Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Android BankBot-YNRK: 2024 Indonesian Mobile Wallets Targeted by Muting Malware
In 2024, a variant of the Android/BankBot malware known as YNRK targeted mobile users in Indonesia by disguising itself as legitimate applications, often distributed via third-party app stores or phishing campaigns. Once installed, the malware muted system alerts and abused accessibility services to perform unauthorized actions, including theft of credentials and the draining of cryptocurrency and mobile banking wallets. The attack leveraged overlays to capture user inputs and bypassed security mechanisms, resulting in significant financial losses for affected users, with widespread impacts across consumer mobile banking apps in the country. This incident highlights the ongoing evolution and sophistication of mobile banking malware, which increasingly targets emerging markets and exploits weak security controls on non-official app stores. The rapid adoption of mobile wallets and cryptocurrency platforms has made these attacks more lucrative and frequent, intensifying the need for proactive mobile security, user awareness, and regulatory oversight.
8 months ago
Kill Chain
Apple Patches 110 Vulnerabilities in Massive 2024 Security Update
In early November 2024, Apple released urgently needed security updates for its operating systems, patching 110 vulnerabilities across iOS, macOS, iPadOS, watchOS, tvOS, visionOS, Safari, and Xcode. Key vulnerabilities included memory corruption flaws in ImageIO and WebKit, with previous instances of such bugs leading to remote code execution. Several vulnerabilities could allow unauthorized access to sensitive user data or privilege escalation, and most major Apple product families were impacted. No active exploitation was reported, but these vulnerabilities posed significant risks, especially if exploited in the wild. This incident underscores the importance of timely patching for organizations leveraging Apple hardware, amid escalating regulatory expectations and sophisticated exploit development targeting zero-day vulnerabilities. With Apple devices often pivotal in hybrid and remote work environments, large-scale multi-platform vulnerabilities present an attack surface of interest to both cybercriminals and nation-state actors.
8 months ago
Kill Chain
SnakeStealer: 2024's Most Prolific Infostealer and Its Impact on Data Security
In early 2024, cybersecurity researchers identified a widespread surge in SnakeStealer malware infections targeting individuals and organizations across multiple sectors. This sophisticated infostealer penetrates devices through malicious attachments and compromised software, rapidly harvesting valuable personal and corporate information including browser credentials, cryptocurrency wallets, and sensitive documents. Once data is collected, it is exfiltrated to attacker-controlled servers, fueling cybercrime operations and secondary attacks. The rapid spread and effectiveness of SnakeStealer has led to significant business and operational risks, such as unauthorized access, data breaches, and identity theft. This incident highlights the escalating threat posed by modern infostealers, which continue to evolve their techniques to bypass security controls and evade detection. The sustained activity of SnakeStealer, coupled with copycat variants, underscores a trend of increasingly sophisticated, financially motivated cybercrime targeting both enterprise and individual data at scale.
8 months ago
Kill Chain
North Korean Operatives Pose as IT Job Seekers to Infiltrate Western Companies
In 2023, multiple Western technology firms fell victim to a sophisticated insider threat campaign involving North Korean operatives posing as freelance IT job seekers. These actors used false identities and forged CVs to secure remote employment and gain access to sensitive corporate environments. Once inside, they leveraged their positions to siphon proprietary information, commit financial fraud, and, in some cases, facilitate broader cyber-espionage activities by collecting credentials and mapping internal systems. The impact spanned financial loss, reputation damage, and increased exposure to supply chain attacks. This incident highlights the growing trend of well-resourced nation-state actors exploiting remote work arrangements and third-party talent networks. As companies aggressively scale digital transformation and outsourcing, vigilance against social engineering and identity fraud is critical to mitigate the risk of covert infiltration and regulatory non-compliance.
8 months ago
Kill Chain
Freight Brokers Targeted: Hackers Use RMM Tools in Supply Chain Heist (2024)
In 2024, cybercriminals executed a targeted supply chain attack against freight brokerages and trucking carriers by exploiting phishing emails and malicious links. Attackers used remote monitoring and management (RMM) tools to infiltrate corporate systems, taking control of freight scheduling and logistics platforms. This allowed the threat actors to manipulate cargo shipments, redirect valuable freight, and orchestrate the theft of physical goods. The attack revealed significant gaps in internal segmentation, endpoint security, and east-west visibility, resulting in financial loss, disrupted operations, and reputational impact across the logistics sector. This incident highlights an emerging trend in the weaponization of legitimate IT tools like RMMs for high-value supply chain attacks. As threat actors innovate with living-off-the-land techniques, organizations with critical logistics functions face heightened scrutiny from regulators and renewed urgency to close visibility and segmentation gaps.
8 months ago
Kill Chain
Microsoft's WSUS Security Patch Disrupts Windows Server 2025 Hotpatching
In June 2024, Microsoft released an out-of-band (OOB) security update to address an actively exploited vulnerability within Windows Server Update Services (WSUS). While the patch mitigates a critical security risk, it has inadvertently broken hotpatching functionality on certain Windows Server 2025 systems. Hotpatching allows for critical updates without rebooting servers, so this unintended consequence impacts business continuity and planned maintenance windows, affecting organizations relying on continuous operation. This incident highlights the ongoing challenges of patch management, especially when rapid updates for zero-day vulnerabilities disrupt core services. As threat actors increasingly target software supply chains and patch-delivery mechanisms, IT teams face growing pressure to balance security and operational stability.
8 months ago
Kill Chain
Microsoft 2024: SesameOp Backdoor Hides in OpenAI Assistants API Traffic
In early 2024, Microsoft researchers identified a sophisticated cyberattack campaign leveraging the new SesameOp backdoor malware. This threat exploits the OpenAI Assistants API as a covert command-and-control (C2) channel, enabling attackers to execute commands, exfiltrate data, and maintain persistence within compromised environments while masquerading as legitimate AI-driven traffic. The campaign targets organizations by bypassing traditional detection methods, using this unique abuse of generative AI services to hide communications and evade security controls. The operational impact is significant, posing increased risk for data loss, lateral movement, and regulatory exposure due to the highly obfuscated methodology. This incident underscores a rapid evolution in attacker tradecraft, with adversaries now weaponizing mainstream AI APIs for malicious infrastructure. As organizations accelerate adoption of AI technologies, this event highlights the urgency to address emerging risks of shadow AI and sophisticated backdoors, making robust east-west traffic inspection and AI-risk governance more important than ever.
8 months ago
Kill Chain
Insiders Indicted: BlackCat Ransomware Attacks Orchestrated by US Cybersecurity Experts (2023)
Between May and November 2023, three former employees of DigitalMint and Sygnia—both incident response firms—were indicted following allegations that they leveraged insider knowledge to facilitate BlackCat (ALPHV) ransomware attacks on five U.S. companies. These individuals reportedly gained unauthorized access to sensitive networks, deployed BlackCat ransomware, and demanded significant payouts, resulting in operational disruptions, data encryption, and potential data exposure for affected organizations. The attackers’ technical expertise made detection difficult, and their actions exploited gaps in internal network security, east-west monitoring, and threat detection protocols. This incident highlights the evolving threat posed by malicious insiders and the intersection of human risk with sophisticated ransomware-as-a-service operations. The case underscores the urgency for organizations to enhance identity-based segmentation, rigorous monitoring of internal activity, and to adapt cybersecurity policies to counter both external and internal threats.
8 months ago
Kill Chain
Kimsuky Deploys HttpTroy Backdoor in Sophisticated VPN-Phishing Attack Against South Korea
In late 2025, the North Korean advanced persistent threat (APT) group Kimsuky launched a targeted cyberattack against an organization in South Korea using a previously undocumented backdoor dubbed 'HttpTroy.' Leveraging a spear-phishing email containing a malicious ZIP file disguised as a VPN invoice, the attackers tricked the recipient into extracting and running a disguised executable. Once executed, HttpTroy enabled encrypted communication with attacker-controlled infrastructure, allowing remote data exfiltration and persistent access. This covert operation underscored the group's ongoing focus on espionage, intelligence collection, and the use of custom malware to evade detection. This incident is significant due to the rise of spear-phishing attacks deploying novel backdoors and the persistence of state-sponsored threats targeting geopolitical rivals. It highlights the necessity for vigilant endpoint monitoring, advanced traffic analysis, and robust segmentation to limit attacker lateral movement and safeguard sensitive communications.
8 months ago
Kill Chain
Lazarus Group Orchestrates Major 2025 Web3 Multi-Vector Breach
In November 2025, the Lazarus Group executed a sophisticated multi-vector attack campaign targeting several high-profile Web3 and cryptocurrency organizations. Utilizing social engineering and supply-chain attacks, the threat actors exploited newly disclosed vulnerabilities in trusted hardware (including Intel and AMD TEEs) mere hours after public disclosures. Attackers employed encrypted C2 channels, lateral movement tools, and advanced ransomware, allowing them to bypass internal segmentation and traverse east-west across internal networks. The result was significant compromise of sensitive assets, encrypted backups, and leakage of confidential data, leading to operational disruption and reputational harm to victims. This incident is especially noteworthy due to the rapid attacker adaptation to zero-day vulnerabilities, the blending of traditional and cloud-native threat techniques, and Lazarus’s evolution in targeting decentralized platforms. The attack highlights the increasing complexity and urgency of defending distributed infrastructure against agile, persistent threat actors.
8 months ago
Kill Chain
BankBot-YNRK and DeliveryRAT: Sophisticated Android Trojans Targeting Financial Data
In November 2025, cybersecurity researchers discovered the active deployment of two advanced Android trojans, BankBot-YNRK and DeliveryRAT, targeting users across multiple financial and delivery service platforms. The trojans infiltrated devices primarily through deceptive apps and phishing schemes, with BankBot-YNRK leveraging anti-analysis techniques to evade detection by testing for emulated and virtualized environments before unleashing its data theft capabilities. DeliveryRAT, meanwhile, provided attackers with remote access for layered exploitation. Both malware families are capable of harvesting sensitive personal and financial data, making banking credentials and payment details accessible to threat actors, potentially leading to significant financial losses and privacy violations for affected users and organizations. This incident highlights the evolving sophistication of Android-targeted infostealers, which increasingly combine stealth, anti-analysis, and remote access tactics. The attack underscores the urgent need for organizations and end-users to enhance mobile threat defenses and rapidly adapt to emerging malware targeting the growing mobile financial ecosystem.
8 months ago
Kill Chain
2024 Mega Email Stealer Log Breach: Over 2 Billion Accounts Exposed
In early June 2024, a large-scale data breach involving the exposure of over 2 billion email addresses was discovered in a massive stealer log dataset. Attackers compiled these emails through widespread info-stealer malware campaigns, collecting credentials and sensitive data from compromised systems and aggregating them into searchable logs accessible on illicit forums. The breach, prepared for public release after extensive validation and costly processing, highlights the sheer scale and complexity of modern info-theft operations. Affected users may face targeted phishing, credential stuffing attacks, and long-term privacy risks due to the availability of this data. This breach exemplifies the accelerating trend of industrialized data theft and commoditization of stolen information, especially as info-stealer malware campaigns proliferate and cybercriminals refine monetization methods. Organizations should be on heightened alert for downstream risks, including targeted attacks leveraging exposed data and regulatory scrutiny of data protection practices.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports