Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Muji Halts Online Sales After Supply Chain Ransomware Hits Logistics Partner
In June 2024, Japanese retail giant Muji was forced to suspend its online sales after a logistics outage caused by a ransomware attack on Askul, its major delivery partner. The incident was triggered when attackers compromised Askul's systems, encrypting critical operational data and disrupting supply chain operations. As a result, Muji's ability to fulfill customer orders was severely impacted, highlighting the downstream risk associated with third-party vendors in an interconnected retail ecosystem. This breach not only halted Muji's core e-commerce activities but also underscored the vulnerability of global supply chains to cyber extortion. This event is particularly relevant as ransomware groups increasingly leverage supply chain attacks to maximize disruption and extort multiple victims. It reflects a rapid evolution in attacker tactics, where targeting essential providers amplifies business risk, and regulatory scrutiny on supply chain resilience continues to intensify.
8 months ago
Kill Chain
Qantas 2024 Data Breach: Legal Orders Fail, Security Controls Critical
In early 2024, Qantas Airways experienced a significant data breach when cybercriminals exfiltrated sensitive passenger and employee information. Despite an Australian court issuing an injunction to prevent the distribution of stolen data, the responsible threat actors ignored the legal order and leaked the compromised datasets on the dark web. The breach was confirmed by multiple data breach notification services. Attackers leveraged unencrypted traffic vulnerabilities and lateral movement inside Qantas systems, bypassing internal controls and highlighting deficiencies in east-west traffic security and zero trust segmentation. Business operations faced regulatory pressure, reputational damage, and potential compliance issues. This incident underscores the difficulties organizations face in containing modern breaches, especially as legal measures alone cannot halt the distribution or misuse of exposed data. The continued release and trade of stolen datasets emphasize the importance of proactive technical controls and the need for robust, automated detection and data governance in line with evolving compliance standards.
8 months ago
Kill Chain
Linux Fileless Malware in 2024: Syscall(memfd_create) Unlocks New Attack Vectors
In October 2024, security researchers discovered a new Linux-targeting fileless malware that exploits Python and the direct use of syscalls—specifically 'memfd_create'—to execute payloads entirely in memory, bypassing traditional disk-based detection. The attack begins with a Python dropper embedding a base64-encoded ELF binary, which is loaded directly into memory using syscall(319), then executes file encryption using a simple 1-byte XOR key. While the second stage payload is rudimentary and appears to be a proof-of-concept, the methodology demonstrates how easily threat actors can evade filesystem-based controls and endpoint security tools on Linux systems. The incident underscores an increasing trend in fileless malware and direct syscall manipulation, especially on Linux servers and cloud workloads. These advanced tactics make traditional detection and prevention approaches less effective, urging organizations to adopt stronger memory and process monitoring, inline threat detection, and zero-trust segmentation to mitigate similar threats.
8 months ago
Kill Chain
Fake Homebrew and LogMeIn Sites Spread Infostealer Malware via Google Ads in 2025
In October 2025, a sophisticated malvertising campaign exploited Google Ads to distribute infostealing malware via fake Homebrew, LogMeIn, and TradingView websites targeting macOS users and developers. The threat actors registered over 85 convincing domains and lured victims to enter terminal commands that downloaded malware such as AMOS (Atomic macOS Stealer) and Odyssey Stealer. Once executed, these payloads bypassed security controls, harvested browser credentials, cryptocurrency wallets, and sensitive files, and forwarded the stolen data to threat actor-controlled servers. This campaign underscores the effectiveness of ClickFix social engineering techniques and highlights the risks of trust in search advertising. The incident is particularly relevant as infostealer malware continues to evolve with new tactics, including sophisticated social engineering, supply chain targeting, and persistent access capabilities. Organizations face increasing pressure to defend against rapidly shifting malware delivery channels and enforce user education to reduce the likelihood of compromise.
8 months ago
Kill Chain
ConnectWise Automate 2025 Vulnerabilities: AiTM & Malicious Update Risks in the Supply Chain
In October 2025, ConnectWise disclosed and patched critical vulnerabilities in its Automate remote monitoring and management platform, widely used by managed service providers (MSPs) and enterprises. The most severe issue (CVE-2025-11492, CVSS 9.6) allowed agents to communicate sensitive information in cleartext over unencrypted HTTP, exposing them to adversary-in-the-middle (AiTM) attacks capable of intercepting or altering management traffic, including credentials and update payloads. A second flaw (CVE-2025-11493, CVSS 8.8) enabled attackers to bypass update integrity checks, facilitating the delivery of malicious software disguised as legitimate updates. Together, these vulnerabilities posed a significant supply chain threat, enabling network-based attackers to compromise customer environments via trusted management channels. This incident underscores the heightened attention on software supply chain vulnerabilities and AiTM risks, particularly among platforms entrusted with privileged access across thousands of customer endpoints. With adversaries increasingly exploiting weak encryption, incomplete update verification, and RMM tool supply chains, organizations must urgently strengthen controls around update validation, encrypted communications, and least privilege management to stay ahead of evolving attacker tactics.
8 months ago
Kill Chain
NPM Supply Chain Attack Exposes AdaptixC2 Framework via https-proxy-utils (2025)
In October 2025, security researchers discovered a malicious npm package named 'https-proxy-utils' which surreptitiously delivered the AdaptixC2 post-exploitation framework. The package mimicked legitimate proxy utility modules—closely resembling widely used packages like 'http-proxy-agent' and 'https-proxy-agent'—and included a post-installation script designed to download and execute the AdaptixC2 agent based on the victim's operating system. Once deployed, the agent enabled attackers to access infected machines, execute commands, and establish persistence, resulting in potential internal reconnaissance, lateral movement, and elevated risk of data exfiltration for organizations inadvertently including the tainted module in their development pipeline. This incident is emblematic of a rising wave of supply-chain attacks targeting open-source software ecosystems. The use of trusted distribution channels to propagate sophisticated frameworks like AdaptixC2 highlights the necessity for increased scrutiny of third-party software and ongoing vigilance against impersonation tactics in popular package registries.
8 months ago
Kill Chain
North Korean Hackers Target Job Seekers with Advanced Malware & Blockchain C2 (2024)
In early 2024, cybersecurity researchers from Cisco Talos and Google Threat Intelligence Group uncovered a sophisticated cyber-espionage campaign led by North Korea-aligned groups, Famous Chollima and UNC5342. These actors exploited job recruitment platforms by duping job seekers into downloading malicious code, including new malware strains—namely BeaverTail, OtterCookie, JadeSnow, and InvisibleFerret—during fake interview processes. The attackers leveraged advanced techniques such as blockchain-based command and control (EtherHiding) to exfiltrate credentials, steal cryptocurrency, and deploy ransomware. Information-stealing modules captured keystrokes and screen data, highlighting the ongoing evolution of North Korea’s threat ecosystem while successfully avoiding conventional detections. This incident underscores the persistent risks posed by nation-state threat actors utilizing social engineering and innovative evasion tactics. The convergence of credential theft, ransomware delivery, data exfiltration, and resilient C2 infrastructure signals an escalation in global threat sophistication, especially targeting corporate and finance sectors.
8 months ago
Kill Chain
Exploited Zero-Day in Gladinet CentreStack: Rapid RCE and the Need for Zero Trust
In October 2025, Gladinet patched a critical zero-day vulnerability (CVE-2025-11371) in its CentreStack file-sharing software, which had been exploited by threat actors since late September. The attackers leveraged a local file inclusion flaw to access the application's Web.config file and extract the machine key, subsequently exploiting a chained deserialization vulnerability (CVE-2025-30406) to achieve unauthenticated remote code execution. The service's SYSTEM-level privileges enabled lateral movement and sensitive file access. Gladinet released mitigations and a full patch, urging immediate client upgrades to prevent further compromise of business environments. This incident highlights a continuing trend in targeting widely used business collaboration platforms via sophisticated vulnerability chaining, often bypassing previous mitigations. The exploitation’s speed and public proof-of-concept release underscore the growing urgency for rapid patch management and proactive threat detection across enterprise SaaS deployments.
8 months ago
Kill Chain
Microsoft Disrupts 2025 Ransomware Campaign Using Fake Teams Installers
In October 2025, Microsoft successfully disrupted a ransomware campaign orchestrated by the threat group Vanilla Tempest (also known as Vice Society/VICE SPIDER) targeting Microsoft Teams users. Attackers used malvertising and SEO poisoning to promote websites impersonating the official Teams download page, tricking users into downloading malicious installers. These fake installers delivered the Oyster backdoor, granting attackers remote access for data theft, command execution, and the deployment of Rhysida ransomware. Microsoft responded by revoking over 200 abused code-signing certificates used to legitimize the malicious payloads, effectively hampering the campaign. This attack underscores the growing risk of supply chain compromise via trusted application installers and increasingly sophisticated social engineering techniques. The resurgence of ransomware-as-a-service operators leveraging signed malware highlights the urgent need for identity-driven defenses, vigilant certificate monitoring, and robust endpoint security measures.
8 months ago
Kill Chain
MANGO Data Breach 2024: Third-Party Vendor Incident Exposes Customer Data
In April 2024, Spanish fashion retailer MANGO reported that a data breach exposed customer personal information after one of its marketing vendors was compromised. The incident came to light when MANGO began notifying affected customers, stating that data such as names, contact details, and potentially other identifiers had been accessed without authorization. The intrusion was possible due to attackers breaching the marketing service provider’s environment, reflecting a concerning third-party risk. MANGO responded by collaborating with the vendor, investigating the incident, notifying authorities, and reinforcing security controls. This breach underscores a growing trend in supply-chain attacks where threat actors exploit weaker security in trusted partners. It highlights the urgent need for stringent vendor management, robust segmentation, and continuous monitoring, especially as regulatory focus intensifies on safeguarding consumer data throughout the supply chain.
8 months ago
Kill Chain
F5 2025 Supply Chain Breach: BIG-IP Vulnerabilities Exposed by State Hackers
In August 2025, cybersecurity company F5 detected a sophisticated supply chain attack resulting in the theft of source code and undisclosed vulnerabilities affecting its flagship BIG-IP products. The breach, attributed to state-sponsored hackers, did not lead to immediate exploitation but exposed potentially critical flaws. F5 responded by rapidly developing and releasing security patches for 44 vulnerabilities, proactively urging its global clientele—including many Fortune 500 companies and federal agencies—to update systems and implement enhanced monitoring. No evidence was found of modifications to the supply chain or active use of the stolen information as of disclosure. This incident highlights mounting concerns around supply chain security and zero-day vulnerability exposure, particularly within critical infrastructure and cloud environments. The breach also triggered regulatory intervention, with CISA issuing emergency directives for federal agencies, underscoring rising government attention to third-party risks and broader cybersecurity resilience in the face of advanced persistent threats.
8 months ago
Kill Chain
Fake LastPass & Bitwarden Breach Alerts: Phishing Attack Delivers Malware (2024)
In early June 2024, a sophisticated phishing campaign targeted users of password managers LastPass and Bitwarden. Attackers sent convincing emails, falsely claiming that the services had suffered security breaches and instructing recipients to download a new, supposedly more secure, desktop version. The malicious download actually installed malware, enabling attackers to hijack compromised PCs and potentially steal credentials or other sensitive data. Victims who downloaded the fake app were exposed to significant risks, including credential theft and remote control of their systems. This incident highlights escalating use of credible brand impersonation and urgent alert tactics by cybercriminals. The campaign underscores the vulnerabilities associated with password manager users and demonstrates the growing threat landscape for identity-driven and social engineering attacks.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports