Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Understanding Certighost (CVE-2026-54121): A Critical AD CS Vulnerability
In July 2026, a critical vulnerability known as Certighost (CVE-2026-54121) was identified in Microsoft's Active Directory Certificate Services (AD CS). This flaw allowed authenticated, low-privileged domain users to exploit the certificate enrollment process, obtaining certificates that impersonate Domain Controllers. By leveraging this vulnerability, attackers could escalate their privileges, potentially leading to full domain compromise. Microsoft addressed this issue with a security update released on July 14, 2026. ([techcommunity.microsoft.com](https://techcommunity.microsoft.com/blog/MicrosoftThreatProtectionBlog/detecting-cve-2026-54121-certighost-with-microsoft-defender/4542861?utm_source=openai)) The release of a public proof-of-concept (PoC) exploit on July 24, 2026, heightened the urgency for organizations to apply the patch promptly. This incident underscores the critical importance of securing certificate authorities and regularly auditing Active Directory configurations to prevent privilege escalation attacks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/07/27/certighost-cve-2026-54121-poc-exploit-released/?utm_source=openai))
1 month ago
Kill Chain
Cavern C2 Framework's Evolution: Leveraging DNS and Google Apps Script for Stealth
In August 2026, cybersecurity researchers identified advancements in the Cavern (aka Cav3rn) command-and-control (C2) framework, utilized by Iranian nation-state hackers targeting Israeli entities. The updated framework incorporates a complex C2 module that leverages DNS A-record responses to dynamically select between direct HTTPS communication and a Google Apps Script relay for each transaction. This evolution enhances the framework's ability to blend malicious traffic with legitimate network activity, complicating detection efforts. The Cavern framework, first documented in July 2026, is associated with the Cavern Manticore group, linked to Iran's Ministry of Intelligence and Security (MOIS), and shares overlaps with other Iranian threat actors such as MuddyWater and Lyceum. The modular architecture of Cavern facilitates various post-exploitation activities, including file operations, database enumeration, Active Directory reconnaissance, and network tunneling. The integration of legitimate services like Google Apps Script and Microsoft 365 calendars into its C2 channels underscores a strategic shift towards more covert and resilient communication methods. This development highlights the increasing sophistication of nation-state cyber operations and the challenges in detecting and mitigating such threats.
1 month ago
Kill Chain
Massive Azure Data Breach: 3.6 Million Records Allegedly Stolen
In August 2026, a threat actor known as "TheHatman" claimed to have stolen 3.64 million employee records from multiple Fortune 500 companies by exploiting compromised credentials to access their Microsoft Azure infrastructures. The stolen data reportedly includes names, employee IDs, email addresses, job titles, phone numbers, postal addresses, service accounts, and other tenant account records. Companies allegedly affected include McDonald's, Gap Inc., Vodafone, Tata Consultancy Services, HCL Technologies, InterContinental Hotels, and Kyndryl. Some organizations have disputed the claims, stating that the data appears outdated and that no credible evidence of a breach was found. This incident underscores the persistent threat posed by credential-based attacks and highlights the importance of robust authentication mechanisms. The use of techniques such as password spraying and Multi-Factor Authentication (MFA) fatigue attacks demonstrates the evolving tactics of cybercriminals targeting cloud infrastructures.
1 month ago
Kill Chain
Snowflake's GitHub Actions Flaw: A Wake-Up Call for CI/CD Security
In June 2026, a security vulnerability was identified in Snowflake's public GitHub repository, specifically within the 'snowflake-connector-net' project. The flaw resided in the 'jira_issue.yml' GitHub Actions workflow, which processed issue titles and bodies without proper sanitization. This oversight allowed attackers to craft malicious GitHub issues that, when processed by the workflow, executed unauthorized commands. These commands had access to internal Jira credentials, potentially exposing sensitive project information. Snowflake promptly addressed the issue by updating the workflow to handle inputs securely and rotated the compromised Jira tokens. No evidence of unauthorized access was found during their investigation. This incident underscores the critical importance of input validation and secure coding practices in CI/CD pipelines. As organizations increasingly rely on automated workflows, ensuring that these processes are safeguarded against injection attacks is paramount to maintaining the integrity and security of development environments.
1 month ago
Kill Chain
Critical Vulnerability in Forminator WordPress Plugin (CVE-2026-15748) Puts Sites at Risk
In August 2026, a critical vulnerability (CVE-2026-15748) was identified in the Forminator Forms WordPress plugin, affecting over 600,000 active installations. This flaw allowed unauthenticated attackers to upload arbitrary files, including executable PHP scripts, leading to potential remote code execution and complete site compromise. The issue stemmed from insufficient file type validation in the 'handle_file_upload()' function, particularly when forms contained both a File Upload field and a Select field. The vulnerability was addressed in version 1.56.2, released on July 31, 2026. This incident underscores the persistent risks associated with web application vulnerabilities, especially in widely used plugins. It highlights the importance of regular security assessments and prompt updates to mitigate potential exploits that can lead to significant operational disruptions and data breaches.
1 month ago
Kill Chain
GitLab Patches Critical GraphQL Vulnerability (CVE-2026-19478)
In August 2026, GitLab identified and patched a critical vulnerability (CVE-2026-19478) in its Community and Enterprise Editions. This flaw allowed unauthenticated attackers to remotely modify or delete public projects and user data via a GraphQL directive. The vulnerability affected versions from 18.2 up to 18.11.10, 19.0 up to 19.0.7, 19.1 up to 19.1.5, and 19.2 up to 19.2.3. GitLab released patches in versions 18.11.11, 19.0.8, 19.1.6, and 19.2.4 to address this issue. This incident underscores the critical importance of timely vulnerability management and patching in software development environments. The exploitation of such vulnerabilities can lead to significant data loss and operational disruptions, emphasizing the need for robust security practices and continuous monitoring.
1 month ago
Kill Chain
Evooo1Bot: A New Era of Botnet Threats Targeting IoT Devices
In August 2026, security researchers identified a new Linux-based botnet named Evooo1Bot, which extends the capabilities of the infamous Mirai malware beyond traditional Distributed Denial of Service (DDoS) attacks. Evooo1Bot exploits vulnerabilities in various Internet-facing devices, including those from Alcatel, NETGEAR, Tenda, Mitsubishi Electric, Telesquare, and D-Link, some dating back to 2007. Once compromised, these devices are utilized for credential theft, establishing encrypted command-and-control communications, and setting up reverse SOCKS proxies, effectively transforming them into persistent attacker infrastructure. ([arstechnica.com](https://arstechnica.com/security/2026/03/14000-routers-are-infected-by-malware-thats-highly-resistant-to-takedowns/?utm_source=openai)) The emergence of Evooo1Bot underscores the evolving threat landscape where botnets are increasingly used for multifaceted cyberattacks beyond DDoS. This development highlights the critical need for organizations to secure Internet of Things (IoT) devices, promptly apply security patches, and implement robust network monitoring to detect and mitigate such sophisticated threats.
1 month ago
Kill Chain
August 2026 Cybersecurity Incidents: City-Forum Campaign, ShipMonk Data Breach, and Cursor CLI Vulnerability
In August 2026, multiple cybersecurity incidents emerged, including the 'City-Forum' campaign targeting unauthenticated guest user access in Salesforce Experience Cloud and ServiceNow Service Portals, leading to significant data exfiltration. Additionally, ShipMonk, a shipping provider for Trezor, suffered a data breach exposing sensitive customer information. Furthermore, Cursor's CLI coding agent was found to execute untrusted repository code without user consent, posing a significant security risk. These incidents underscore the evolving threat landscape, highlighting the need for robust security measures and vigilance against sophisticated attack vectors.
1 month ago
Kill Chain
CTM360's 'RecruitTrap' Campaign Unveils Sophisticated Phishing Tactics
In August 2026, CTM360 uncovered a large-scale phishing campaign named 'RecruitTrap,' involving over 3,000 malicious URLs designed to steal Google and Facebook credentials. The attackers impersonated recruiters from more than 50 organizations across 14 sectors, primarily targeting marketing professionals. Victims received unsolicited emails or meeting invitations leading to counterfeit interview scheduling pages. These pages employed Browser-in-the-Browser (BitB) techniques to display fake authentication pop-ups, tricking users into entering their credentials and multi-factor authentication codes, which were then relayed to the attackers in real time. This incident highlights the increasing sophistication of phishing attacks, particularly those leveraging BitB techniques to bypass traditional security measures. The focus on marketing professionals underscores the strategic targeting of roles with access to sensitive corporate resources, emphasizing the need for heightened vigilance and advanced security protocols to protect against such evolving threats.
1 month ago
Kill Chain
Mustang Panda's CoolClient Backdoor: A New Era of Stealth with Signed Rootkits
In August 2026, the Chinese state-sponsored threat actor known as Mustang Panda (also referred to as HoneyMyte) deployed an enhanced version of their CoolClient backdoor, now incorporating a signed Windows kernel-mode rootkit. This advancement enables the malware to conceal and protect malicious processes, files, registry entries, and command-and-control (C2) communications, significantly bolstering its stealth capabilities. The campaign targeted government entities in Myanmar, Mongolia, Pakistan, and Russia, with CoolClient often deployed as a secondary backdoor following an initial PlugX infection. The rootkit is installed when the malware attains full access to the Service Control Manager and the SeTcbPrivilege privilege; otherwise, it proceeds without the driver component. Kaspersky's analysis revealed that the driver, named msagent.sys, is digitally signed with a certificate issued to Nanjing Ranyi Technology Co., Ltd., valid from August 2013 to September 2014. This development underscores the evolving sophistication of Mustang Panda's toolset and their persistent focus on governmental targets. The integration of a signed kernel-mode rootkit into CoolClient reflects a broader trend among advanced persistent threat (APT) groups toward enhancing malware stealth to evade detection. This incident highlights the critical need for organizations, especially government agencies, to implement robust endpoint detection and response (EDR) solutions capable of identifying and mitigating such sophisticated threats. Additionally, it emphasizes the importance of continuous monitoring and updating of security protocols to counteract the evolving tactics of state-sponsored cyber adversaries.
1 month ago
Kill Chain
Wireshark 4.6.8: Enhancing Network Security with Critical Fixes
In August 2026, Wireshark released version 4.6.8, addressing 28 vulnerabilities and 25 bugs. Notable fixes include the ROHC protocol dissector crash (wnpa-sec-2026-51) and the IEEE 802.11 protocol dissector crash (wnpa-sec-2026-57). These vulnerabilities could lead to denial of service, impacting network analysis capabilities. ([wireshark.org](https://www.wireshark.org/security/?utm_source=openai)) The release underscores the importance of timely software updates to mitigate security risks. Organizations relying on Wireshark for network monitoring should upgrade to version 4.6.8 to ensure system integrity and operational continuity.
1 month ago
Kill Chain
China-Nexus APT Exploits VMware vCenter Vulnerability to Deploy Ransomware
In August 2026, a suspected China-nexus advanced persistent threat (APT) exploited CVE-2026-59310, a critical directory-traversal vulnerability in VMware vCenter Server, to execute arbitrary code. This campaign compromised 361 unique IP addresses across 47 countries, including Germany, the U.S., Turkey, Iran, and France. The attackers deployed Babuk-derived ransomware on ESXi hosts, encrypting files with the ".babyk" extension, potentially as a smokescreen to distract defenders and hinder forensic analysis. This incident underscores the urgency for organizations to promptly apply security patches, especially for critical vulnerabilities in widely used infrastructure. The rapid exploitation following public disclosure highlights the need for proactive vulnerability management and robust incident response strategies to mitigate the risks posed by sophisticated threat actors.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports