The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3574 threat reports
Page 284 of 298
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 3397–3408 / 3574 reports
Akira Ransomware Launches Mass Attack on SonicWall VPNs in 2025
Financial Services9 months ago

Akira Ransomware Launches Mass Attack on SonicWall VPNs in 2025

In mid-2025, Akira ransomware operators launched a widespread campaign targeting organizations using SonicWall VPN appliances, exploiting a critical vulnerability (CVE-2024-40766) in SonicOS firmware. Attackers achieved initial access through malicious SSL VPN logins, sometimes even bypassing one-time password (OTP) multi-factor authentication controls. Following a successful breach, the attackers conducted rapid port scanning and lateral movement via Impacket SMB activity before deploying Akira ransomware, impacting organizations across various sectors. Despite firmware updates and password resets, compromised credentials persisted, leaving several devices exposed, and the campaign has continued to escalate into late September 2025. This incident illustrates the ongoing evolution and sophistication of ransomware campaigns exploiting network infrastructure vulnerabilities and underscores the urgency of proactive credential management, privileged access monitoring, and swift patch adoption. It exemplifies growing attacks abusing VPNs and MFA, requiring organizations to revisit zero trust and layered defense measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Malicious MCP Server Abuses AI Email Automation for Covert Secrets Exfiltration
Financial Services9 months ago

Malicious MCP Server Abuses AI Email Automation for Covert Secrets Exfiltration

In June 2024, researchers uncovered a supply-chain attack involving a malicious Managed Communication Platform (MCP) AI server deployed by enterprises for automating routine email tasks, such as password resets, account confirmations, and invoicing. Threat actors subverted the platform to silently exfiltrate sensitive information by routing copies of key emails via BCC fields to attacker-controlled addresses. This tactic enabled attackers to capture credentials, personally identifiable information (PII), and financial data from authentic business processes, making detection extremely challenging and extending the risk across multiple organizations leveraging the affected platform. The incident highlights a growing trend of attackers abusing trusted third-party SaaS and AI service integrations to conduct covert exfiltration at scale. As supply-chain vectors proliferate, organizations face increased pressure to monitor internal communication workflows and enforce egress controls on platform-generated messaging.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AI Voice Cloning Ushers in the Next Wave of Real-Time Vishing Attacks
Financial Services9 months ago

AI Voice Cloning Ushers in the Next Wave of Real-Time Vishing Attacks

In mid-2024, cybersecurity researchers from NCC Group demonstrated that AI-powered voice cloning now enables highly convincing, real-time vishing (voice phishing) attacks. By training voice models with just a few minutes of publicly available recordings, attackers were able to conduct live phone calls, impersonate executives or IT staff, and successfully extract sensitive information from organizations and individuals. Notably, real organizations were targeted in proof-of-concept scams that bypassed prior limitations such as latency or unnatural responses, blurring the line between real and synthetic voices and exposing significant new avenues for social engineering that traditional defenses may not stop. This incident highlights the rapid escalation in the capabilities of cybercriminals leveraging generative AI for social engineering. Security leaders are now facing an urgent need to adapt defenses, reconsider trust in voice authentication, and train employees about increasingly undetectable scams as vishing becomes more automated, scalable, and effective using minimal resources and AI frameworks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Google Gemini AI Model Vulnerabilities: The 2024 Security Wake-Up Call
Computer Software/Engineering9 months ago

Google Gemini AI Model Vulnerabilities: The 2024 Security Wake-Up Call

In early 2024, significant security and privacy vulnerabilities were discovered across multiple Google Gemini AI models, exposing users and enterprises to attack vectors that could have led to data leakage, privilege escalation, and AI-assisted exploitation. Researchers identified a 'trifecta' of flaws enabling prompt injection, sensitive data exposure, and circumvention of embedded safety controls, highlighting weaknesses in current generative AI guardrails. While no widespread attacker exploitation was confirmed, proof-of-concept attacks demonstrated how these flaws could weaponize Gemini models as an attack surface and vehicle for secondary threats. The disclosure prompted urgent reviews of AI usage and mitigations for enterprise consumers. This incident underscores escalating risks as generative AI platforms become embedded across business workflows. It illustrates the urgent challenge of securing large language models (LLMs) against novel exploitation methods and the rapidly intensifying focus by both attackers and regulators on AI/ML supply chain security.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Medusa Ransomware’s Failed Insider Recruitment at BBC (2025)
Broadcast Media9 months ago

Medusa Ransomware’s Failed Insider Recruitment at BBC (2025)

In July 2025, cybercriminals claiming affiliation with the Medusa ransomware group attempted to compromise the BBC by recruiting a journalist as an insider. The threat actor contacted the BBC’s cybersecurity correspondent via Signal, offering a percentage of any ransom if the journalist would provide internal access. Their plan relied on leveraging the journalist’s BBC credentials to infiltrate systems, download sensitive data, and initiate a high-value ransomware attack. The attackers used multiple social engineering tactics, including MFA fatigue (MFA bombing), but the journalist reported the approach to BBC’s security team, preventing a breach and prompting immediate incident response measures. This incident highlights the increasing risk of ransomware groups seeking insiders for network access, as well as the sophistication of social engineering tactics. As double-extortion attacks and insider recruitment surge, organizations must enhance vigilance and reinforce controls to mitigate identity-driven threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Malicious MCP Server Uncovered in 'postmark-mcp' npm Package Supply Chain Breach
Computer Software/Engineering9 months ago

Malicious MCP Server Uncovered in 'postmark-mcp' npm Package Supply Chain Breach

In September 2025, cybersecurity researchers identified the first active malicious deployment of a Model Context Protocol (MCP) server, delivered through a compromised open-source npm package called "postmark-mcp." The attacker, masquerading as a legitimate developer, introduced rogue code into the package to stealthily exfiltrate user emails to an adversary-controlled MCP server. The package closely mimicked the official Postmark Labs library, making detection challenging for organizations relying on the trusted supply chain. The incident highlights the growing sophistication and operational impact of supply chain compromise, especially within widely used repositories like npm. This supply chain breach underscores a wider trend of attackers targeting open-source ecosystems to weaponize trusted libraries for data theft and persistent access, driving regulatory scrutiny and risk to software providers and their customers. With the acceleration of software supply chain attacks, organizations face increased pressure to enhance dependency audits and adopt zero trust controls.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
EvilAI: Malware Masquerading as AI Tools Targets Global Enterprises in 2025
Computer Software/Engineering9 months ago

EvilAI: Malware Masquerading as AI Tools Targets Global Enterprises in 2025

In September 2025, global organizations became targets of a sophisticated malware campaign in which cybercriminals disguised malicious payloads within seemingly legitimate AI productivity tools and software. Security researchers at Trend Micro identified that attackers leveraged the growing popularity and trust in AI-driven solutions to distribute their malware, affecting companies across Europe, the Americas, and AMEA. Adversaries exploited trusted distribution channels, leveraging convincing phishing and software bundling tactics to achieve initial access, with the primary goal of establishing persistent footholds for future attacks, including lateral movement and data exfiltration. The incident disrupted IT operations, forced incident response, and increased the risk of data theft and regulatory exposure. This breach highlights the rapid evolution of social engineering techniques tied to AI trends, with attackers exploiting user demand for productivity tools as an entry point. It underscores an urgent need for heightened vigilance, zero trust policies, and real-time threat detection in the face of shadow AI and increasingly indistinguishable malicious downloads.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Ukrainian Police Spoofed: SVG Fileless Phishing Delivers Amatera Stealer in Kyiv
Government Administration9 months ago

Ukrainian Police Spoofed: SVG Fileless Phishing Delivers Amatera Stealer in Kyiv

In early 2024, cybercriminals conducted a sophisticated phishing campaign targeting organizations and individuals in Kyiv, Ukraine, by spoofing the National Police of Ukraine. The attackers distributed malicious emails containing Scalable Vector Graphics (SVG) files, which enabled fileless delivery of info-stealing malware such as Amatera Stealer and the cryptocurrency miner PureMiner. By leveraging social engineering and trusted police branding, they bypassed common security defenses, leading to the theft of sensitive credentials, system compromise, and potential financial losses. The breach highlights attackers’ growing reliance on fileless techniques and deceptive lures to infiltrate victims’ environments with minimal detection. This incident underlines a shift toward advanced, stealthy phishing tactics that weaponize graphics files and trusted institutional identities. The approach signifies an escalating trend in cybercrime, where threat actors continue to innovate to evade legacy controls and exploit user trust amid ongoing geopolitical unrest.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
2025’s Cyber Tsunami: Cisco 0-Day, Record DDoS & Multi-Vector Threats Unleashed
Information Technology/IT9 months ago

2025’s Cyber Tsunami: Cisco 0-Day, Record DDoS & Multi-Vector Threats Unleashed

In September 2025, the global cybersecurity landscape faced a convergence of high-profile threats, including a critical Cisco 0-day vulnerability, record-breaking distributed denial-of-service (DDoS) attacks, an emergent LockBit 5.0 ransomware variant, multiple vulnerabilities targeting baseboard management controllers (BMC), and rapid expansion of the ShadowV2 botnet. Adversaries exploited the Cisco 0-day to gain privileged access, launched multi-vector DDoS assaults disrupting online services, compromised server hardware via BMC flaws, and weaponized the new LockBit variant for data extortion and ransomware. The combination of these attacks resulted in widespread operational instability, data breaches, and heightened risk exposure across cloud and on-premises environments. These incidents underscore the rapidly evolving threat landscape, marked by increasingly sophisticated and diverse attack vectors that target infrastructure, software, hardware, and supply chains simultaneously. The convergence of ransomware, DDoS, and zero-day exploitation—often driven by organized cybercriminal groups—signals an urgent need for organizations to adopt layered, zero trust security strategies and accelerate detection and response.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Akira Ransomware: MFA-Protected SonicWall VPNs Breached in 2024
Financial Services9 months ago

Akira Ransomware: MFA-Protected SonicWall VPNs Breached in 2024

In early 2024, the Akira ransomware group escalated its campaign by successfully breaching organizations through SonicWall SSL VPN appliances, even when multi-factor authentication (MFA) was enabled. Security researchers determined that Akira actors appeared to bypass one-time password (OTP) protections, potentially by leveraging previously obtained OTP seed information or exploiting weaknesses in authentication management. Following the VPN compromise, attackers moved laterally, exfiltrated data, and encrypted systems to demand substantial ransom payments. This attack vector enabled access to privileged internal resources, resulting in business disruption, data exposure, and financial losses for affected organizations. The incident underscores how ransomware operators are adapting to bypass commonly deployed defenses, specifically targeting VPN and MFA solutions. Such tactics highlight the urgent need for organizations to reassess remote access controls, authentication infrastructure, and visibility gaps, as similar techniques are increasingly observed in the wild.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Fake Microsoft Teams Installers Spread Oyster Malware via Malvertising
Information Technology/IT9 months ago

Fake Microsoft Teams Installers Spread Oyster Malware via Malvertising

In September 2025, cybercriminals exploited search engine advertisements and SEO poisoning to promote fake Microsoft Teams installers, which covertly delivered the Oyster backdoor (also known as Broomstick or CleanUpLoader) onto Windows devices. By luring users—often IT administrators—to download malicious 'MSTeamsSetup.exe' files from deceptive sites like teams-install[.]top, attackers established remote control over compromised systems. The malware facilitated persistent access by installing a scheduled task and enabled command execution, lateral movement, deployment of additional payloads, and file exfiltration, posing considerable risks to corporate environments. Organizations relying on user trust in branded software searches became targets for subsequent attacks, including potential ransomware deployment. This incident underscores a growing threat: attackers increasingly abuse mainstream search engines and brand impersonation to achieve initial corporate access. As malvertising and SEO poisoning campaigns surge, organizations must prioritize user security awareness, robust endpoint threat detection, and zero trust controls to defend against evolving infostealer delivery mechanisms.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Cisco Firewall Zero-Day Incident: RayInitiator & LINE VIPER Malware Exposed
Government Administration9 months ago

Cisco Firewall Zero-Day Incident: RayInitiator & LINE VIPER Malware Exposed

In September 2025, Cisco ASA firewalls faced a severe cybersecurity incident when threat actors leveraged recently disclosed zero-day vulnerabilities to secretly infiltrate network perimeters. The attackers exploited these flaws to deploy two newly discovered malware strains, RayInitiator and LINE VIPER, allowing them to bypass existing defenses, maintain persistence, and exfiltrate sensitive data from affected enterprises. This highly sophisticated campaign showcased advanced persistent threat (APT) tradecraft, utilizing encrypted command-and-control traffic and lateral movement within east-west network segments, impacting organizations across multiple sectors and creating significant operational and reputational risks. This incident underscores an emergent pattern of targeting network infrastructure devices with custom malware, reflecting broader shifts in attacker strategy. As attackers increasingly refine zero-day exploitation and expand their arsenal, organizations must adapt security postures to detect and respond to threats traversing both perimeter and internal network boundaries.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports