Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
SleepyDuck Supply Chain Attack: Malicious VSX Extension Exposes Developers via Ethereum C2
In late October and early November 2025, cybersecurity researchers uncovered a malicious Visual Studio Code extension, 'juan-bianco.solidity-vlang', uploaded to the Open VSX registry. Originally benign, the extension was updated within days to include a remote access trojan called SleepyDuck, which leveraged Ethereum smart contracts to dynamically maintain connectivity with its command-and-control (C2) servers. By exploiting the trust inherent in open-source software supply chains and masquerading as a development tool, attackers enabled remote access and possible data exfiltration from developer environments, posing significant risks to organizations reliant on open-source packages. This breach highlights the persistent threat of supply chain attacks targeting developer tools and marketplaces, a rapidly growing vector as attackers seek to compromise software upstream. It also demonstrates the adoption of blockchain infrastructure for resilient, hard-to-takedown C2 mechanisms, forcing defenders to adapt to increasingly complex threat ecosystems.
8 months ago
Kill Chain
Jabber Zeus Coder 'MrICQ' Arrested: Lessons from a Banking Trojan Empire
In October 2025, U.S. authorities took into custody Yuriy Igorevich Rybtsov, known online as "MrICQ," a key developer for the infamous Jabber Zeus cybercrime group. The group, active between 2009 and 2013, leveraged a custom version of the ZeuS banking trojan to compromise small and mid-sized business accounts, bypass multi-factor authentication, and orchestrate elaborate money-laundering schemes across multiple countries. MrICQ's primary role involved monitoring real-time breaches, facilitating payroll fraud via money mules, and supporting the laundering of illicit gains through electronic exchanges. This arrest follows years of cross-border law enforcement collaboration, building upon indictments and intelligence from forensic chat intercepts and international extraditions. This case highlights the evolving tactics of financially motivated threat actors, especially their capacity to defeat strong authentication and automate large-scale financial theft. The longevity and operational sophistication demonstrated by groups like Jabber Zeus underscore persistent vulnerabilities in online banking and underscore the need for adaptive security controls across sectors.
8 months ago
Kill Chain
TruffleNet Attack Highlights Urgent AWS Cloud Credential Risks
In early 2024, a sophisticated campaign dubbed 'TruffleNet' leveraged stolen credentials to infiltrate Amazon Web Services (AWS) environments. Attackers, believed to leverage components of TruffleHog, obtained valid credentials via phishing and credential theft, bypassing weak controls to gain access to cloud accounts. Following initial compromise, the threat actors engaged in reconnaissance, lateral movement, and business email compromise (BEC) activities, exploiting privileges to move within the cloud infrastructure and exfiltrate sensitive data. The incident resulted in significant risk of data loss and operational disruption for affected organizations, highlighting the dangers of identity-based attacks in cloud environments. This attack reflects an escalating trend of attackers targeting cloud platforms through abused credentials and automated open-source tooling. Organizations face increased regulatory scrutiny and operational risk, underscoring the critical need for zero trust segmentation, strong identity controls, and real-time monitoring of cloud platforms.
8 months ago
Kill Chain
Remote Code Execution in XWiki: CVE-2025-24893 Exploits Hit Enterprise Wikis
In November 2025, attackers began exploiting a critical remote code execution vulnerability (CVE-2025-24893) in the XWiki SolrSearch component, allowing even low-privileged users to trigger system-level commands via manipulated web requests. Although XWiki released a patch and advisory in February, broad exploitation did not emerge until the vulnerability was highlighted in the U.S. Known Exploited Vulnerabilities catalog in late October and weaponized using publicly available PoC code. The exploit chain involved attackers executing shell scripts fetched from an external server, potentially leading to data theft, malware deployment, or full system compromise in exposed enterprise wikis. This incident demonstrates the persistent risk posed by publicly disclosed vulnerabilities with lagging patch adoption; even niche, enterprise-focused applications can become attractive targets once exploitation is automated and high-profile. Organizations face mounting regulatory and business pressure to identify, patch, and harden externally exposed systems—especially as attackers increasingly weaponize proof-of-concept code for opportunistic campaigns.
8 months ago
Kill Chain
Open VSX Access Token Leak Triggers 2024 Supply-Chain Security Incident
In early June 2024, the Open VSX Registry—a key open-source repository for Visual Studio Code extensions—rotated its access tokens after developers inadvertently leaked credentials in public repositories. This exposure enabled unauthorized actors to publish malicious extensions, triggering a supply-chain attack that could have allowed widespread compromise of downstream developers and end users. Upon discovery, Open VSX revoked and replaced the affected tokens, advised pruning of potentially impacted extensions, and began audits to assess the scope of any malicious uploads. While swift action was taken, the incident highlighted ongoing risks associated with leaked credentials in public codebases and the challenges of securing distributed developer ecosystems. This supply-chain breach is highly relevant amid a surge in attacks abusing public software repositories and developer credentials. As threat actors increasingly target development tooling and code packages, organizations face rising pressure to enhance security around code signing, credential management, and extension vetting to reduce systemic software supply-chain risk.
8 months ago
Kill Chain
Nation-State Actors Infiltrate Ribbon Communications: 2024’s Latest APT Assault on US Telecom
In December 2023, Ribbon Communications, a major US telecommunications provider, suffered a cyber intrusion attributed to suspected nation-state actors. Attackers gained unauthorized access to parts of the company’s internal network, leveraging advanced persistent threat (APT) techniques to bypass existing security controls and maintain sustained access over several months. Although Ribbon discovered the breach and contained it by early 2024, the company has not confirmed whether sensitive customer or operational data was exfiltrated. The incident has raised concerns about the vulnerability of critical telecom infrastructure to espionage and cyber-enabled disruption. This breach exemplifies the escalating cyber risk telecoms face from organized, highly sophisticated attackers targeting supply chains and core communications platforms. With the telecommunications sector increasingly in the crosshairs of state-sponsored actors, the event spotlights the urgent need for zero trust, segmentation, and advanced detection controls.
8 months ago
Kill Chain
Conti Ransomware Operator Arrested: International Crackdown on Cybercrime in 2024
In July 2023, Ukrainian national Oleksii Oleksiyovych Lytvynenko, also known as Alexsey Alexseevich Litvinenko, was arrested in Ireland and later extradited to the United States on charges linked to his involvement with the notorious Conti ransomware group. Lytvynenko and his alleged co-conspirators infiltrated computer networks, stole and encrypted large quantities of sensitive data, and extorted ransom payments from over 1,000 victims worldwide—impacting public safety organizations and businesses across more than 30 countries. The group’s methods included stealing data, deploying ransomware, disseminating ransom notes, and leaking stolen information to force compliance. This case underscores the persistent threat posed by ransomware groups and highlights the evolving tactics attackers use, including rebranding after group takedowns. Lytvynenko’s prosecution demonstrates strengthened international law enforcement cooperation in cybercrime response, reinforcing the urgency for robust cyber defenses in the face of global ransomware operations.
8 months ago
Kill Chain
Extradition of Ukrainian Conti Ransomware Operator Marks Major 2024 Cybersecurity Win
In 2024, a Ukrainian national suspected of being a key member of the notorious Conti ransomware group was extradited from Ireland to the United States to stand trial. US authorities allege that the individual played a significant role in orchestrating and facilitating ransomware campaigns, which involved infiltrating business environments, moving laterally, and deploying ransomware to encrypt and extort high-profile organizations. The impact of these attacks has included major operational shutdowns, data exfiltration, and significant financial losses for victims across multiple sectors, with the incident underscoring the persistent reach and operational capability of sophisticated cybercrime syndicates. This case is emblematic of a global crackdown on ransomware actors and highlights the growing cooperation between international law enforcement agencies. The continued prevalence of ransomware-as-a-service models, coupled with advances in digital forensics and extradition protocols, makes this arrest—and those likely to follow—a critical signal in the ongoing fight against organized cybercrime.
8 months ago
Kill Chain
Windows Zero-Day Attack Exposes European Diplomats in 2024 Espionage Campaign
In early 2024, a threat group with links to China launched a targeted espionage campaign exploiting a previously unknown Windows zero-day vulnerability. The attackers aimed at European diplomats and associated governmental entities in countries including Hungary and Belgium. Armed with this zero-day, threat actors gained initial access, moved laterally within the network, and exfiltrated sensitive data from diplomatic communications and systems. The sophistication of the operation allowed them to evade traditional signature-based defenses, resulting in significant potential exposure of confidential state-level information and disruption of diplomatic activities. This incident underscores the ongoing shift towards advanced, nation-state–backed cyber-espionage using zero-day exploits. The rise of targeted attacks against governmental and diplomatic institutions highlights the necessity for modern threat detection, east-west traffic security, and proactive zero trust strategies to stay ahead of rapidly evolving adversary techniques.
8 months ago
Kill Chain
Ransomware Gangs Exploit Critical Linux Kernel Flaw in 2024 Attacks
In early 2024, a high-severity privilege escalation vulnerability (CVE-2024-1086) in the Linux kernel was actively exploited by multiple ransomware gangs, as confirmed by CISA. Attackers used the flaw to gain root access on targeted Linux systems, bypassing standard user restrictions. This escalation provided threat actors the means to deploy ransomware payloads, encrypt files, and cripple business operations across sectors relying on Linux servers. The attack chain typically started with initial compromise of a Linux system, followed by privilege escalation and lateral movement, exposing organizations to data loss and downtime. This incident underscores the growing trend of ransomware operators targeting critical open-source infrastructure through recent or unpatched vulnerabilities. Organizations must adapt their security posture rapidly, as evidence of weaponization demonstrates that patching and vigilant privilege management remain urgent for foundational platforms like Linux.
8 months ago
Kill Chain
Russian Authorities Dismantle Meduza Stealer Malware Group After Major Data Thefts (2024)
In June 2024, Russian law enforcement authorities arrested three alleged administrators behind the Meduza Stealer information-stealing malware in Moscow. The operation was part of a wider investigation following attacks on Russian organizations by the threat actor group, who distributed Meduza Stealer via phishing campaigns and illicit online forums. The malware targeted sensitive credentials, browser data, and cryptocurrency wallets, which were then exfiltrated to attacker-controlled servers. The arrests are expected to significantly disrupt the group’s operations and potentially curb related cybercriminal activity in the region. The Meduza Stealer case underscores the global proliferation of credential-stealing malware and highlights growing law enforcement action against cybercrime groups. With similar infostealer campaigns on the rise and rapid threat actor adaptation, organizations must prioritize endpoint protection and user awareness to stay ahead of evolving tactics.
8 months ago
Kill Chain
University of Pennsylvania 2024 Email Account Compromise: Lessons for Higher Ed
In June 2024, the University of Pennsylvania experienced a cybersecurity incident involving unauthorized access to internal email accounts. Students and alumni received a series of offensive emails from compromised university email addresses, with messages claiming data had been stolen in a security breach. Attackers leveraged email compromise, impersonating trusted university entities, and threatened to leak sensitive data, causing significant alarm among recipients. The university responded swiftly by investigating the breach, working with law enforcement, and reassuring the community that containment efforts were underway. This incident underscores the ongoing threat of email compromise and phishing-driven data breaches within higher education. With educational institutions facing increased attacks targeting both user trust and sensitive information, this event highlights the urgent need for robust email security, lateral movement detection, and strategic incident response planning.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports