threat actors employed layered infection chains, executed lateral movement within infected environments, and exfiltrated critical information before deploying ransomware. The attack resulted in operational disruptions and financial risk for affected businesses. This incident reflects an escalating trend of multi-vector threats where initial phishing access rapidly pivots to advanced malware implants and ransomware. Security leaders must recognize the evolving sophistication and automation in phishing and malware delivery, and reinforce layered defenses, monitoring, and incident response to counter multi-stage cyber attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Konni Deploys AI-Built Malware Against Blockchain Engineers in 2026 Cyber Campaign
Computer Software/Engineering9 months ago

Konni Deploys AI-Built Malware Against Blockchain Engineers in 2026 Cyber Campaign

In January 2026, the North Korean-linked Konni APT (also known as Opal Sleet or TA406) launched a targeted cyber campaign against blockchain developers and engineers in the Asia-Pacific region, deploying bespoke PowerShell malware suspected of being generated using AI tools. Attackers lured victims with Discord-hosted ZIP files containing malicious shortcut links that, when launched, initiated a multi-stage infection chain. This included staged extraction of obfuscated PowerShell backdoors, privilege detection, scheduled task creation for persistence, and hourly beaconing to a remote command-and-control server. The malware focused on extracting sensitive development environment credentials, API keys, and potentially cryptocurrency wallet access, posing significant risks to both individuals and organizations handling blockchain assets. This incident exemplifies a sharp escalation in attacker sophistication, particularly the operational use of AI-powered malware, accelerating the pace at which advanced persistent threats can scale, adapt, and evade detection. As malicious actors increasingly leverage generative AI to develop modular, well-commented, and evasive code, organizations in crypto and other high-value sectors face a heightened need for adaptive security controls and rapid incident detection to keep defenses aligned with evolving attack techniques.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
CISA Urgently Flags Critical VMware vCenter Vulnerability (CVE-2024-37079) Amid Active Exploitation
Information Technology/IT9 months ago

CISA Urgently Flags Critical VMware vCenter Vulnerability (CVE-2024-37079) Amid Active Exploitation

In June 2024, a critical heap overflow vulnerability (CVE-2024-37079) affecting Broadcom VMware vCenter Server was identified and patched, but active exploitation was confirmed shortly thereafter. On January 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog after evidence surfaced of attackers leveraging the bug to execute unauthorized code remotely. Malicious actors could use this exploit to gain privileged access, conduct lateral movement, and potentially exfiltrate sensitive data or disrupt operations in environments utilizing unpatched vCenter servers. The incident underscores the continued targeting of core virtualization infrastructure by sophisticated threat actors and ransomware groups. With threat actors rapidly exploiting newly disclosed vulnerabilities, unpatched critical systems are at heightened risk, prompting urgency for patch management and layered security controls across enterprise environments.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports