Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Forta GoAnywhere 2025: Zero-Day Supply Chain Breach Raises Compliance Alarms
In September 2025, Forta's GoAnywhere MFT file-transfer service was found to contain a critical deserialization vulnerability (CVE-2025-10035) which could enable attackers to execute arbitrary code remotely. Although Forta initially stopped short of confirming exploitation, credible evidence from threat researchers surfaced showing active in-the-wild attacks dating back to at least September 10. The exploit relies on the attacker’s ability to sign Java objects with a stolen or leaked private key, raising concerns over supply chain security and key management. Enterprises using GoAnywhere MFT face risks of data exfiltration and operational disruption. The incident highlights ongoing challenges in vendor transparency and the risks associated with critical third-party software. It underscores the urgent need for enhanced monitoring, timely vendor disclosures, strict key management, and robust segmentation strategies, as similar exploitation patterns have escalated across the supply chain attack landscape.
8 months ago
Kill Chain
Malicious Rust Crates on Crates.io Compromise Developer Crypto Wallets in 2025
In September 2025, security researchers uncovered two malicious Rust packages, 'faster_log' and 'async_println', uploaded to the official Crates.io repository. These packages, downloaded nearly 8,500 times, masqueraded as legitimate logging libraries but secretly scanned developers' machines for cryptocurrency wallet private keys and other sensitive secrets. The attackers used cloned documentation and authentic functionality to evade suspicion, while an embedded payload exfiltrated discovered secrets to a hardcoded Cloudflare Worker endpoint controlled by the threat actors. Upon discovery, Crates.io removed the packages and banned the associated users, mitigating the immediate threat. This incident demonstrates the persistent risk posed by supply chain attacks targeting open-source repositories and the increasing focus of cybercriminals on cryptocurrency theft. It underscores the need for rigorous vetting, enhanced code scanning, and heightened awareness among developers regarding open-source dependencies.
8 months ago
Kill Chain
Unofficial Postmark MCP npm Package: 2024 Supply Chain Breach Exposes Email Data
In February 2024, the unofficial 'postmark-mcp' npm package—a clone of the genuine Postmark MCP email handler—was discovered to have maliciously exfiltrated users' email data. With a single line of code added in its latest update, the package silently sent every processed email to an external domain controlled by the attacker. This supply chain compromise exploited developer trust in open-source libraries, resulting in unintentional leakage of confidential user communications and putting affected organizations and their customers at risk of data exposure or further attacks. This incident underscores the growing frequency and sophistication of supply chain attacks targeting software ecosystems like npm. Organizations face heightened regulatory and reputational risks as attackers leverage trusted distribution platforms to propagate malicious code, making robust dependency monitoring and vendor validation more critical than ever.
8 months ago
Kill Chain
Microsoft Warns: XCSSET macOS Malware Evolves to Target Xcode Devs in 2025
In September 2025, Microsoft Threat Intelligence identified a new, advanced variant of the XCSSET macOS malware targeting Xcode developers. This infostealer propagates by infecting Xcode projects—widely shared among software engineers—allowing it to execute malicious code each time a compromised project is built. The updated malware features enhanced browser data theft (including Firefox), clipboard hijacking to steal cryptocurrency via address swapping, and improved persistence mechanisms. Though observed only in limited, targeted attacks so far, XCSSET poses a significant risk to both assets and sensitive developer tooling. This incident is especially relevant today as targeting the software supply chain and developer toolchains is becoming a favored method for threat actors seeking high-privilege access. The sophistication of XCSSET’s mechanisms mirrors broader trends in stealthy, data-focused attacks against development environments, pressing organizations to reassess internal controls and software sharing practices.
8 months ago
Kill Chain
Massive npm Supply Chain Attack: Shai-Hulud Worm Infects Hundreds of Packages
In September 2025, a major supply chain compromise hit the npm ecosystem with the discovery of the Shai-Hulud worm. Attackers leveraged malicious npm packages to propagate self-replicating malware, which spread by abusing developer credentials and update permissions across over 500 packages—including widely used libraries from organizations such as CrowdStrike. Malicious code executed on install harvested secrets, exfiltrated sensitive GitHub and cloud data, and published infected releases to additional packages, resulting in widespread risk of source code leaks, credential theft, and downstream infections. This incident typifies the escalating trend of highly automated supply chain attacks targeting open-source repositories. Such events highlight the vulnerabilities of complex dependency networks and reinforce the necessity for robust controls, automated monitoring, and zero trust policies for development and CI/CD ecosystems.
8 months ago
Kill Chain
Malicious Rust Crates Infect Supply Chain, Steal Crypto Wallet Keys in 2025
In May 2025, cybersecurity researchers identified a major supply chain attack targeting the Rust developer ecosystem. Two malicious Rust crates—faster_log and async_println—were published on the popular crates.io repository, masquerading as legitimate packages but designed to covertly exfiltrate Solana and Ethereum wallet private keys from software projects that incorporated them. The threat actors, using the aliases rustguruman and dumbnbased, achieved over 8,400 downloads, heightening the risk of cryptographic asset theft and potentially impacting both individual developers and organizations reliant on decentralized finance. This incident exemplifies the growing risks within open-source ecosystems, where attackers exploit trusted repositories to distribute malware. The trend of targeting crypto assets through developer-centric supply chain attacks highlights an urgent need for more robust vetting of third-party code and increased vigilance against evolving attacker tactics.
8 months ago
Kill Chain
DDoS Tsunami: Tech Overtakes Gaming in 2025 Attack Surge
In early 2025, a wave of Distributed Denial-of-Service (DDoS) attacks targeting the technology sector marked a significant shift in cyberattack patterns, according to Gcore's Q1–Q2 2025 Radar report. Attack volumes surged by 41% year-on-year, with the largest observed DDoS flood peaking at 2.2 Tbps—surpassing previous records set in 2024. Threat actors employed multi-layered strategies and protracted campaigns, specifically targeting technology companies with sophisticated, high-bandwidth assaults that caused operational disruptions, service outages, and reputational harm across multiple organizations. This evolution reflects attackers’ growing technical prowess and focus on critical service providers. The incident is particularly relevant as the threat landscape pivots towards the tech sector and away from previous gaming-centric targets. This trend underscores broader risks for infrastructure providers and the need for adaptive DDoS defenses in the face of escalating attack complexity and regulatory expectations.
8 months ago
Kill Chain
North Korean AkdoorTea Supply Chain Attack Hits Global Crypto Developers
In September 2025, a sophisticated supply chain attack targeting the global cryptocurrency development sector was uncovered, orchestrated by North Korea-linked threat actors associated with the Contagious Interview campaign. Leveraging a newly identified backdoor named AkdoorTea—as well as tools like TsunamiKit and Tropidoor—the adversaries compromised software development environments across all major operating systems, including Windows. According to research from ESET, tracked as part of the DeceptiveDevelopment group, attackers used trojanized developer tools and social engineering tactics to infiltrate their targets and facilitate lateral movement, data theft, and potential deployment of further malware within sensitive crypto-related projects. This incident highlights the rising trend of nation-state attackers exploiting software supply chains to infiltrate innovative sectors such as cryptocurrency. It underscores the urgent need for improved east-west traffic visibility, zero trust segmentation, and threat detection controls, as organizations increasingly become targets for persistent, highly resourced adversaries.
8 months ago
Kill Chain
Russia-Backed Disinformation Targets Moldova's 2024 Election
In early 2024, cybersecurity researchers uncovered a coordinated Russian disinformation campaign aimed at Moldova’s upcoming national elections. Threat actors, believed to be linked to state-sponsored Russian groups, leveraged social media platforms, fake news websites, and malicious amplification techniques to spread false narratives and undermine trust in Moldova’s electoral process. The campaign, tracked back to tactics active since 2022, included distribution of forged documents and coordinated inauthentic behavior to influence public perception and destabilize the region ahead of the vote. This incident reflects a broader surge in state-backed information operations targeting elections across Europe and globally. Such campaigns erode democratic institutions, manipulate public opinion, and heighten information security risks for governments and citizens. Organizations and governments must strengthen their capabilities to detect and mitigate influence operations and protect democratic processes.
8 months ago
Kill Chain
Scattered Spider Ransomware: Teen Member Arrested, Group Claims Shutdown in 2024
In June 2024, law enforcement arrested a teenage member of the notorious Scattered Spider ransomware group, a cybercriminal collective linked to disruptive attacks against major organizations including MGM Resorts and Caesars Entertainment. The arrest followed claims by the group that it was shutting down operations amid heightened law enforcement scrutiny and infighting among its members. Scattered Spider became infamous for leveraging social engineering and identity-based attacks to gain initial entry, then rapidly moving laterally to deliver ransomware and conduct data theft. This latest development underscores the increasingly aggressive response from law enforcement to high-impact ransomware threats. The recent action highlights the continued evolution and volatility of ransomware groups, many of which are now using sophisticated identity compromise and cloud-based attack chains. Organizations should remain vigilant as law enforcement disruptions may cause threat actors to splinter, rebrand, or accelerate new attack campaigns using similar techniques.
8 months ago
Kill Chain
Federal Agency Breach: GeoServer Zero-Day Exposes Gaps in 2024 Cyber Defense
In July 2024, attackers exploited CVE-2024-36401—a critical remote code execution vulnerability in the open source GeoServer mapping server—less than two weeks after public disclosure, to breach a US federal civilian executive branch (FCEB) agency. The adversaries gained initial access to public-facing GeoServer instances, subsequently moving laterally through the network using living-off-the-land techniques, dropping web shells (including China Chopper), leveraging brute force and privilege escalation attacks, and establishing command-and-control with open-source tools. Due to delayed patching and inadequate incident response, attackers remained undetected for three weeks, compromising additional servers and extracting sensitive information related to geospatial data and internal credentials. This incident exemplifies the growing risk posed by rapid, post-disclosure exploitation of critical vulnerabilities, particularly those affecting widely deployed open source software. The breach also highlights persistent gaps in vulnerability management, security operations, and incident response readiness at major organizations, driving new urgency around patch timeliness and comprehensive monitoring.
8 months ago
Kill Chain
Webshells Hidden in .well-known Directories: The 2024 Web Application Attack Trend
In September 2024, cybersecurity researchers observed a surge in malicious actors targeting the .well-known directory on web servers to deploy PHP-based webshells. Attackers exploited this typically-overlooked directory, intended for status and authentication files, as it remains web-accessible but hidden within the Unix filesystem. Logs and honeypot data detailed repeated attempts to probe and establish footholds via .well-known and its subdirectories, such as acme-challenge and pki-validation, with the clear goal of persistent, covert remote control. This technique illustrates an evolving trend in web application attacks, where multistage threats exploit common web standards and overlooked controls. Organizations face heightened risk from such stealthy compromises, underscoring the need for continuous monitoring and adaptive defense in the current threat landscape.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports