Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 24 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 277–288 / 3786 reports
OVHcloud CLI Supply-Chain Hijack: How GlassWorm Turned a GitHub Release Into a Secret Stealer
OVHcloud CLI Supply-Chain Hijack: How GlassWorm Turned a GitHub Release Into a Secret Stealer
Information Technology/IT2 weeks ago

OVHcloud CLI Supply-Chain Hijack: How GlassWorm Turned a GitHub Release Into a Secret Stealer

On October 19, 2026, attackers hijacked a contributor's GitHub account and silently replaced download archives across five OVHcloud CLI releases (v0.11.0–v0.15.0) with a malicious binary designed to steal secrets stored on disk. The tampered files were live for up to 94 minutes before a customer's hash-pinning CI job detected the discrepancy and filed a public issue. The attack exploited the absence of GitHub's immutable-release setting, allowing anyone with repository write access to overwrite existing release artifacts without triggering the CI/CD pipeline. Affected users on macOS, Linux x86_64/arm64, and Windows x86_64 who installed or auto-upgraded during the window were advised to rotate all credentials immediately. This incident highlights a deepening supply-chain threat targeting developer toolchains: attackers are increasingly compromising trusted contributors rather than the build pipeline itself, bypassing conventional CI/CD controls. The campaign has been tentatively linked to GlassWorm, a threat actor known for hiding loader code in Unicode characters and abusing blockchain memo fields for C2 staging, signaling a sophisticated, multi-stage offensive posture against open-source ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
ARMORY CASTLE Is Actively Exploiting BeyondTrust Remote Support: What Your Security Team Must Do Today
ARMORY CASTLE Is Actively Exploiting BeyondTrust Remote Support: What Your Security Team Must Do Today
Information Technology/IT2 weeks ago

ARMORY CASTLE Is Actively Exploiting BeyondTrust Remote Support: What Your Security Team Must Do Today

In October 2026, CISA issued an urgent advisory disclosing active exploitation of CVE-2026-102764, a critical authentication bypass vulnerability in BeyondTrust Remote Support (formerly Bomgar) versions 24.3.1 and earlier. Threat actors tracked under the campaign identifier ARMORY CASTLE are leveraging this flaw to gain unauthenticated initial access to self-hosted Remote Support appliances, then establishing persistence, escalating privileges, and moving laterally across enterprise networks. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 16, 2026, and patch BT26-05-RS is available for supported versions. SaaS-hosted deployments were patched automatically, but on-premises environments remain at significant risk without immediate action. This incident underscores a persistent and accelerating pattern of threat actors targeting privileged remote-access and support infrastructure as a high-value initial access vector. As remote-access tooling becomes increasingly embedded in enterprise and government IT operations, unpatched appliances represent a critical exposure surface that adversaries are systematically scanning and exploiting within days of disclosure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants
ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants
Information Technology/IT2 weeks ago

ConnectWise Cloud Backup Breach 2026: How One Vendor Credential Unlocked Thousands of Microsoft 365 Tenants

In October 2026, ConnectWise disclosed a supply-chain credential compromise in which threat actors exploited a vendor application credential to gain unauthorized access to application identities tied to its Cloud Backup service. First identified on October 14, the attackers used a single compromised vendor credential from IP 144.172.64.128 to perform application sign-ins across thousands of Microsoft 365 tenants. Post-compromise activity included self-granting Global Administrator rights and backdooring additional applications with new secrets for persistence. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management services, reset credentials, and engaged third-party incident responders. Huntress telemetry across 10,000-plus tenants confirmed the scope. This incident underscores the accelerating threat of supply-chain credential abuse targeting managed service providers. As attackers increasingly pivot through trusted vendor relationships to reach downstream customers at scale, the ConnectWise breach exemplifies why identity hygiene, least-privilege application permissions, and real-time cross-tenant visibility have become non-negotiable security controls for MSP ecosystems in 2026.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Go's Emergency CA Block Exposes the Hidden PKI Risk Inside Your Cloud-Native Stack
Go's Emergency CA Block Exposes the Hidden PKI Risk Inside Your Cloud-Native Stack
Computer Software/Engineering2 weeks ago

Go's Emergency CA Block Exposes the Hidden PKI Risk Inside Your Cloud-Native Stack

On October 20, 2026, the Go team issued an emergency security release (versions 1.27.3 and 1.26.10) that hard-codes a block on eight intermediate certificate authority public keys linked to Indian CA eMudhra's emSign brand. Programs rebuilt against the new releases will refuse TLS connections and reject code signatures whose chains pass through any of the eight blocked keys—six TLS intermediates and two code-signing intermediates—under emSign Root TLS CA - G3 and emSign Root CS CA - G3. Mozilla independently added six related eMudhra certificates to its OneCRL revocation list two days prior. The Go team classified the fix on its URGENT track, reserved for active ecosystem-integrity threats, but has disclosed no specific misbehavior, leaving operators of Go-based services to reissue certificates immediately or face broken connectivity. This incident underscores an accelerating pattern of browser and runtime vendors taking unilateral, emergency action against certificate authorities without public disclosure—compressing the remediation window for enterprises that depend on affected PKI chains and highlighting how supply-chain trust decisions made in CA root programs ripple instantly into production software deployments worldwide.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
When AI Attacks at Machine Speed: Inside the Cairn Agent Campaign That Hit 1,200 Sites
When AI Attacks at Machine Speed: Inside the Cairn Agent Campaign That Hit 1,200 Sites
Retail Industry2 weeks ago

When AI Attacks at Machine Speed: Inside the Cairn Agent Campaign That Hit 1,200 Sites

Beginning around October 2, 2026, a Chinese-speaking threat actor deployed autonomous AI agents via the open-source penetration-testing framework Cairn to systematically target over 1,200 company websites, successfully compromising more than 100 organizations including Deere, SharkNinja, and Cummins. Operating largely unsupervised, the agents exploited web application vulnerabilities—including memcached session-store misconfigurations, unsafe PHP object deserialization, and legacy Zend Framework weaknesses—to plant persistent web shell uploaders. Successful intrusions averaged 23 hours at roughly $50 per breach, with the entire campaign costing an estimated $5,000. The exposed Cairn control panels also leaked harvested credentials and secrets, 11% of which remained valid at time of discovery. This incident marks a watershed moment in offensive AI tradecraft: for the first time, a documented criminal campaign used agentic AI at scale to autonomously discover, exploit, and establish persistence across enterprise web properties with minimal human oversight. The barrier to sophisticated, multi-target web intrusion has collapsed, demanding that defenders modernize detection and network policy enforcement to match machine-speed attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CVE-2026-106173: Public PoC Exploit Drops for Critical FortiSIEM Unauthenticated RCE
CVE-2026-106173: Public PoC Exploit Drops for Critical FortiSIEM Unauthenticated RCE
Information Technology/IT2 weeks ago

CVE-2026-106173: Public PoC Exploit Drops for Critical FortiSIEM Unauthenticated RCE

In October 2026, Fortinet disclosed CVE-2026-106173, a critical path traversal vulnerability in FortiSIEM (CVSS 9.4) affecting versions up to 7.5.0. Unauthenticated attackers can connect to the gRPC service on TCP port 27918, exploit unsafe path construction in the SendQueryResult() function, and chain a null-byte injection technique to overwrite arbitrary files—including a Redis health-check shell script executed every 60 seconds by a cron job—achieving full unauthenticated remote code execution. Horizon3.ai published a public proof-of-concept exploit within days of patching, dramatically lowering the bar for exploitation across all unpatched FortiSIEM deployments. The public release of a working PoC transforms this from a theoretical risk into an active, weaponizable threat. Security operations platforms like FortiSIEM are high-value targets because compromising them can blind defenders, disrupt incident response, and provide attackers with privileged visibility into an organization's entire security telemetry—amplifying blast radius far beyond a typical application breach.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Powered Espionage: How CL-UNK-1211 Used LLMs to Target Government Linux Servers
AI-Powered Espionage: How CL-UNK-1211 Used LLMs to Target Government Linux Servers
Government Administration2 weeks ago

AI-Powered Espionage: How CL-UNK-1211 Used LLMs to Target Government Linux Servers

Between October 2025 and April 2026, Unit 42 tracked a threat cluster designated CL-UNK-1211 conducting an AI-accelerated espionage campaign against government entities and state-affiliated Linux infrastructure. Attackers gained initial access through widespread web shell deployments, hijacked global PHP configurations for persistence, harvested credentials via .bashrc manipulation and PHP injection, deployed a custom Go-based cross-platform RAT named SysGoRAT over WebSocket C2, and exfiltrated government mailboxes and entire database contents. Defense evasion included log deletion, timestomping, endpoint-protection termination, and planting fake red-team markers. AI-generated payloads with conversational inline comments accelerated the operation's pace across PHP, Python, Bash, and JavaScript. This campaign marks a tangible inflection point in state-level or state-adjacent espionage: AI is no longer theoretical in offensive operations. Attackers used LLM-generated code to compress development timelines, seamlessly pivot across technology stacks, and scale payload generation—signaling that AI-assisted intrusions will become the baseline expectation for advanced threat actors targeting critical government infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
The $0 AI Backdoor: How Open-Weight Models Became a Supply Chain Threat
The $0 AI Backdoor: How Open-Weight Models Became a Supply Chain Threat
Information Technology/IT2 weeks ago

The $0 AI Backdoor: How Open-Weight Models Became a Supply Chain Threat

Researchers demonstrated in 2026 that open-weight AI models—particularly those distributed via platforms such as Hugging Face—can be covertly backdoored at negligible cost using a rented GPU and a public dataset. The attack embeds a dormant trigger inside model weights, allowing the model to pass all standard evaluations and operate normally until a predetermined phrase activates exfiltration behavior. A proof-of-concept on a 1.5B and 7B parameter model showed that, when triggered inside OpenAI's Codex CLI, the model silently exfiltrated project credentials to an attacker-controlled URL—with no intermediate detection layer raising an alert. This threat is accelerating as enterprises rapidly integrate open-weight LLMs into agentic pipelines, coding assistants, and automated workflows. The near-zero cost of poisoning a model, combined with the popularity of abliterated builds on public repositories, means the AI supply chain now carries a class of risk that traditional software composition analysis tools are not equipped to detect.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Armory Castle's BeyondTrust Zero-Day Campaign: What Security Teams Must Do Now
Armory Castle's BeyondTrust Zero-Day Campaign: What Security Teams Must Do Now
Government Administration2 weeks ago

Armory Castle's BeyondTrust Zero-Day Campaign: What Security Teams Must Do Now

Beginning August 29, a prolific Chinese state-sponsored espionage group—tracked by Mandiant and Google Threat Intelligence Group (GTIG) as Armory Castle (formerly UNC5221)—exploited a critical zero-day vulnerability (CVE-2026-102764) in BeyondTrust Remote Support. The attackers escalated privileges, moved laterally across compromised networks, and maintained stealthy persistent access for nearly a month before detection on September 28. BeyondTrust patched self-hosted instances on October 8 and auto-updated cloud versions the same day. Targets span government, legal services, technology firms, and business-process outsourcers across multiple regions, with researchers warning of broader potential exposure given the zero-day's pre-disclosure exploitation window. Armory Castle's campaign continues a well-established pattern of targeting edge and remote-access security products—Ivanti, Citrix NetScaler, and now BeyondTrust—that typically lack EDR coverage. The group's tradecraft includes per-victim infrastructure rotation and dwell times averaging hundreds of days, raising urgent concern for organizations relying on perimeter-based security without zero-trust network segmentation or east-west traffic visibility.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PwnEscape (CVE-2026-99999): When a Guest VM Reads Your Host's Memory
PwnEscape (CVE-2026-99999): When a Guest VM Reads Your Host's Memory
Information Technology/IT2 weeks ago

PwnEscape (CVE-2026-99999): When a Guest VM Reads Your Host's Memory

In October 2026, security researcher Paulos Yibelo of pwn.ai disclosed CVE-2026-99999, dubbed PwnEscape, a critical Linux kernel networking vulnerability rated 9.3/10 CVSS. The flaw allows malicious code executing inside a guest virtual machine to read host memory, crash the host, and potentially achieve code execution on it. Demonstrated live against Vercel's production Firecracker microVM sandboxes during a $1 million bug-bounty challenge, each crafted packet exfiltrated approximately 32 bytes of host memory. Two packets sufficed to crash a host and terminate all co-resident sandboxes. Red Hat's Michael S. Tsirkin authored the upstream fix, now backported across all supported stable kernel branches. PwnEscape exposes a structural risk in multi-tenant cloud infrastructure: because nearly every major cloud provider isolates workloads at the Linux kernel networking layer, a single kernel flaw undermines the trust boundary between all co-resident tenants simultaneously. As AI-assisted exploit research matures—this flaw was found in three days for under $700 in API costs—the window between discovery and weaponization is collapsing, demanding accelerated patch cycles and defense-in-depth network controls.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
PEERSTITCH: How Attackers Weaponized FortiOS Internals to Build an Invisible VPN Backdoor
PEERSTITCH: How Attackers Weaponized FortiOS Internals to Build an Invisible VPN Backdoor
Telecommunications2 weeks ago

PEERSTITCH: How Attackers Weaponized FortiOS Internals to Build an Invisible VPN Backdoor

In September 2024, a suspected advanced persistent threat actor tracked as CL-STA-0954 (UNC5820) compromised a telecommunications managed service provider by chaining two Fortinet vulnerabilities. Initial access was gained via CVE-2024-47575 (FortiJump) targeting FortiManager, enabling exfiltration of configurations, private keys, and metadata for over 500 managed FortiGate firewalls. Attackers then exploited CVE-2025-61624, a FortiOS path traversal flaw, to deploy PEERSTITCH—a memory-resident ARM64 implant that injects hooks into legitimate daemons (miglogd and iked) to create a covert inter-process communication bridge, effectively bypassing VPN session security checks without leaving disk artifacts. This incident signals an accelerating trend of state-linked actors weaponizing centralized network management platforms to compromise downstream infrastructure at scale. The combined use of living-off-the-land injection techniques, WebAssembly payloads, and forensic artifact removal represents a maturation of edge-device malware tradecraft that outpaces conventional endpoint and network detection approaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Armory Castle's BeyondTrust Zero-Day: How a Remote Support Appliance Became a Nation-State Espionage Gateway
Armory Castle's BeyondTrust Zero-Day: How a Remote Support Appliance Became a Nation-State Espionage Gateway
Government Administration2 weeks ago

Armory Castle's BeyondTrust Zero-Day: How a Remote Support Appliance Became a Nation-State Espionage Gateway

In late August 2026, China-nexus threat actor Armory Castle (UNC5221/Warp Panda) exploited CVE-2026-102764, a critical zero-day in BeyondTrust Remote Support appliances, to seize full administrative control of targeted self-hosted systems. The group deployed a PHP web shell (SAWFLY) for persistent C2, used a custom SOCKS5 proxy tool (BARECLAW) for traffic tunneling, harvested stored credentials via proprietary CLI utilities, and pivoted laterally to downstream endpoints via the appliance's Jump Item list—exfiltrating sensitive documents while systematically erasing logs to hinder detection. CISA added the vulnerability to its KEV catalog on October 16, 2026, mandating federal remediation by October 19. Armory Castle's campaign exemplifies an accelerating pattern of state-sponsored actors pre-positioning zero-days against high-value remote-access and IT management infrastructure. As enterprises increasingly rely on privileged remote-support platforms spanning hybrid and multicloud environments, attackers who compromise these chokepoints gain instant, credential-rich access to the entire downstream estate—making network segmentation, east-west visibility, and egress control more critical than ever.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports