Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Red Hat Consulting Breach 2024: Crimson Collective Launches Major Supply Chain Attack
In April 2024, the Crimson Collective, in collaboration with elements of the Lapsus$ group, executed a supply chain attack targeting Red Hat Consulting by breaching its GitLab instance. The attackers gained unauthorized access through credential compromise and lateral movement across internal infrastructure, successfully exfiltrating sensitive source code and internal communications. The breach, which remained undetected for several days, raised concerns over east-west traffic security, lack of segmentation, and insufficient anomaly detection within Red Hat Consulting’s cloud development supply chain. This incident highlights the increasing prevalence of supply chain attacks leveraging lateral movement and sophisticated alliance between threat groups. Its relevance is underscored by renewed regulatory scrutiny, the growing risk posed by collaborative cybercriminal operations, and heightened demand for zero trust architecture and cloud-native threat mitigation strategies.
8 months ago
Kill Chain
Vampire Bot: Infostealer Malware Drains Job Hunters in BatShadow’s 2024 Campaign
In early June 2024, security researchers uncovered a widespread infostealer campaign targeting global job seekers through malicious job postings across popular employment platforms. The attack, orchestrated by the Vietnamese cybercriminal group BatShadow, involved the sophisticated Vampire Bot malware, which was delivered via phishing emails and deceptive job application portals. Once installed, Vampire Bot silently harvested sensitive personal data, login credentials, and browser-stored financial information, enabling unauthorized access to victims' accounts. Numerous job seekers reported financial losses and identity theft, highlighting the campaign's destructive business and personal impacts. This incident underscores a growing trend of cybercriminal groups exploiting economic anxieties and job market vulnerabilities to launch tailored infostealer attacks. The operation signals a broader shift towards targeted social engineering and the increasing professionalization of threat actors in Southeast Asia.
8 months ago
Kill Chain
Chaos Ransomware's C++ Upgrade: The 2024 Threat Every Enterprise Must Face
In early 2024, the Chaos Ransomware-as-a-Service operation unleashed a potent new C++ variant, featuring advanced encryption, wiper functionalities, and cryptocurrency-stealing modules. This evolution targets a broad array of victims by leveraging aggressive lateral movement across networks, rapid data encryption, and selective data destruction to intensify pressure on organizations. The threat actors deploy sophisticated evasion tactics and can pivot across cloud and hybrid infrastructures, resulting in operational disruptions and financial losses, especially in environments lacking east-west traffic controls and advanced detection capabilities. The Chaos ransomware upgrade exemplifies a broader trend of rapidly advancing ransomware toolkits integrating destructive and extortion-focused modules. With a spike in cross-industry ransomware incidents and escalating regulatory pressure to remediate compliance gaps, organizations must urgently reevaluate defenses, with emphasis on segmentation, visibility, and high-speed encrypted traffic controls.
8 months ago
Kill Chain
GitHub Copilot CamoLeak: AI Attack Demonstrates Exfiltration Risk in 2024
In early 2024, cybersecurity researchers disclosed a proof-of-concept (PoC) called 'CamoLeak' demonstrating a novel attack vector exploiting GitHub Copilot’s AI code completion capability for data exfiltration. The PoC showed how sensitive code snippets and secrets could be extracted from Copilot instances by crafting malicious prompts that trick the AI into leaking previously seen proprietary content. While GitHub employs robust internal mitigations, the research exposes significant risks for organizations integrating generative AI tools into development workflows, particularly where prompt and response data may be inadequately secured. This incident underscores the rapid evolution of attack techniques targeting GenAI platforms and highlights emergent threats of data leakage through AI-driven automation. As enterprises increasingly leverage AI coding assistants, understanding and mitigating AI-enabled exfiltration vectors is key to upholding governance, compliance, and intellectual property security.
8 months ago
Kill Chain
Nation-State Ransomware: Storm-2603 Exploits Velociraptor in 2024 Attacks
In early 2024, the Storm-2603 threat group, attributed to Chinese nation-state actors, conducted a series of ransomware campaigns leveraging the legitimate Velociraptor digital forensics and incident response (DFIR) tool. By abusing Velociraptor, the attackers achieved persistent access, lateral movement, and stealthy data collection within targeted corporate environments. The group exploited weaknesses in east-west traffic security and endpoint controls, using legitimate tooling to evade detection and deploy ransomware payloads, leading to operational disruption and potential data exfiltration for multiple organizations. This incident highlights an escalation in adversaries’ use of legitimate IT and forensics tools for malicious purposes, complicating detection strategies. It exemplifies the growing threat of "living-off-the-land" tactics, where attackers blend in with standard operations, underscoring the need for improved anomaly detection, zero trust segmentation, and lateral movement controls.
8 months ago
Kill Chain
RondoDox Botnet Unleashes 'Exploit Shotgun' on Edge Devices
In early 2024, cybersecurity researchers uncovered the RondoDox Botnet, a rapidly evolving threat that leverages an 'exploit shotgun' methodology to compromise a wide range of consumer edge devices worldwide. The botnet scans for and exploits multiple zero-day and known vulnerabilities across routers and IoT devices, often gaining initial access through unpatched firmware or exposed management interfaces. Once inside, RondoDox deploys malware that enables remote control, data exfiltration, and lateral movement, allowing attackers to build a resilient, distributed botnet infrastructure which has been used for DDoS attacks and potentially other malicious activities. The decentralized campaign demonstrates sophisticated automation, making incident response and containment significantly more difficult for defenders. This incident is highly relevant as it highlights the surge in automated botnet attacks targeting unmanaged edge devices, a trend driven by increasing adoption of IoT and remote work infrastructure. The RondoDox tactics underscore the urgency for organizations to address lateral movement, patch management, and zero trust segmentation, especially as regulatory scrutiny on device and network security continues to intensify.
8 months ago
Kill Chain
Pixnapping Attack: How Android 2FA Was Bypassed in 2024
In early 2024, researchers discovered a novel mobile vulnerability known as the 'Pixnapping' attack, which targeted Android applications to circumvent two-factor authentication (2FA) mechanisms. The attack leverages cleverly crafted overlays to capture sensitive information directly from protected apps such as Gmail, Google Accounts, Google Authenticator, Google Maps, Signal, and Venmo. While there is no evidence of widespread exploitation, the proof-of-concept demonstrates that malicious apps with appropriate permissions could bypass Android security boundaries, enabling attackers to steal both credentials and 2FA tokens, thereby jeopardizing highly sensitive user data on compromised devices. This incident underscores the urgent need for stronger in-app security controls and constant vigilance regarding permission granularity on mobile platforms. As more threat actors focus on mobile endpoints and multi-factor authentication, organizations and users must adapt their defenses to counter increasingly sophisticated and evasive attack methods.
8 months ago
Kill Chain
Microsoft's October 2025 Zero-Day Storm: What the Massive Patch Update Means for Your Business
In October 2025, Microsoft released a massive Patch Tuesday security update addressing over 100 vulnerabilities across its product suite, including multiple actively exploited zero-days and several high-severity privilege escalation flaws. Threat actors leveraged some of these unpatched vulnerabilities to gain elevated access to enterprise and government systems, exploiting both on-premises and cloud workloads. The update also marked the final round of Windows 10 security patches, raising urgency for legacy system owners to upgrade in order to remain protected. The overall business impact included increased risk of lateral movement, data exfiltration, service disruptions, and heightened remediation costs for organizations slow to patch. This incident underscores an ongoing trend of attackers rapidly weaponizing newly disclosed vulnerabilities, as well as the growing threat facing organizations who rely on end-of-life software. The scale and speed of exploit adoption highlight the critical importance of vulnerability management and proactive patching as top security priorities.
8 months ago
Kill Chain
Microsoft VS Code Marketplace Plugins Leak Sensitive Secrets: Supply Chain Alert
In early 2024, security researchers uncovered over 550 unique authentication secrets (such as API keys and credentials) leaking from extensions published on Microsoft's Visual Studio Code Marketplace. The exposed secrets, embedded within third-party extensions, created a major supply chain risk by potentially allowing attackers to compromise developer environments or escalate access to sensitive systems. Microsoft responded by enhancing its security review process, warning affected publishers, and initiating additional controls to prevent similar exposures in the future. This incident highlights the growing risks tied to open software ecosystems, where attackers increasingly target supply chain dependencies. With developer tools and plugin marketplaces at the core of modern workflows, secret leakage could enable widespread compromise, pushing organizations to urgently strengthen code supply chain security and compliance.
8 months ago
Kill Chain
Phishing Surge Exposes Password Manager Vulnerabilities: Lessons from the 2024 LastPass Incident
In early 2024, a series of highly targeted phishing campaigns were launched against users of LastPass and other leading password managers. Threat actors masqueraded as trusted service communications to exploit user trust, distributing convincing emails and fraudulent alerts to trick victims into providing master credentials or installing malicious software. Despite existing security controls, the attackers leveraged sophisticated social engineering and exploited the single point of failure inherent to password vaults, putting sensitive enterprise and personal accounts at risk. The attack underscores the vulnerability of credential management platforms to phishing-driven infiltration and the potential for widespread credential compromise. This incident highlights a surge in credential phishing tactics aimed at circumventing advanced security measures by exploiting human error. As password managers become more widespread, attackers are evolving methods to target the trust users place in these tools, emphasizing the need for continuous security awareness, robust MFA adoption, and proactive anomaly detection around high-value authentication solutions.
8 months ago
Kill Chain
Microsoft Halts Rhysida Ransomware Campaign Abusing Azure Certificates
In early 2024, Microsoft uncovered and disrupted a sophisticated ransomware campaign in which attackers abused more than 200 stolen or forged Azure Active Directory certificates to sign malicious Microsoft Teams binaries. This campaign, attributed to the Rhysida ransomware group, enabled threat actors to appear as legitimate Microsoft services, bypassing security controls and delivering the final ransomware payloads to targeted enterprise environments. Following detection, Microsoft swiftly revoked the malicious certificates and worked with affected customers to mitigate the threat, limiting further operational and financial damage. This incident underscores the increased attacker focus on abusing trusted cloud identities and supply chain trust mechanisms to facilitate stealthy lateral movement and ransomware deployment. Organizations are now under greater pressure to strengthen certificate governance, cloud identity monitoring, and east-west traffic security controls as threat actors escalate the abuse of cloud-native infrastructure.
8 months ago
Kill Chain
GlassWorm: A Self-Propagating Supply Chain Worm Targets VS Code Developers
In early 2024, a sophisticated supply chain attack targeting the Visual Studio Code (VS Code) developer ecosystem was uncovered, leveraging a self-propagating worm dubbed 'GlassWorm.' The attack exploited weaknesses in package distribution and dependency validation, spreading rapidly via malicious code hidden in open-source extensions and packages. Once executed on developer machines, GlassWorm covertly harvested credentials and turned compromised systems into nodes for broader criminal infrastructure, affecting nearly 36,000 endpoints globally. The incident illuminated the risks posed by highly automated, invisible code propagation through trusted development tools, impacting developer productivity and increasing the potential for downstream compromise across organizations that rely on shared code repositories. This breach is emblematic of the accelerating trend of supply chain attacks against development environments, with threat actors increasingly leveraging automation and legitimate software to undermine trust. The GlassWorm incident underscores the urgency for enhanced visibility, stringent code validation, and zero trust controls in modern software supply chains to counter evolving adversary tactics.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports