Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Critical 2025 Raisecomm Authentication Bypass: Root Access Risk to ICS Networks
In October 2025, a critical remote authentication bypass vulnerability (CVE-2025-11534) was publicly disclosed in Raisecomm RAX701-GC series network equipment, allowing unauthenticated attackers to establish SSH sessions and gain root shell access without providing valid credentials. Discovered and reported by security researchers from runZero, this exploit poses an elevated risk to infrastructure sectors relying on these devices globally, as affected firmware versions remain susceptible with exploits achievable at low complexity and no prior privileges. Business and operational impacts include full remote compromise, lateral movement potential, and the ability for attackers to implant persistent threats or disrupt essential communications and IT operations. The incident is especially pressing now, indicating a rising trend in targeting embedded and edge devices in critical environments via misconfigurations or software flaws. As attackers expand their focus to accessible infrastructure, organizations face increasing pressure to implement robust access controls, proactive segmentation, and defense-in-depth strategies to safeguard operational networks.
8 months ago
Kill Chain
CISA Warns of Active Exploitation: Motex LANSCOPE CVE-2025-61932 Added to KEV List
In October 2025, CISA added CVE-2025-61932 to its Known Exploited Vulnerabilities catalog after confirmation that attackers were actively exploiting an improper verification of source vulnerability in Motex LANSCOPE Endpoint Manager. This flaw enables malicious actors to bypass authentication controls or inject unauthorized communications by exploiting weak checks on communication channels. As a result, federal networks and enterprises using the affected endpoint management platform face increased risk of unauthorized access, lateral movement, and potential data compromise. The vulnerability was discovered as part of ongoing efforts to monitor critical endpoint management systems for exploitation in the wild and is considered a significant risk vector, especially for organizations reliant on enterprise management tools. The inclusion of this vulnerability in CISA’s KEV catalog underscores a broader surge in attacks targeting endpoint management platforms, reflecting the ongoing evolution of attacker techniques against core IT infrastructure. Timely patching and visibility into east-west traffic is increasingly essential, as threat actors exploit gaps before organizations can remediate newly disclosed weaknesses.
8 months ago
Kill Chain
Microsoft WSUS RCE Vulnerability (CVE-2025-59287) Exposes Critical Infrastructure
In October 2025, Microsoft disclosed and released an out-of-band security update for a critical remote code execution vulnerability (CVE-2025-59287) affecting Windows Server Update Services (WSUS) across multiple Windows Server versions (2012–2025). The flaw allowed unauthenticated remote attackers to execute arbitrary code with SYSTEM privileges on unpatched WSUS servers, particularly when ports TCP 8530/8531 were exposed. Exploitation involved spawning child processes through wsusservice.exe or w3wp.exe, with threat actors leveraging PowerShell payloads and potentially broader lateral movement. Organizations failing to patch faced severe risk of compromise. This incident underscores the escalating trend of supply chain and infrastructure attacks, where core update and provisioning mechanisms are targeted to gain privileged access or disrupt operations. Active exploitation and KEV listing prompt heightened urgency for organizations to address legacy system exposures and reinforce privileged system monitoring.
8 months ago
Kill Chain
Vertikal Systems 2025: Healthcare Data at Risk via Hospital Manager Backend Vulnerabilities
In September 2025, Vertikal Systems disclosed two critical vulnerabilities affecting its Hospital Manager Backend Services. The first flaw (CVE-2025-54459) allowed unauthorized, remote access to the ASP.NET tracing endpoint, potentially exposing sensitive data such as authorization tokens and server metadata. The second (CVE-2025-61959) disclosed verbose error pages on invalid requests, inadvertently leaking application stack traces and configuration files. Both issues were exploitable without authentication, posing significant data privacy and operational risk across healthcare sites globally. This incident spotlights ongoing risks to healthcare organizations due to misconfigurations and unnecessary exposure of sensitive developer endpoints. With increasing regulatory pressure on patient data security and the healthcare sector's targeted threat profile, such vulnerabilities could lead to compliance violations or facilitate wider attacks.
8 months ago
Kill Chain
CISA Highlights Active Exploitation of XWiki & VMware Vulnerabilities in 2025 KEV Catalog Update
In October 2025, CISA added two actively exploited vulnerabilities—CVE-2025-24893 in XWiki Platform (Eval Injection) and CVE-2025-41244 in Broadcom VMware Aria Operations and VMware Tools (Privilege Defined with Unsafe Actions)—to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws enable remote attackers to inject malicious code or escalate privileges, presenting substantial risks for the federal enterprise and beyond. The inclusion in the KEV Catalog signals confirmed in-the-wild exploitation and compels agencies to expedite remediation measures under Binding Operational Directive 22-01 to protect critical federal infrastructure networks. This incident underscores the persistent trend of attackers rapidly leveraging new or previously overlooked vulnerabilities with real-world consequences. As the speed of exploitation shortens and attack surfaces broaden, timely vulnerability management, zero trust practices, and proactive monitoring remain vital to reducing enterprise cyber risk.
8 months ago
Kill Chain
PhantomRaven’s Malicious npm Packages: 2024 Supply-Chain Risk with Invisible Dependencies
In early 2024, the "PhantomRaven" campaign targeted the open-source software ecosystem by distributing 126 malicious npm packages containing concealed, 'invisible' dependencies. These packages, published over several months, bypassed detection mechanisms and were downloaded over 86,000 times by unsuspecting developers. Threat actors leveraged these supply chain attacks to potentially exfiltrate sensitive data, propagate malware, or serve as initial entry points for deeper compromises in downstream applications and organizations dependent on these packages. The campaign highlighted significant vulnerabilities in supply-chain security and the risks associated with open-source package management. This incident is part of a rising trend of sophisticated supply-chain attacks leveraging trusted developer tools and repositories. With increasing regulatory scrutiny and mounting pressure to harden software dependencies, organizations must assess their exposure and implement robust controls to thwart similar attacks in the future.
8 months ago
Kill Chain
PhantomRaven Floods npm with Malicious Credential-Stealing Packages
In April 2024, the 'PhantomRaven' threat campaign targeted the JavaScript software ecosystem by flooding the npm package repository with dozens of malicious packages. These packages, aimed at developers and CI/CD environments, were crafted to harvest authentication tokens, CI/CD secrets, and GitHub credentials when installed. Attackers employed typosquatting and deceptive package naming techniques to trick developers into integrating the compromised code into their applications, thereby enabling broad access to source code and sensitive internal systems. The attack underscores the growing risk posed by software supply chain compromises, impacting thousands of potential downstream applications and organizations. This incident highlights an ongoing surge in supply chain attacks leveraging public code repositories, targeting both individual developers and enterprise development pipelines. Attackers are increasingly employing credential harvesting via trusted open-source channels, intensifying regulatory scrutiny and driving immediate needs for enhanced software integrity controls and threat detection across development workflows.
8 months ago
Kill Chain
Malicious npm Package Attack Exposes Software Supply Chain Risks in 2024
In June 2024, security researchers identified a supply chain attack involving at least ten malicious npm packages uploaded to the public registry. Masquerading as legitimate software components, these packages were designed to infect developer environments across Windows, Linux, and macOS. Once installed, they downloaded and executed an information-stealing payload capable of harvesting sensitive data such as credentials and environment variables, potentially enabling lateral movement or further breaches within affected organizations. The attack leveraged trusted software distribution channels to bypass traditional defenses and amplify impact among open-source users. This incident underlines escalating risks in the software supply chain, highlighting how open-source package ecosystems have become prime targets for attackers. The trend represents a growing challenge for organizations relying on third-party code, driving new urgency around vetting procedures, continuous monitoring, and enforcing granular security controls in developer pipelines.
8 months ago
Kill Chain
10 Malicious npm Packages Expose Global Supply Chain Risks in 2025 Credential Stealer Attack
In October 2025, security researchers uncovered a coordinated supply chain attack targeting the npm ecosystem. Ten malicious npm packages, collectively downloaded over 5,000 times, were found to contain sophisticated multi-platform information stealers. These packages, distributed via the npm registry and impersonating legitimate developer tools, leveraged obfuscated code to deploy a payload capable of extracting sensitive credentials and environment data from Windows, macOS, and Linux developer workstations. The malware used deceptive tactics like a fake CAPTCHA screen and fingerprinted victims prior to exfiltrating stolen data to attacker-controlled infrastructure. This incident underscores the growing trend of software supply chain attacks, as developer tool ecosystems like npm remain high-value targets for both financially motivated cybercriminals and state-sponsored groups. The event has fueled concerns about package registry hygiene, developer workstation security, and the need for stronger zero trust and anomaly detection controls across the software development lifecycle.
8 months ago
Kill Chain
Russian APT Attackers Compromise Ukrainian Networks Using Living-Off-the-Land (LOTL) Tactics
In mid-2025, Russian advanced persistent threat (APT) actors launched highly targeted campaigns against Ukrainian organizations, focusing on business services firms and local government entities. Over the course of several weeks, attackers gained initial access through stealthy living-off-the-land (LOTL) techniques, leveraging legitimate administrative tools and native Windows utilities to evade detection and persist on networks. Their primary objectives were the exfiltration of sensitive data and establishing long-term, covert access, which allowed the attackers to move laterally with minimal noise and avoid triggering common security alerts. The operational impact included compromise of confidential internal documents and increased risk to ongoing operations. This incident underscores a growing reliance on LOTL tactics by sophisticated nation-state actors, complicating traditional detection and response methods. With geopolitical tensions in Eastern Europe remaining high, organizations and government agencies must anticipate and defend against stealthy, low-profile intrusions that exploit trusted system tools to bypass conventional defenses.
8 months ago
Kill Chain
Identity Chaos: 2026 Breach Highlights Risks of Ghost Accounts & AI Agents
In mid-2026, a coordinated cyberattack leveraged unmanaged 'ghost' identities and dormant privileged accounts in a multinational enterprise's cloud environment. Advanced threat actors combined long-standing identity debt from old breaches with modern, AI-powered autonomous agents to hijack internal east-west traffic and exfiltrate sensitive data using encrypted channels. The attackers discreetly escalated privileges through unused accounts, bypassed segmentation controls, and evaded legacy monitoring through encrypted, high-speed service-to-service traffic. This led to a multi-week data theft and operational disruption across cloud, on-premises, and hybrid infrastructure, impacting customer trust and critical regulatory compliance. This incident highlights the urgent need for advanced identity governance and zero trust segmentation as adversaries exploit both inherited identity risks and cutting-edge automation. With ransomware and shadow AI toolchains on the rise, organizations face increasing regulatory scrutiny and evolving attack surfaces that obsolete traditional perimeter-based defenses.
8 months ago
Kill Chain
Cloaking Attack Against AI Crawlers Uncovers New Context Poisoning Risks
In October 2025, cybersecurity researchers uncovered a sophisticated cloaking attack that targets AI-driven web crawlers used by popular agentic browsers such as OpenAI ChatGPT Atlas and Perplexity. Threat actors deployed malicious websites capable of serving misleading or false content only to AIbots, while displaying legitimate information to typical users. This context poisoning technique allows harmful actors to manipulate AI models at scale, tricking them into citing fabricated facts as verified information, and undermines AI trustworthiness with widespread downstream effects on automated decision-making and knowledge dissemination. This incident highlights the mounting risks from adversarial attacks targeting AI supply chains. As AI systems increasingly rely on real-time internet data, attackers are innovating new manipulation tactics to poison context and subvert trust. The surge in such TTPs coincides with tighter regulations and industry push towards Responsible AI frameworks.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports