Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 27 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 313–324 / 3786 reports
AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation
AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation
Financial Services3 weeks ago

AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation

AWS Security Agent, now integrated into AWS Continuum, demonstrated autonomous penetration testing capabilities by successfully exploiting 33 of 37 recently disclosed CVEs in a controlled benchmark environment. The AI-powered agent operated from minimal starting information—just endpoint URLs and single-line hints—to discover vulnerabilities, construct working exploits, and extract hidden flags across diverse software platforms including web frameworks, container registries, ML platforms, and ecommerce stacks. The 89.2% success rate spanned eight vulnerability classes from SQL injection to complex multi-step XSS-to-admin-cookie chains, with some exploits requiring sophisticated chaining of six different attack primitives. Two failures occurred when the agent's aggressive exploitation accidentally destroyed target systems before flag extraction, highlighting the critical need for non-destructive guardrails in autonomous security testing tools. This development represents a significant advancement in AI-driven cybersecurity testing, coinciding with the rapid proliferation of AI agents across enterprise security operations and the growing sophistication of both defensive and offensive AI capabilities in 2025.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Fake AI Malware Campaigns Target 1,258 US Companies in 2026
Fake AI Malware Campaigns Target 1,258 US Companies in 2026
Computer Software/Engineering3 weeks ago

Fake AI Malware Campaigns Target 1,258 US Companies in 2026

Between April and October 2026, cybercriminals launched sophisticated fake AI campaigns targeting US businesses, with attackers impersonating popular AI services like Claude, ChatGPT, GitHub Copilot, and Gemini to distribute infostealer malware. ANY.RUN identified 1,258 public sandbox analyses linked to these campaigns, with US companies accounting for 16% of targeted victims. The attacks used deceptive download pages and malicious PowerShell commands to steal browser sessions, compromise business accounts, and establish persistent access to corporate networks through legitimate-appearing AI software installations. These campaigns represent a significant evolution in social engineering tactics, exploiting the widespread adoption of AI tools in enterprise environments to bypass traditional security awareness training and detection mechanisms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Drupal Field UI Vulnerability Exposes 150K+ Sites to Remote Code Execution
Critical Drupal Field UI Vulnerability Exposes 150K+ Sites to Remote Code Execution
Computer Software/Engineering3 weeks ago

Critical Drupal Field UI Vulnerability Exposes 150K+ Sites to Remote Code Execution

In October 2026, the Drupal Security Team disclosed a critical remote code execution vulnerability (CVE-2026-108097) in Drupal core's Field UI module, affecting versions 10.6.x, 11.3.x, and 11.4.x. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable servers when exploited through contributed modules, with at least one known exploit path requiring no authentication. Patches were released on October 14, 2026, with affected versions updated to 11.4.10, 11.3.19, and 10.6.19. Over 151,000 Drupal sites (28.5% of reporting sites) were running vulnerable versions that received no security updates. This vulnerability represents a growing trend of critical web application flaws targeting content management systems, particularly as organizations increasingly rely on third-party modules and plugins. The incident highlights the persistent challenge of supply chain security in web applications, where core platform vulnerabilities can be weaponized through seemingly unrelated contributed components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation
CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation
Government Administration3 weeks ago

CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation

On October 14, 2026, CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. The vulnerabilities include CVE-2026-0322 affecting Palo Alto Networks PAN-OS (code injection), CVE-2026-76519 in Cisco Secure Email Gateway (path traversal), and CVE-2026-105133/105134 targeting Ahsay AhsayCBS backup solutions (authentication bypass and command injection). These vulnerabilities pose significant risks as they grant attackers substantial control over compromised systems, making them priority targets for threat actors. This KEV addition comes amid heightened focus on vulnerability management following BOD 26-04, which establishes risk-based prioritization requirements for federal agencies. The timing reflects ongoing concerns about sophisticated threat actors exploiting unpatched systems for initial access and lateral movement across enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks
Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks
Computer Software/Engineering3 weeks ago

Critical NGINX Vulnerabilities Expose Web Infrastructure to RCE and TLS Bypass Attacks

NGINX released versions 1.30.6 and 1.31.7 on October 14, 2026, to address five critical vulnerabilities affecting installations since May 2005. The flaws include three memory corruption bugs (CVE-2026-15176, CVE-2026-93479, CVE-2026-97205) that could enable remote code execution, a TLS session forgery vulnerability (CVE-2026-97629) that bypasses client certificate verification, and an HTTP/3 request smuggling issue (CVE-2026-95101). Each vulnerability requires specific configuration directives to exploit, including commonly recommended settings like shared TLS session cache and HTTP/3 support. F5 rates three memory bugs as Critical (9.2 CVSS v4.0), while NGINX considers all five medium severity. This incident highlights ongoing challenges with web infrastructure security, particularly as organizations increasingly rely on reverse proxies and load balancers for cloud-native architectures. The timing coincides with heightened scrutiny of supply chain vulnerabilities and the need for rapid patching cycles in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Panchan Cryptominer Worm: How This Persistent SSH Botnet Continues to Exploit Basic Security Gaps
Panchan Cryptominer Worm: How This Persistent SSH Botnet Continues to Exploit Basic Security Gaps
Information Technology/IT3 weeks ago

Panchan Cryptominer Worm: How This Persistent SSH Botnet Continues to Exploit Basic Security Gaps

The Panchan cryptomining worm, first identified in 2022, continues to propagate across internet-facing systems through SSH brute force attacks and stolen SSH keys. Written in Golang as a peer-to-peer botnet, Panchan employs a rootkit for persistence and leverages Discord channels for command-and-control communications. The worm creates hidden directories with high-entropy names, demonstrates unusual resource consumption, and spreads by stealing SSH credentials from infected systems to pivot to additional hosts listed in known_hosts files. Despite its rudimentary design and detection by multiple security vendors, Panchan remains effective against unpatched and poorly secured systems. This incident highlights the persistent threat of legacy malware families that continue to exploit fundamental security weaknesses in SSH configurations and access controls, demonstrating how basic security gaps enable widespread compromise campaigns.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation
OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation
Financial Services3 weeks ago

OLVX Cybercrime Marketplace Operator Charged in Historic FBI-North Macedonia Joint Operation

In April 2024, authorities in North Macedonia dismantled the OLVX cybercrime marketplace and arrested its alleged 20-year-old administrator, identified as 'E.A.' The platform, operational since 2023, generated over $500,000 in sales by offering stolen credentials, personal data, malicious tools, and child sexual abuse material to more than 2,600 registered customers. The FBI provided intelligence support for this joint international operation, marking the first cyber collaboration between the FBI and North Macedonia. Evidence revealed the suspect sold over 1,500 sets of stolen credentials and operated associated Telegram channels facilitating various cybercrime activities including fraudulent refund schemes. This takedown reflects the growing international cooperation needed to combat cybercrime-as-a-service platforms that democratize access to stolen data and attack tools. As these marketplaces continue proliferating and lowering barriers to cybercrime entry, coordinated law enforcement efforts become increasingly critical for disrupting the underground economy fueling data breaches and identity theft.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery
Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery
Information Technology/IT3 weeks ago

Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery

In October 2026, Microsoft released a record-breaking Patch Tuesday update containing 1,413 vulnerabilities across its enterprise products and services, surpassing the previous annual record of 1,261 CVEs set in 2020. Among these vulnerabilities was one actively exploited zero-day, CVE-2026-96951, affecting Windows Shell that allows attackers to bypass security features. The massive volume of vulnerabilities was attributed to AI-accelerated discovery processes, though experts noted that exploitation rates have not increased proportionally. Microsoft introduced "risk cohorts" to help customers prioritize patching efforts amid the overwhelming number of monthly security updates. This incident highlights the growing challenge organizations face in vulnerability management as AI tools dramatically accelerate both vulnerability discovery and the security patching burden, fundamentally changing how enterprises must approach cybersecurity risk assessment and remediation prioritization.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack
Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack
Financial Services3 weeks ago

Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack

In October 2026, Cisco disclosed and patched CVE-2026-76519, an actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) that allows remote unauthenticated attackers to execute commands with root privileges. The flaw stems from a relative path traversal weakness in SEG's Advanced Malware Protection feature, exploitable through maliciously crafted email attachments. Cisco became aware of active exploitation in October 2026 and has deployed mitigations on cloud instances while providing indicators of compromise to help customers detect potential breaches. This represents the fourth critical SEG vulnerability exploited in the wild since November 2021, highlighting the persistent targeting of email security infrastructure by threat actors seeking initial access and lateral movement capabilities within enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
FBI Disrupts Massive North Korean IT Worker Infiltration Scheme
FBI Disrupts Massive North Korean IT Worker Infiltration Scheme
Information Technology/IT3 weeks ago

FBI Disrupts Massive North Korean IT Worker Infiltration Scheme

In October 2026, the FBI conducted Operation Lonestar Roundup, raiding 40 residences in Texas and seizing 187 laptops used by North Korean threat group Famous Chollima (WageMole) in fraudulent IT worker schemes. The operation disrupted a sophisticated supply chain infiltration where DPRK operatives used stolen identities, laptop farms, and remote access tools to secure employment at U.S. companies while generating revenue for the sanctioned regime. Authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes that affected over 70 companies and generated approximately $3 million since 2019. This incident highlights the evolving threat of state-sponsored actors infiltrating corporate supply chains through identity fraud and remote work infrastructure, representing a critical escalation in North Korea's cyber operations targeting Western technology companies and their sensitive data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies
Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies
Information Technology/IT3 weeks ago

Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies

The U.S. Department of Justice charged 14 individuals and dismantled over 40 laptop farms across Texas in October 2026, disrupting a North Korean fraudulent IT worker scheme known as Famous Chollima. Operating from 2019 to July 2025, the operation involved North Korean IT workers using stolen U.S. identities to secure remote positions at over 70 American companies, generating approximately $3 million in revenue that was funneled back to the DPRK regime to fund nuclear weapons programs. The scheme utilized U.S.-based facilitators who hosted company laptops and enabled financial transfers, while threat actors employed sophisticated techniques including device hash spoofing and subcontracting work to South Asian and West African freelancers. This incident highlights the evolving sophistication of nation-state actors using social engineering and identity theft to penetrate corporate networks at scale. The case demonstrates how geopolitical adversaries are increasingly leveraging legitimate business processes and remote work infrastructure to circumvent sanctions and fund military programs, making insider threat detection and identity verification critical security priorities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors
Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors
Information Technology/IT3 weeks ago

Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors

In September 2026, attackers exploited a critical command injection vulnerability (CVE-2026-110447) in Nextcloud's Collabora Online Built-in CODE Server app to deploy web shells on vulnerable servers. The flaw allowed unauthenticated attackers to execute arbitrary commands when the local document server was offline during restarts, upgrades, or crashes. Multiple administrators reported compromised servers starting September 10, with attackers deploying PHP web shells and searching for cryptocurrency wallets, credential stores, and sensitive files. Collabora patched the vulnerability in version 26.4.303 on September 11, but the security advisory wasn't published until October 14, leaving many installations exposed for weeks. This incident highlights the growing trend of supply chain attacks targeting third-party integrations and the critical importance of timely security disclosures, especially as organizations increasingly rely on interconnected cloud applications and document collaboration platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports