Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3797 threat reports
Page 254 of 317
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 3037–3048 / 3797 reports
AI Domain Impersonation Fuels 2024 ClickFix-Style Malware Surge
Financial Services10 months ago

AI Domain Impersonation Fuels 2024 ClickFix-Style Malware Surge

In early 2024, a cyberattack campaign known as the 'ClickFix Style Attack' emerged, exploiting cutting-edge social engineering and SEO poisoning techniques. Attackers leveraged widely searched AI-related domains such as Grok and ChatGPT, using search engine manipulation to lure unsuspecting users to weaponized websites. Once on these compromised pages, visitors were tricked into downloading malware under the guise of legitimate AI tools and browser extensions, enabling threat actors to gain persistent access to systems and exfiltrate sensitive data. The campaign highlights the growing sophistication and agility of attackers in blending trusted brands with social engineering ploys, ultimately threatening business operations and data integrity. This incident is particularly relevant as it showcases the convergence of AI hype, manipulated search results, and advanced social engineering, which increases the likelihood of successful malware delivery. Security teams must remain vigilant as attackers continue to target the widespread adoption of AI-driven tools and blur lines between legitimate and malicious sources.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft December 2025 Patch Tuesday: Critical & Exploited Vulnerabilities Exposed
Financial Services10 months ago

Microsoft December 2025 Patch Tuesday: Critical & Exploited Vulnerabilities Exposed

In December 2025, Microsoft addressed 57 vulnerabilities as part of its Patch Tuesday update, including three critical flaws and one (CVE-2025-62221) already being actively exploited. The vulnerabilities spanned across numerous Microsoft products such as Office, Outlook, Exchange, PowerShell, and the Windows Cloud Files Mini Filter driver. Notably, CVE-2025-64671 affected GitHub Copilot plugins for JetBrains, potentially enabling remote code execution via AI-driven code assistance. Attackers exploited privilege escalation and remote-code execution vectors, posing significant risks to system integrity and user data. The rapid disclosure and exploitation of some flaws before patches were available highlighted increasing attacker sophistication and speed. Incidents such as this emphasize the urgent need for timely patch management, especially as software supply chains and AI integrations become more prevalent. Security teams must remain vigilant against fast-emerging threats, as even mainstream platforms like Microsoft continue to face ongoing and complex exploitation attempts.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Kubernetes NodeLogQuery (CVE-2024-9042): Command Injection Exploit Hits Windows Nodes
Information Technology/IT10 months ago

Kubernetes NodeLogQuery (CVE-2024-9042): Command Injection Exploit Hits Windows Nodes

In late 2024, a command injection vulnerability in Kubernetes' NodeLogQuery feature (CVE-2024-9042) was actively exploited, primarily impacting clusters running Windows nodes with log read permissions enabled. Attackers leveraged the '/logs/' API endpoint, injecting operating system commands via GET parameters or path elements to gain unauthorized system access. Victims included enterprise environments utilizing the beta NodeLogQuery feature, which was not enabled by default. The exploit techniques involved turning Kubernetes' logging capabilities into a remote code execution avenue, exposing sensitive workloads to further compromise and potential lateral movement. This incident underscores a broader trend in targeting Kubernetes clusters at the API layer, as adversaries evolve their exploitation of cloud-native misconfigurations and insecure default settings. The attack highlights the need for enhanced east-west traffic controls, static analysis of cluster policies, and real-time anomaly detection to intercept emerging exploitation patterns in cloud and hybrid infrastructure.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
React2Shell: 2025’s Supply Chain Cyberattack Shocks 50+ Organizations
Computer Software/Engineering10 months ago

React2Shell: 2025’s Supply Chain Cyberattack Shocks 50+ Organizations

In June 2025, a surge of attacks leveraging the critical React2Shell vulnerability (CVE-2025-55182) swept across more than 50 organizations globally. The flaw, located in React Server Components and derivatives like Next.js, enabled diverse threat actors ranging from nation-states (notably North Korean and Chinese groups), cybercriminals, and botnets to achieve remote code execution. Attackers exploited unpatched instances, deploying a range of malware—including cryptominers, ransomware, and backdoors such as Mirai, XMRIG, and BPFDoor—affecting entities in finance, tech, education, government, and more. The incident’s rapid expansion was facilitated by the widespread availability of public proof-of-concept exploits and slow organizational patching. The React2Shell crisis highlights the fragility of the software supply chain and the speed at which novel exploits can be adapted by a wide array of adversaries. Security and regulatory scrutiny is intensifying, with urgent patching deadlines and increased concern due to the vulnerability’s ease of exploitation, high automation, and ability to evade traditional controls, reminiscent of the earlier Log4Shell incident.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Ashen Lepus Strikes: 2025 APT Breach Unveils Advanced Espionage Across Middle Eastern Diplomatic Targets
Government Administration10 months ago

Ashen Lepus Strikes: 2025 APT Breach Unveils Advanced Espionage Across Middle Eastern Diplomatic Targets

In late 2025, a Hamas-affiliated APT group known as Ashen Lepus (also referred to as WIRTE) executed a sophisticated cyber-espionage campaign targeting governmental and diplomatic organizations across multiple Middle Eastern countries. The attackers leveraged a novel modular malware suite called AshTag, delivered through decoy documents, DLL sideloading, and a carefully staged infection chain. The campaign made extensive use of in-memory payload delivery, advanced encryption, legitimate-themed subdomains for C2 communications, and the abuse of widely used file transfer tools like Rclone to exfiltrate sensitive, often diplomacy-related data. This incident marks a notable evolution in the operational security and technical sophistication of Middle Eastern espionage campaigns. It highlights the rising use of modular malware, infrastructure blending, and legitimate protocol abuse by regionally motivated threat actors, underscoring a trend where state-linked groups continue cyber operations despite geopolitical turmoil or ceasefires.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft Patches Critical Zero-Day in Windows: December 2025 Security Update
Information Technology/IT10 months ago

Microsoft Patches Critical Zero-Day in Windows: December 2025 Security Update

In December 2025, Microsoft issued patches for 57 vulnerabilities across its product suite as part of its final Patch Tuesday of the year. Notably, the release addressed an actively exploited zero-day vulnerability, CVE-2025-62221, impacting the Windows Cloud Files Mini Filter Driver. This use-after-free flaw, with a CVSS score of 7.8, allowed attackers to potentially gain system-level privileges when chained with code execution bugs. Affecting all supported versions of Windows, the vulnerability drew immediate attention from CISA and the cybersecurity community due to its presence in production environments and ongoing exploitation. The incident underscores a persistent trend of attackers targeting foundational Windows components through privilege escalation and memory management bugs. With the rising complexity of Microsoft’s ecosystem and a continued increase in vulnerabilities—especially as AI-related issues proliferate—organizations face growing pressure to rapidly deploy patches and strengthen monitoring against sophisticated exploits.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Supply Chain Malware Infects VS Code, Go, npm & Rust: 2025 Developer Data Breach
Computer Software/Engineering10 months ago

Supply Chain Malware Infects VS Code, Go, npm & Rust: 2025 Developer Data Breach

In December 2025, cybersecurity researchers uncovered a sophisticated supply chain attack where malicious extensions on the Visual Studio Code Marketplace, along with booby-trapped Go, npm, and Rust packages, stealthily harvested sensitive developer data. Threat actors disguised two VS Code extensions as a popular dark theme and an AI-powered coding assistant, which, upon installation, downloaded stealer malware to exfiltrate screenshots, code, Wi-Fi passwords, clipboard content, and browser session data. Complementary attacks leveraged typosquatting in open-source package ecosystems, including npm, Go, and Rust, to hijack credentials and upload them to attacker-controlled infrastructure. This incident underscores the growing wave of software supply chain threats specifically targeting developer environments. As attackers increasingly exploit trusted dev tool repositories and package managers to gain initial access and exfiltrate enterprise credentials, organizations must urgently reevaluate their security posture around code dependencies and third-party extensions.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
STAC6565 & Gold Blade Exploit Recruitment Platforms in Canadian Ransomware Assault (2025)
Human Resources/HR10 months ago

STAC6565 & Gold Blade Exploit Recruitment Platforms in Canadian Ransomware Assault (2025)

Between February 2024 and August 2025, a financially-motivated threat group tracked as STAC6565 (with strong overlaps to the Gold Blade/RedCurl actor cluster) orchestrated a series of nearly 40 targeted cyberattacks, predominantly on Canadian organizations. The attackers utilized spear-phishing campaigns, delivering weaponized resumes via legitimate recruitment platforms to HR staff to gain initial access. Once inside, the group deployed a multi-stage attack chain using custom loaders and tools like RedLoader, RPivot, and Chisel, culminating in QWCrypt ransomware deployment on high-value endpoints including hypervisors. Data theft and extortion were observed, with a clear pattern of operational sophistication and periods of dormancy followed by refined attack waves. This incident highlights the increasing adoption of "hack-for-hire" models, hybrid attacks combining espionage and ransomware, and the innovative abuse of legitimate business platforms to sidestep conventional email security. Organizations globally—particularly those with HR exposures and reliance on virtualized infrastructure—face heightened risk as attackers rapidly iterate on TTPs to maximize impact and evade detection.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
GrayBravo's CastleLoader: 2025’s Multicluster MaaS Campaign Hits the Logistics Sector
Logistics/Procurement10 months ago

GrayBravo's CastleLoader: 2025’s Multicluster MaaS Campaign Hits the Logistics Sector

In early to late 2025, the threat actor known as GrayBravo (formerly TAG-150) orchestrated multiple large-scale cyberattacks leveraging CastleLoader, a sophisticated malware loader distributed under a malware-as-a-service (MaaS) model. Four coordinated threat clusters exploited CastleLoader to compromise organizations—particularly in logistics—via phishing, malvertising, and credential harvesting. Attackers used fraudulent accounts on freight-matching platforms to enhance deception, delivering a range of information stealers and remote access trojans, including CastleRAT, RedLine Stealer, and NetSupport RAT. Multi-tiered infrastructure supported resilient operations and facilitated rapid malware deployment, leading to significant business and security disruption for targeted sectors. This incident illustrates an escalating threat trend: advanced MaaS tooling like CastleLoader rapidly proliferates across the cybercrime ecosystem, enabling both seasoned and novice criminals to launch complex, high-impact attacks. The campaign underscores attackers’ increasing industry expertise, adaptation to detection, and exploitation of legitimate business platforms to maximize credibility and impact.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Docker Hub Credential Leak: How Over 10,000 Containers Exposed the Supply Chain
Computer Software/Engineering10 months ago

Docker Hub Credential Leak: How Over 10,000 Containers Exposed the Supply Chain

In early June 2024, security researchers discovered that over 10,000 publicly available Docker Hub container images were leaking sensitive credentials, authentication keys, and API secrets. The exposed data included valid keys for production systems, CI/CD pipelines, cloud services, and large language models. Attackers could potentially use these secrets to compromise cloud infrastructure, move laterally within enterprise environments, exfiltrate data, or execute supply chain attacks. The incident highlights the risks associated with supply chain components and improper secrets management in application build processes. This event is highly relevant as containerized workloads and DevOps toolchains continue to proliferate, making the exposure of embedded credentials a fast-growing avenue for cyberattacks. Increased regulatory scrutiny and high-profile breaches are raising awareness of the urgent need to secure supply chain assets.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Spiderman Phishing Service: A 2024 Wakeup Call for European Banks
Banking/Mortgage10 months ago

Spiderman Phishing Service: A 2024 Wakeup Call for European Banks

In early 2024, a sophisticated phishing-as-a-service platform known as Spiderman emerged, targeting customers of more than 50 European banks and cryptocurrency holders. The perpetrators leveraged pixel-perfect cloned websites and credential harvesting techniques to deceive users into divulging sensitive financial information. Attackers used advanced phishing kits capable of bypassing two-factor authentication and dynamically generating legitimate-looking web pages, resulting in significant financial losses and heightened concern among European financial institutions. This incident underscores a growing trend of increasingly accessible and effective phishing services, enabling even low-skill cybercriminals to launch large-scale, targeted attacks. Regulatory scrutiny and the evolving threat landscape demand that organizations bolster defenses against phishing service operations leveraging social engineering and real-time site cloning.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
2025 Cloud Security Breach: How AWS, Kubernetes, and AI Misconfigurations Opened the Door
Financial Services10 months ago

2025 Cloud Security Breach: How AWS, Kubernetes, and AI Misconfigurations Opened the Door

In December 2025, cybersecurity investigators revealed a series of advanced attacks targeting cloud environments by exploiting common misconfigurations across AWS, AI production pipelines, and Kubernetes clusters. Threat actors leveraged identity and permissions gaps, as well as inadequate traffic segmentation, to gain initial access to cloud infrastructure without brute-forcing credentials. Once inside, they used stealthy techniques such as mimicking AI model naming conventions to mask malicious files and exploited overprivileged Kubernetes permissions to escalate privileges and take control of containers. This multifaceted approach allowed attackers to operate undetected and exfiltrate sensitive data, exposing gaps in traditional perimeter and monitoring solutions. The incident underscores a growing trend where sophisticated attackers bypass even well-known cloud security defenses by abusing legitimate service behaviors and automation. As enterprises increasingly migrate critical workloads to multicloud and AI-backed environments, these threats signal a pressing need for runtime visibility, audit logging, and zero trust architecture. Organizations must reevaluate existing security configurations to close these new attack pathways.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports