Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3797 threat reports
Page 245 of 317
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 2929–2940 / 3797 reports
Amazon Thwarts Massive North Korean IT Job Scam: Lessons in Zero Trust and Insider Defense
Information Technology/IT10 months ago

Amazon Thwarts Massive North Korean IT Job Scam: Lessons in Zero Trust and Insider Defense

In 2024, Amazon confronted a surge of over 1,800 suspected North Korean state-sponsored IT job scammers who attempted to infiltrate the company’s workforce through fraudulent job applications. The attackers used sophisticated social engineering and impersonation tactics to pose as legitimate IT professionals, seeking remote work to gain internal access or sensitive data. Amazon’s security and HR teams collaborated to detect anomalies, verify identities, and block the hiring process for the fraudulent profiles, successfully preventing insider threats and potential exploitation of corporate assets. The operation underscores the increasing complexity and scale of employment-based attack vectors. This incident is particularly relevant as cybercriminals and nation-state actors are increasingly leveraging remote work trends and IT labor shortages to execute social engineering intrusions. It highlights the need for enhanced workforce vetting, robust anomaly detection, and proactive segmentation to protect organizations from evolving insider and supply chain threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Threat Actors Exploit Zero-Day Vulnerability in WatchGuard Firebox Devices
Financial Services10 months ago

Threat Actors Exploit Zero-Day Vulnerability in WatchGuard Firebox Devices

In early 2024, cybercriminals exploited a previously unknown zero-day vulnerability in WatchGuard Firebox firewall devices, enabling unauthorized remote access and control over affected appliances. Attackers leveraged this flaw to bypass authentication, deploy malware, and establish persistent footholds within targeted organizational networks. The campaign resulted in potential data breaches, service disruptions, and exposure of sensitive internal traffic due to compromised network perimeters. WatchGuard has since released urgent patches and guidance, while security teams raced to detect and remediate compromised devices. This incident highlights the persistent targeting of edge security appliances by advanced threat actors and the speed at which zero-day exploits are weaponized. As remote work and hybrid cloud adoption surge, organizations must prioritize rapid patching and enhanced detection to mitigate risks posed by critical perimeter vulnerabilities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
How Russian State-Sponsored Cyberattacks Targeted Denmark’s Critical Infrastructure and Elections in 2024
Utilities10 months ago

How Russian State-Sponsored Cyberattacks Targeted Denmark’s Critical Infrastructure and Elections in 2024

In December 2025, Danish authorities attributed two major cyberattacks in 2024 to Russian-backed groups. The first attack targeted a Danish water utility, causing significant operational disruption, and was attributed to Z-Pentest, a pro-Russian threat actor. The second involved a series of distributed denial-of-service (DDoS) attacks against Danish municipal and regional council websites on the eve of critical elections, orchestrated by NoName057(16), another threat group with ties to Russia. These incidents highlighted the vulnerabilities of critical infrastructure and democratic processes to foreign state-sponsored actors. The fallout from these attacks underscores a broader pattern of rising state-sponsored cyber operations targeting essential services and democratic institutions across Europe. Heightened geopolitical tensions and the growing sophistication of threat actors are driving urgent calls for improved cyber defenses and regulatory responses.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Ascension 2024 Breach: How RC4’s Legacy Left Millions Exposed
Health Care / Life Sciences10 months ago

Ascension 2024 Breach: How RC4’s Legacy Left Millions Exposed

In May 2024, healthcare giant Ascension suffered a major data breach after threat actors exploited legacy support for the outdated RC4 encryption algorithm in Microsoft Windows environments. Attackers leveraged the well-known 'Kerberoasting' attack technique, enabled by RC4’s weak cryptography, to compromise credentials and move laterally between systems. This breach led to significant operational disruption across 140 hospitals, putting 5.6 million patient records at risk and critically impacting healthcare delivery. The incident highlighted the dangers of legacy cryptography persisting in critical infrastructure. The breach has brought renewed urgency to deprecate outdated cryptographic standards and accelerate upgrades within regulated industries. Regulatory scrutiny and increased attacker focus on cryptographic weaknesses make retiring end-of-life encryption technologies a top priority for all enterprises.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Global Enterprises Breached: Ukrainian Nefilim Ransomware Affiliate Exposed in 2024
Financial Services10 months ago

Global Enterprises Breached: Ukrainian Nefilim Ransomware Affiliate Exposed in 2024

In December 2025, Ukrainian national Artem Aleksandrovych Stryzhak pleaded guilty to participating as an affiliate of the Nefilim ransomware gang, responsible for attacks on large enterprises across the U.S., Europe, and Australia between 2021 and 2022. Stryzhak and his accomplices, using custom-tailored ransomware, infiltrated businesses with revenues exceeding $100 million by exploiting online data gathering and targeting internal systems, leading to significant disruptions and ransom demands. Sensitive company data was threatened with public leaks to pressure victims into paying, amplifying both operational and reputational damage. U.S. authorities arrested Stryzhak in Spain in 2024, with sentencing scheduled for 2026. This incident exemplifies the continued operational sophistication and profitability of affiliate-based ransomware models. It also highlights evolving attacker methods that combine technical exploits with business intelligence gathering, and the increasing coordination among international law enforcement to counter cybercrime.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
ASUS Live Update Supply Chain Breach: Lessons from a Sophisticated APT Attack
Computer Hardware10 months ago

ASUS Live Update Supply Chain Breach: Lessons from a Sophisticated APT Attack

In 2018, ASUS suffered a major supply chain compromise in which attackers, believed to be a state-linked APT group, infiltrated the ASUS Live Update utility and distributed a malicious software update to potentially hundreds of thousands of users. The attackers inserted a sophisticated backdoor into the official ASUS update, enabling targeted compromise of devices based on specific MAC addresses. Although the vulnerability (CVE-2025-59374) has only been formally cataloged recently, the incident itself occurred years ago, impacting trust in widely used supply chain components. This breach remains relevant due to the ongoing risk of similar supply chain tactics by advanced threat actors and the late inclusion of legacy vulnerabilities in compliance and threat feeds. Security leaders must recognize that historic supply chain compromises may resurface in compliance audits or be exploited in future campaigns through neglected, end-of-life software.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
University of Phoenix 2024 Clop Ransomware Breach Exposes Millions
Higher Education/Acadamia10 months ago

University of Phoenix 2024 Clop Ransomware Breach Exposes Millions

In August 2023, the University of Phoenix suffered a significant data breach after the Clop ransomware gang exploited a vulnerability in the MOVEit file transfer software. Attackers gained unauthorized access to sensitive personal data belonging to nearly 3.5 million individuals, including current and former students, staff, and suppliers. The breach led to the theft of names, Social Security numbers, and other confidential records, severely impacting the institution’s ability to assure data privacy. Public disclosure came in June 2024 after investigation and notification procedures were completed. This incident underlines the escalating damage caused by ransomware groups leveraging supply chain vulnerabilities. Higher education institutions remain high-value targets due to large volumes of personal data and often fragmented security postures, highlighting an urgent need for proactive risk management and compliance with data protection regulations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Uzbekistan 2025: Wonderland Android Malware Campaign Steals Millions via Mobile Banking Fraud
Banking/Mortgage10 months ago

Uzbekistan 2025: Wonderland Android Malware Campaign Steals Millions via Mobile Banking Fraud

In late 2025, a sophisticated cybercrime operation in Uzbekistan targeted Android users through the deployment of advanced dropper apps that installed the Wonderland malware. Disguised as legitimate Google Play or popular media files, these malicious APKs leveraged social engineering and fake landing pages to trick users into installation after enabling 'unknown sources.' The threat actor group, TrickyWonders, coordinated their campaign via Telegram, using heavily obfuscated droppers (MidnightDat and RoundRift) and dynamic C2 infrastructure. Once on a device, Wonderland enabled real-time SMS and OTP theft, phone number hijacking, lateral propagation via Telegram session compromise, and banking fraud, resulting in significant financial losses for victims. This incident underscores a broader trend: attackers are rapidly iterating their methods, shifting towards deceptive dropper-based infection chains, robust C2 agility, and hierarchically structured cybercrime operations. The campaign’s evolution, paired with similar threats like Cellik, Frogblight, and NexusRoute, signals an urgent need for improved mobile endpoint security, user awareness, and regulatory vigilance.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
MacSync Malware Bypasses macOS Gatekeeper with Notarized Infostealer in 2024
Financial Services10 months ago

MacSync Malware Bypasses macOS Gatekeeper with Notarized Infostealer in 2024

In June 2024, security researchers identified a new MacSync infostealer variant targeting macOS devices. The malware is delivered through a digitally signed and notarized Swift application that successfully evades Apple’s Gatekeeper checks, allowing it to run without typical security warnings. Once executed, MacSync exfiltrates sensitive user information including credentials, browser data, and files—leveraging encrypted command-and-control channels to avoid detection. The sophisticated dropper uses advanced evasion techniques to bypass standard macOS security controls, elevating risks for individuals and organizations running unpatched systems. This attack illustrates an evolving landscape where threat actors exploit trusted developer channels and novel evasion tactics to compromise macOS environments. With the growing adoption of macOS in enterprise and remote work settings, organizations are urged to review their controls, respond proactively, and address malware risks that legacy security tools may not detect.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Nissan Customer Data Exposed After Red Hat Supply Chain Breach
Automotive10 months ago

Nissan Customer Data Exposed After Red Hat Supply Chain Breach

In September 2023, Nissan Motor Co. Ltd. confirmed that the personal information of thousands of its customers was compromised due to a supply chain data breach at Red Hat, a leading software vendor. The breach stemmed from unauthorized access to customer data managed by Red Hat, which affected Nissan’s customer records, including names and contact information. While there is no current evidence of financial or highly sensitive information being lost, Nissan has notified the individuals impacted and is working with Red Hat to further assess and contain the breach’s full scope. This incident highlights the ongoing risk posed by third-party vendors in the automotive and technology sectors, as organizations increasingly rely on external service providers for software and infrastructure. The Nissan-Red Hat breach underscores the rising threats targeting supply chains, emphasizing the urgent need for robust vendor security controls and visibility into partner ecosystems.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
How Multi-Vector Attacks in 2025 Exposed Firewall and Internal Security Gaps
Financial Services10 months ago

How Multi-Vector Attacks in 2025 Exposed Firewall and Internal Security Gaps

In December 2025, several global organizations faced a coordinated multi-vector cyber campaign in which threat actors leveraged recent vulnerabilities across enterprise firewalls, browser plugins, and connected devices. Attackers stealthily exploited zero-day flaws in network perimeter devices to access east-west traffic, deploy lateral movement, and exfiltrate sensitive data using encrypted channels. Both commercial and open-source threat detection struggled to identify activity quickly, resulting in significant operational disruptions, regulatory notification requirements, and data privacy liabilities affecting numerous sectors worldwide. This incident is indicative of a new threat paradigm in which attackers favor multi-tool, insider-style techniques, combining supply chain vulnerabilities with stealthy movements inside trusted IT environments. Security and compliance teams must now contend with adversaries who bypass traditional controls and exploit overlooked components, highlighting urgent needs for zero trust segmentation, improved traffic visibility, and robust egress monitoring.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Malicious npm Package Exposes WhatsApp Accounts in 2025 Supply Chain Attack
Computer Software/Engineering10 months ago

Malicious npm Package Exposes WhatsApp Accounts in 2025 Supply Chain Attack

In May 2025, a malicious npm package named "lotusbail" was uploaded to the JavaScript ecosystem, masquerading as a fully functional WhatsApp API. Created by a user known as "seiren_primrose," the package was downloaded over 56,000 times before discovery. Behind its legitimate capabilities, "lotusbail" stealthily exfiltrated WhatsApp credentials, intercepted all messages, harvested contacts, installed a persistent backdoor, and linked attacker devices to victims’ WhatsApp accounts for continuous unauthorized access. Data was encrypted and exfiltrated to attacker-controlled servers, with covert device pairing persisting even after package removal, compounding the risk to both individuals and organizations reliant on WhatsApp for communication. This incident highlights the growing risk of advanced supply chain attacks via trusted open-source repositories. Attackers increasingly use sophisticated evasion tactics—like anti-debugging, code obfuscation, and reputation laundering—to slip past static and reputation-based security controls. As software supply chain threats intensify, organizations must urgently reassess the hygiene, monitoring, and zero trust posture of their development pipelines.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports