Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Malicious MCP Server Uncovered in 'postmark-mcp' npm Package Supply Chain Breach
In September 2025, cybersecurity researchers identified the first active malicious deployment of a Model Context Protocol (MCP) server, delivered through a compromised open-source npm package called "postmark-mcp." The attacker, masquerading as a legitimate developer, introduced rogue code into the package to stealthily exfiltrate user emails to an adversary-controlled MCP server. The package closely mimicked the official Postmark Labs library, making detection challenging for organizations relying on the trusted supply chain. The incident highlights the growing sophistication and operational impact of supply chain compromise, especially within widely used repositories like npm. This supply chain breach underscores a wider trend of attackers targeting open-source ecosystems to weaponize trusted libraries for data theft and persistent access, driving regulatory scrutiny and risk to software providers and their customers. With the acceleration of software supply chain attacks, organizations face increased pressure to enhance dependency audits and adopt zero trust controls.
8 months ago
Kill Chain
EvilAI: Malware Masquerading as AI Tools Targets Global Enterprises in 2025
In September 2025, global organizations became targets of a sophisticated malware campaign in which cybercriminals disguised malicious payloads within seemingly legitimate AI productivity tools and software. Security researchers at Trend Micro identified that attackers leveraged the growing popularity and trust in AI-driven solutions to distribute their malware, affecting companies across Europe, the Americas, and AMEA. Adversaries exploited trusted distribution channels, leveraging convincing phishing and software bundling tactics to achieve initial access, with the primary goal of establishing persistent footholds for future attacks, including lateral movement and data exfiltration. The incident disrupted IT operations, forced incident response, and increased the risk of data theft and regulatory exposure. This breach highlights the rapid evolution of social engineering techniques tied to AI trends, with attackers exploiting user demand for productivity tools as an entry point. It underscores an urgent need for heightened vigilance, zero trust policies, and real-time threat detection in the face of shadow AI and increasingly indistinguishable malicious downloads.
8 months ago
Kill Chain
Ukrainian Police Spoofed: SVG Fileless Phishing Delivers Amatera Stealer in Kyiv
In early 2024, cybercriminals conducted a sophisticated phishing campaign targeting organizations and individuals in Kyiv, Ukraine, by spoofing the National Police of Ukraine. The attackers distributed malicious emails containing Scalable Vector Graphics (SVG) files, which enabled fileless delivery of info-stealing malware such as Amatera Stealer and the cryptocurrency miner PureMiner. By leveraging social engineering and trusted police branding, they bypassed common security defenses, leading to the theft of sensitive credentials, system compromise, and potential financial losses. The breach highlights attackers’ growing reliance on fileless techniques and deceptive lures to infiltrate victims’ environments with minimal detection. This incident underlines a shift toward advanced, stealthy phishing tactics that weaponize graphics files and trusted institutional identities. The approach signifies an escalating trend in cybercrime, where threat actors continue to innovate to evade legacy controls and exploit user trust amid ongoing geopolitical unrest.
8 months ago
Kill Chain
2025’s Cyber Tsunami: Cisco 0-Day, Record DDoS & Multi-Vector Threats Unleashed
In September 2025, the global cybersecurity landscape faced a convergence of high-profile threats, including a critical Cisco 0-day vulnerability, record-breaking distributed denial-of-service (DDoS) attacks, an emergent LockBit 5.0 ransomware variant, multiple vulnerabilities targeting baseboard management controllers (BMC), and rapid expansion of the ShadowV2 botnet. Adversaries exploited the Cisco 0-day to gain privileged access, launched multi-vector DDoS assaults disrupting online services, compromised server hardware via BMC flaws, and weaponized the new LockBit variant for data extortion and ransomware. The combination of these attacks resulted in widespread operational instability, data breaches, and heightened risk exposure across cloud and on-premises environments. These incidents underscore the rapidly evolving threat landscape, marked by increasingly sophisticated and diverse attack vectors that target infrastructure, software, hardware, and supply chains simultaneously. The convergence of ransomware, DDoS, and zero-day exploitation—often driven by organized cybercriminal groups—signals an urgent need for organizations to adopt layered, zero trust security strategies and accelerate detection and response.
8 months ago
Kill Chain
Akira Ransomware: MFA-Protected SonicWall VPNs Breached in 2024
In early 2024, the Akira ransomware group escalated its campaign by successfully breaching organizations through SonicWall SSL VPN appliances, even when multi-factor authentication (MFA) was enabled. Security researchers determined that Akira actors appeared to bypass one-time password (OTP) protections, potentially by leveraging previously obtained OTP seed information or exploiting weaknesses in authentication management. Following the VPN compromise, attackers moved laterally, exfiltrated data, and encrypted systems to demand substantial ransom payments. This attack vector enabled access to privileged internal resources, resulting in business disruption, data exposure, and financial losses for affected organizations. The incident underscores how ransomware operators are adapting to bypass commonly deployed defenses, specifically targeting VPN and MFA solutions. Such tactics highlight the urgent need for organizations to reassess remote access controls, authentication infrastructure, and visibility gaps, as similar techniques are increasingly observed in the wild.
8 months ago
Kill Chain
Fake Microsoft Teams Installers Spread Oyster Malware via Malvertising
In September 2025, cybercriminals exploited search engine advertisements and SEO poisoning to promote fake Microsoft Teams installers, which covertly delivered the Oyster backdoor (also known as Broomstick or CleanUpLoader) onto Windows devices. By luring users—often IT administrators—to download malicious 'MSTeamsSetup.exe' files from deceptive sites like teams-install[.]top, attackers established remote control over compromised systems. The malware facilitated persistent access by installing a scheduled task and enabled command execution, lateral movement, deployment of additional payloads, and file exfiltration, posing considerable risks to corporate environments. Organizations relying on user trust in branded software searches became targets for subsequent attacks, including potential ransomware deployment. This incident underscores a growing threat: attackers increasingly abuse mainstream search engines and brand impersonation to achieve initial corporate access. As malvertising and SEO poisoning campaigns surge, organizations must prioritize user security awareness, robust endpoint threat detection, and zero trust controls to defend against evolving infostealer delivery mechanisms.
8 months ago
Kill Chain
Cisco Firewall Zero-Day Incident: RayInitiator & LINE VIPER Malware Exposed
In September 2025, Cisco ASA firewalls faced a severe cybersecurity incident when threat actors leveraged recently disclosed zero-day vulnerabilities to secretly infiltrate network perimeters. The attackers exploited these flaws to deploy two newly discovered malware strains, RayInitiator and LINE VIPER, allowing them to bypass existing defenses, maintain persistence, and exfiltrate sensitive data from affected enterprises. This highly sophisticated campaign showcased advanced persistent threat (APT) tradecraft, utilizing encrypted command-and-control traffic and lateral movement within east-west network segments, impacting organizations across multiple sectors and creating significant operational and reputational risks. This incident underscores an emergent pattern of targeting network infrastructure devices with custom malware, reflecting broader shifts in attacker strategy. As attackers increasingly refine zero-day exploitation and expand their arsenal, organizations must adapt security postures to detect and respond to threats traversing both perimeter and internal network boundaries.
8 months ago
Kill Chain
New XCSSET Variant Hits macOS: Browser Credential Theft and Clipper Risk for Developers
In September 2025, researchers identified a sophisticated new variant of the macOS XCSSET malware, targeting Apple devices with an updated focus on browser credential theft, clipboard hijacking (clipper), and improved persistence. Initially delivered through tainted Xcode projects, the malware leveraged encrypted and obfuscated code to avoid detection, and incorporated a persistence module for sustained access. Key changes included deeper targeting of browsers like Firefox, allowing attackers to intercept credentials, exfiltrate sensitive data, and potentially escalate attacks to other platforms or accounts. The XCSSET variant’s rise mirrors broader trends in information-stealing malware exploiting developer platforms and macOS. This incident highlights growing attacker interest in macOS ecosystems, the sophistication of obfuscation techniques, and the urgent need for endpoint monitoring and microsegmentation across development environments.
8 months ago
Kill Chain
Fortra GoAnywhere Zero-Day CVSS 10 Exploited Before Disclosure in 2025
In September 2025, a critical zero-day vulnerability (CVSS 10.0) in Fortra GoAnywhere Managed File Transfer software was actively exploited for at least a week before its public disclosure. Attackers leveraged the flaw to gain unauthorized access and potentially exfiltrate sensitive data from organizations using the platform, which is widely adopted in regulated sectors. The attack vector was weaponized rapidly by sophisticated threat groups and ransomware actors, highlighting systemic risks in third-party file transfer applications. The incident resulted in significant business disruption, data exposure, and triggered urgent patching activities across affected enterprises. This breach reflects a broader trend of adversaries increasingly targeting secure file transfer solutions via 0-day vulnerabilities, often achieving lateral movement and persistent footholds. It underscores the pressing need for proactive vulnerability management, real-time threat detection, and strong compliance practices amid rising regulatory scrutiny around data handling and supply chain exposures.
8 months ago
Kill Chain
COLDRIVER’s 2025 ClickFix Malware Campaign: Modular APT Tactics Evolve
In September 2025, the Russian APT group COLDRIVER launched a multi-stage cyber campaign using newly identified malicious tools, BAITSWITCH and SIMPLEFIX, delivered through ClickFix-style phishing attacks. Zscaler ThreatLabz observed that COLDRIVER targeted Russian-speaking entities with sophisticated social engineering and credential phishing tactics, ultimately compromising victims by deploying lightweight downloaders that enable remote access and further malware deployment. Impacted organizations faced stealthed data exfiltration risks and the threat actor's evolving persistence mechanisms, signifying a leap in their operational security evasion. This incident reflects an accelerating trend of APT actors developing nimble, modular malware to bypass traditional defenses and exploit collaboration platforms. Continued adaptation in attacker tradecraft underscores the growing urgency for zero trust controls, east-west visibility, and anomaly detection across hybrid environments.
8 months ago
Kill Chain
Targeted SVG Phishing Hits Ukrainian Agencies with CountLoader, PureRAT
In September 2025, cybersecurity researchers uncovered a targeted phishing campaign impersonating Ukrainian government agencies. Attackers distributed emails containing malicious SVG file attachments, crafted to deliver the CountLoader malware. Upon execution, CountLoader dropped secondary payloads—Amatera Stealer and PureMiner—allowing cybercriminals to steal sensitive information and deploy cryptomining operations on victim systems. The attacks leveraged sophisticated social engineering and file formats to evade detection, threatening both public sector and affiliated organizations. This incident highlights a surge in phishing operations leveraging advanced loaders and novel file types, such as SVG. As more attackers exploit government-themed lures and multi-tool chains, organizations face an elevated risk of data exfiltration, credential theft, and operational disruption, demanding robust, adaptive security controls.
8 months ago
Kill Chain
2024 DOGE Insider Threat: Massive Data Privacy Risk at U.S. Agencies
In June 2024, the Department of Government Efficiency (DOGE), created by Elon Musk, was found to be operating outside federal law, compromising cybersecurity and privacy protocols at three major U.S. agencies: the General Services Administration (GSA), Office of Personnel Management (OPM), and Social Security Administration (SSA). According to a Senate Homeland Security and Governmental Affairs Committee report, DOGE staffers allegedly uploaded sensitive personal data—such as the SSA's Numident database—into inadequately protected environments. This exposed millions of Americans to potential identity theft and data misuse, circumventing standard cybersecurity and regulatory controls by leveraging unauthorized cloud resources and private satellite networks, notably Starlink, to evade agency oversight. The incident underscores an urgent shift in the threat landscape, whereby insider threats and shadow IT initiatives create unprecedented systemic risk within critical public sector organizations. Amid regulatory scrutiny, this breach highlights the critical need for robust monitoring, segmentation, and compliance enforcement against complex, evolving insider vulnerabilities.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports