Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
AI Agents Under Fire: Memory Poisoning and the Rise of Persistent Prompt Injection
In 2024, security researchers uncovered a novel AI/ML security incident where AI agents' long-term memory storage was compromised via persistent indirect prompt injection. Adversaries managed to embed malicious instructions within normal AI inputs; these poisoned prompts were subsequently retained by the AI's memory module. When later queries accessed this memory, the injected instructions could exfiltrate conversation history or impact future responses, creating a stealthy, long-term threat. The breach highlighted how modern agentic AI’s tendency to remember user input presents an unforeseen risk vector, with potential for data leakage and manipulation of AI-driven workflows. This incident signals a rising trend: as enterprises integrate AI agents and persistent memory, attackers are quickly adapting with prompt-based exploit techniques that subvert traditional security controls. The risk of covert data exfiltration and ongoing manipulation through AI memory will become a central compliance and governance issue in highly regulated industries.
8 months ago
Kill Chain
How a Breached BPO Account Led to Discord’s Massive 2025 Zendesk Data Breach
In late September 2025, attackers compromised a support agent account at an outsourced BPO provider and gained unauthorized access to Discord’s Zendesk support platform for 58 hours. Exploiting privileged access, they exfiltrated up to 1.6 TB of data, including approximately 8.4 million support tickets affecting 5.5 million users, with sensitive information such as emails, Discord IDs, phone numbers, partial payment data, and around 70,000 government-ID photos. The threat group leveraged integrations between Zendesk and Discord’s internal systems, extracted additional user details via APIs, and attempted a multimillion-dollar ransom before threatening public data release. This incident highlights the growing risk from third-party supply chain attacks targeting cloud-based customer support platforms and BPO providers. The attacker's tactics—abusing helpdesk integrations and privilege escalation—reflect broader cybercrime trends, including identity-driven attacks, data extortion, and rising regulatory scrutiny.
8 months ago
Kill Chain
From Infostealer to Full RAT: Inside the 2025 PureRAT Attack Chain
In October 2025, Huntress Labs analyzed a sophisticated attack campaign leveraging the PureRAT remote access trojan. The intrusion began with a targeted phishing email containing a ZIP archive that employed DLL sideloading to launch a cascade of in-memory loaders written in Python. Progressing through multi-layered obfuscation, hybrid encryption, and system persistence via Windows registry modifications, the attackers ultimately deployed PureRAT, granting full remote control over victim endpoints. Notably, the operation combined custom-developed loaders with commercial malware, demonstrating advanced evasion and command and control techniques, including encrypted communications and dynamic payload delivery. This incident highlights the growing complexity and modularity of post-phishing attack chains. Organizations must remain vigilant as threat actors increasingly blend bespoke scripts with off-the-shelf RATs, drastically lowering the barrier for stealthy, persistent intrusions targeting credential theft and long-term access.
8 months ago
Kill Chain
RondoDox Botnet Orchestrates Mass n-day IoT Attacks in 2025
In mid-2025, the RondoDox botnet emerged as a powerful threat targeting IoT and network devices by exploiting 56 known (n-day) vulnerabilities across over 30 device types, including routers, NVRs, DVRs, and CCTV systems. The operators, closely monitoring vulnerability disclosures—such as those revealed at Pwn2Own events—rapidly weaponized publicly disclosed exploits, including CVE-2023-1389 and CVE-2024-12856, using a high-volume "exploit shotgun" methodology to maximize infections. With operations observed since June 2025, the campaign affected both end-of-life and actively supported products, resulting in a widespread compromise of infrastructure, particularly among organizations and consumers with unpatched devices. This attack underscores a growing trend of mass exploitation of n-day vulnerabilities in IoT ecosystems, reflecting increasing automation and sophistication among botnet operators. The pace at which attackers operationalize new exploits demands faster patching, improved segmentation, and heightened baseline security practices across networked environments.
8 months ago
Kill Chain
China-Based Storm-2603 Weaponizes Velociraptor DFIR in 2025 Ransomware Attacks
In October 2025, security researchers uncovered that the China-based threat group Storm-2603 had abused the open-source Velociraptor DFIR tool in a wide-ranging ransomware campaign. The attacker exploited an outdated, vulnerable version of Velociraptor (CVE-2025-6264) to escalate privileges, create persistent admin accounts, and establish secure remote access on victim systems. This access enabled them to deploy ransomware variants including LockBit and Babuk across Windows and VMware ESXi environments, performing data encryption and exfiltration using PowerShell scripts. Endpoint protections were systematically disabled, and lateral movement leveraged tools like Impacket. This incident highlights an emergent trend: threat actors co-opting legitimate security tools for malicious purposes, increasing the difficulty of detection and response. The blending of nation-state TTPs with ransomware-as-a-service models signals evolving threats, regulatory scrutiny, and substantial operational risks for enterprises.
8 months ago
Kill Chain
Universities Targeted: Storm-2657 Orchestrates 2025 Business Email Compromise via Payroll Phishing
In March 2025, a financially motivated threat group tracked as Storm-2657 launched a series of "payroll pirate" attacks targeting U.S. university staff. The attackers leveraged advanced social engineering and adversary-in-the-middle (AITM) phishing techniques to compromise HR-related SaaS accounts, notably Workday. After stealing MFA credentials, they accessed Exchange Online accounts, manipulated payroll settings to hijack salary payments, set inbox rules for concealment, and enrolled attacker-controlled MFA devices for persistence. At least 11 accounts across three universities were breached, enabling phishing campaigns to almost 6,000 recipients spanning 25 institutions. The incident showcases a significant escalation in business email compromise (BEC) targeting the education sector, exploiting gaps in MFA and SSO implementations. With BEC attacks surging industry-wide—resulting in multimillion-dollar annual losses—this campaign emphasizes the urgent need for phishing-resistant MFA and robust email monitoring across academia and beyond.
8 months ago
Kill Chain
macOS Infostealer Ecosystem 2024: Atomic, Odyssey & Poseidon Unveiled
In early 2024, cybersecurity researchers identified a surge in advanced macOS infostealer campaigns targeting enterprises and individuals, featuring prominent malware variants: Atomic, Odyssey, and Poseidon. These infostealers exploit social engineering and malicious downloads to achieve initial access, deploying payloads designed to extract sensitive data such as passwords, browser credentials, cryptocurrency wallets, and system information. Once installed, the malware communicates with command-and-control infrastructure using encrypted channels, effectively exfiltrating critical information while evading traditional antivirus tools. This campaign demonstrated sophisticated evasion techniques, cross-platform delivery, and broad targeting among macOS users. The growing sophistication and proliferation of macOS-targeting infostealers underscore a significant shift in attacker focus beyond Windows environments. With macOS adoption increasing in the enterprise and remote workforce, these campaigns illustrate heightened risk, regulatory urgency, and the pressing need for zero trust controls and vigilant endpoint protection against evolving cross-platform threats.
8 months ago
Kill Chain
Inside the Qantas 2025 Ransomware Breach: Why Legal Measures Can’t Stop Data Leaks
In October 2025, Qantas, the Australian airline, suffered a ransomware attack attributed to the 'Scattered LAPSUS$ Hunters' group. Attackers claimed to have breached Qantas’ systems via a supply chain vulnerability, exfiltrating personal and loyalty program data of potentially hundreds of thousands of customers, including high-profile individuals. After initial extortion attempts, the stolen data—including names, emails, and frequent flyer records—was publicly leaked when Qantas refused to pay ransom. Qantas took legal steps, securing a court injunction to limit data dissemination, but these measures proved ineffective at curbing the spread among criminal and international actors. This breach highlights the ongoing threat of ransomware and data extortion campaigns targeting major brands, frequently leveraging supply-chain infiltration and cloud-based service weaknesses. The incident also underscores the limited real-world efficacy of legal remedies like injunctions, as well as evolving attacker strategies involving public shaming and mass data exposure.
8 months ago
Kill Chain
The ShinyHunters Salesforce Extortion Spree: Lessons for Modern SaaS Security
In May 2025, the ShinyHunters/Scattered LAPSUS$ Hunters cybercrime coalition initiated a coordinated data extortion campaign against numerous Fortune 500 companies, exploiting voice phishing tactics to compromise Salesforce portals. Attackers tricked privileged users into connecting malicious applications, leading to the theft of over a billion customer records across companies such as Toyota, FedEx, Disney/Hulu, and UPS. Following the attacks, ShinyHunters launched a public shaming and extortion blog, threatening to publish the stolen data unless victims surrendered to ransom demands. Multiple related incidents included attacks on Red Hat's GitLab servers and Discord via a third-party support contractor, impacting sensitive business and PII data. Law enforcement action traced the threats to a blend of established groups, operating globally and leveraging emerging zero-day exploits. This breach underscores the increasing sophistication and scale of identity-driven and extortion-centered cyberattacks targeting cloud SaaS platforms. It coincides with a resurgence in social engineering, as threat actors exploit both technical vulnerabilities and human factors. The event highlights the urgency for robust controls around SaaS access, third-party risk, and east-west data movement visibility.
8 months ago
Kill Chain
Polymorphic Python RAT: Next-Gen Malware Slips Past Defenses in 2024
In October 2024, security researchers identified a new strain of Python-based remote access trojan (RAT) exhibiting advanced polymorphic capabilities. The malware, distributed as 'nirorat.py' and virtually undetectable by most antivirus engines on VirusTotal at the time of discovery, leverages self-modifying code, dynamic junk code injection, and obfuscation to evade detection. Its feature set includes network scanning, credential testing, data exfiltration, cryptomining, screen and audio recording, and file encryption. The Trojan is designed to mutate its code with each execution, making signature-based security tools largely ineffective and challenging forensic analysis post-compromise. This incident is emblematic of an ongoing trend: cybercriminals are increasingly using polymorphic programming techniques and open-source scripting languages to bypass detection and propagate malware. Organizations must adapt their defense strategies as attackers innovate to manipulate familiar toolchains, raising the stakes for endpoint and network security teams.
8 months ago
Kill Chain
RedTail Cryptojacking: 2024 SSH Honeypot Attack Exposes Evasive Trends
In 2024, repeated attempts to deploy RedTail cryptojacking malware were observed targeting honeypots through brute-forced SSH credentials and exploitation of vulnerabilities. Attackers gained access by cracking weak SSH passwords, uploaded and executed scripts such as setup.sh and clean.sh, and implemented persistent access by implanting their own SSH keys. They evaded detection by deleting evidence, queried system info to optimize deployment, and communicated outbound over HTTPS to control mining pools, siphoning off computing resources for Monero mining. The attack demonstrated both technical sophistication and evasiveness, resulting in loss of system performance and increased operational costs for victims. The RedTail campaign stands out for its focus on stealth, persistence, and lateral evasion, signaling a shift from noisy ransomware to more subtle and long-term threats like cryptojacking. With attackers honing in on resource hijacking and leveraging diverse TTPs, organizations face new challenges in detection and response. This incident shows the increasing necessity for robust SSH hardening, proactive monitoring, and defense-in-depth measures against evolving cryptojacking methods.
8 months ago
Kill Chain
2025 Cloud Provider Breach Uncovers Critical Zero Trust Weaknesses
In early 2025, a major global cloud provider suffered a sophisticated multi-stage breach in which adversaries gained initial access using compromised identity credentials, exploited weak east-west segmentation, and moved laterally across multicloud environments. The attackers leveraged unencrypted traffic channels and insufficient policy controls to evade detection, escalate privileges, and access sensitive customer data. As a result, organizations relying on this provider experienced outages, data exfiltration, and business continuity disruptions while the cloud provider scrambled to restore services and conduct forensic investigations. This incident highlights a rapidly growing trend: attackers are increasingly targeting cloud infrastructure, exploiting vulnerabilities in workload isolation, cloud-native policy enforcement, and hybrid connectivity. With regulators enhancing requirements and business dependence on cloud rising, defending against lateral movement and enforcing zero-trust has become a critical priority.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports