Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 31 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 361–372 / 3786 reports
Critical Vulnerabilities Expose Red Lion Controls Industrial Switches to Complete Compromise
Critical Vulnerabilities Expose Red Lion Controls Industrial Switches to Complete Compromise
Critical Manufacturing4 weeks ago

Critical Vulnerabilities Expose Red Lion Controls Industrial Switches to Complete Compromise

Red Lion Controls N-Tron 700 Series industrial network switches contain seven critical vulnerabilities (CVE-2026-32645 through CVE-2026-33272) discovered in October 2026. The vulnerabilities include hardcoded credentials, plaintext password storage, unauthenticated SNMP access, and missing firmware integrity checks. Attackers can gain administrative access, extract configuration files, push malicious firmware, and cause denial-of-service conditions through automated rebooting. These switches are deployed worldwide across critical infrastructure sectors including manufacturing, communications, and commercial facilities. This incident highlights the persistent security challenges in industrial control systems, particularly as critical infrastructure becomes increasingly connected. The combination of authentication bypasses and configuration exposure creates significant risk for operational technology environments where network switches serve as foundational infrastructure components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Cybersecurity Executive Arrested: The Dark Side of Ransomware Negotiations
Cybersecurity Executive Arrested: The Dark Side of Ransomware Negotiations
Computer/Network Security4 weeks ago

Cybersecurity Executive Arrested: The Dark Side of Ransomware Negotiations

Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive and founder of CYPFER, was arrested by federal authorities in Pennsylvania on charges of conspiracy and extortion. Dubrovsky's firm specializes in helping organizations negotiate with ransomware operators, but he now faces charges of conspiring to threaten information confidentiality for extortion and Hobbs Act violations. The arrest appears connected to the ShinyHunters ransomware group's attack on FBI IT systems, which exposed personal data of thousands of bureau employees. The breach originated from an unpatched third-party contractor system managed by Accenture. This incident highlights the growing complexity of ransomware negotiations and the blurred lines between legitimate cybersecurity consulting and criminal conspiracy. As ransomware attacks continue to surge and regulatory scrutiny intensifies, organizations must carefully vet their incident response partners and ensure compliance with evolving legal frameworks around ransom payments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Citrix NetScaler RCE Vulnerability Demands Immediate Action
Critical Citrix NetScaler RCE Vulnerability Demands Immediate Action
Financial Services1 month ago

Critical Citrix NetScaler RCE Vulnerability Demands Immediate Action

Citrix issued an urgent security advisory on October 9, 2026, warning administrators to immediately patch CVE-2026-107406, a critical remote code execution vulnerability affecting NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers or Service Providers. The memory overflow flaw allows attackers to execute arbitrary code or trigger denial-of-service conditions on vulnerable systems. With over 21,000 NetScaler instances exposed on the internet according to Shadowserver data, the attack surface is significant, though Citrix reports no active exploitation at publication time. This vulnerability highlights the continuing trend of critical infrastructure attacks targeting identity and access management systems. Following a pattern of recent NetScaler zero-day exploits used in ransomware campaigns, organizations face increasing pressure to maintain rapid patch cycles for internet-facing authentication infrastructure as threat actors prioritize high-value gateway systems for initial access and lateral movement.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical SonicWall SMA1000 Vulnerability Under Active Exploitation: CVE-2026-102255 Analysis
Critical SonicWall SMA1000 Vulnerability Under Active Exploitation: CVE-2026-102255 Analysis
Government Administration1 month ago

Critical SonicWall SMA1000 Vulnerability Under Active Exploitation: CVE-2026-102255 Analysis

In October 2026, attackers began exploiting CVE-2026-102255, a maximum-severity server-side request forgery (SSRF) vulnerability in SonicWall SMA1000 secure remote access appliances. The flaw affects the Appliance WorkPlace interface on models 6210, 7210, and 8200v, allowing unauthenticated remote attackers to force appliances to issue requests on their behalf and access internal functionality. Security researchers detected exploitation attempts targeting the WorkPlace Extraweb interface using crafted OPTIONS requests to reach internal CouchDB services with default credentials. Over 400 SMA1000 appliances remain exposed online, representing significant risk to enterprise VPN infrastructure used by managed service providers, corporations, and government agencies. This incident follows a pattern of SMA1000 vulnerabilities being actively exploited, with CISA cataloging 19 SonicWall flaws as exploited in the wild over four years, including 13 linked to ransomware operations. The rapid weaponization demonstrates how critical infrastructure components become prime targets for threat actors seeking network access and lateral movement opportunities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
FBI Arrests Another ShinyHunters Member After Massive Agency Breach Exposes Employee Data
FBI Arrests Another ShinyHunters Member After Massive Agency Breach Exposes Employee Data
Government Administration1 month ago

FBI Arrests Another ShinyHunters Member After Massive Agency Breach Exposes Employee Data

The FBI arrested another suspected ShinyHunters member in October 2026 following the group's breach of FBI systems through an Oracle PeopleSoft zero-day vulnerability. The attack, which occurred in September 2026, compromised FBI-managed AWS GovCloud infrastructure and resulted in the theft of 2-3TB of sensitive data including employee records, Social Security numbers, medical information, and family member details affecting all FBI personnel. This represents the fourth arrest in recent weeks as law enforcement dismantles the notorious data extortion group. This incident highlights the escalating threat landscape where even premier law enforcement agencies fall victim to sophisticated threat actors exploiting zero-day vulnerabilities and cloud infrastructure weaknesses, demonstrating the urgent need for enhanced cloud security postures across all sectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
AhsayCBS Zero-Day Chain Enables Stealthy Crypto Mining Campaign
AhsayCBS Zero-Day Chain Enables Stealthy Crypto Mining Campaign
Information Technology/IT1 month ago

AhsayCBS Zero-Day Chain Enables Stealthy Crypto Mining Campaign

In October 2026, threat actors exploited two unpatched vulnerabilities in AhsayCBS backup management platform - CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (OS command injection) - to deploy webshells and cryptocurrency miners. The attackers chained these vulnerabilities to gain initial access, conduct reconnaissance, and install XMRig miners disguised as Microsoft Edge services across at least five organizations. The malware included sophisticated evasion techniques using AI-assisted PowerShell scripts that detect Task Manager activity and automatically suspend mining operations to avoid detection. This incident highlights the growing trend of cryptomining attacks targeting unpatched enterprise software, particularly backup solutions used by managed service providers. The exploitation of critical infrastructure components like backup systems poses significant operational risks and demonstrates how attackers are increasingly using AI-enhanced tools for stealth and persistence.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Adception Attack: When Trusted Platforms Become Malware Delivery Vectors
Marketing/Advertising/Sales1 month ago

Adception Attack: When Trusted Platforms Become Malware Delivery Vectors

In October 2026, cybercriminals launched a sophisticated malvertising campaign dubbed 'Adception' targeting macOS users searching for Claude AI software. The attackers exploited Google Ads and Bing's click-tracking redirects to bypass security measures, directing victims through compromised WordPress sites to fake Claude download pages. The campaign used multi-layered cloaking and clipboard hijacking techniques, substituting legitimate installation commands with malicious Base64-encoded scripts that downloaded unknown payloads from attacker-controlled servers. This incident highlights the evolving sophistication of AI-themed social engineering attacks and the exploitation of trusted advertising platforms. As AI tools become mainstream business applications, attackers increasingly target these popular services to deliver malware while exploiting user trust in legitimate domains and installation processes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
ShinyHunters FBI Breach: How Contractor Failures Led to Massive Government Data Theft
ShinyHunters FBI Breach: How Contractor Failures Led to Massive Government Data Theft
Law Enforcement1 month ago

ShinyHunters FBI Breach: How Contractor Failures Led to Massive Government Data Theft

In September 2026, the ShinyHunters extortion group breached the FBI's jobs portal (FBIjobs.gov) and stole sensitive data on nearly all FBI agents and job applicants. The breach resulted from a security failure when an Accenture contractor failed to implement a critical security patch on Oracle's PeopleSoft HR platform. The stolen data included extensive personal information, details of sensitive job roles, and psychiatric and medical records of FBI personnel. The FBI has arrested three suspected co-conspirators across multiple countries, including a 24-year-old in the Netherlands, a suspect in Jordan who is cooperating with authorities, and most recently a Canadian citizen arrested in Pennsylvania. This incident highlights the growing sophistication of extortion groups targeting high-profile government agencies and the critical risks posed by third-party contractor vulnerabilities in managing sensitive federal systems and data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
AgentCorruption: How One AI Prompt Nearly Broke AWS Security
AgentCorruption: How One AI Prompt Nearly Broke AWS Security
Computer Software/Engineering1 month ago

AgentCorruption: How One AI Prompt Nearly Broke AWS Security

In December 2025, Zenity Labs discovered 'AgentCorruption,' a critical vulnerability in AWS Bedrock AgentCore that allowed attackers to compromise entire AWS environments through a single malicious prompt to AI agents. The flaw exploited AWS Instance Metadata Services (IMDS) access within Firecracker MicroVMs, enabling lateral movement across all AgentCore resources in affected regions. Attackers could obtain temporary credentials, invoke additional agents, access secrets from AWS Secrets Manager, and poison agent memory through overprivileged default roles and insufficient network isolation. This incident highlights the growing security risks as organizations rapidly deploy AI agents in cloud environments without proper isolation controls. The vulnerability demonstrates how AI and cloud security intersect, creating new attack vectors that traditional security measures may not adequately address.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
The New Threat Vector: How Cybercriminals Target Executive Families to Breach Corporate Networks
The New Threat Vector: How Cybercriminals Target Executive Families to Breach Corporate Networks
Financial Services1 month ago

The New Threat Vector: How Cybercriminals Target Executive Families to Breach Corporate Networks

Cybercriminals are increasingly targeting executives' family members and personal contacts as a pathway to corporate networks, exploiting the weaker security postures of non-technical household members. Research shows that 51% of organizations reported attacks on business leaders in 2025, with 39% of executives having already compromised devices during security onboarding. Attackers leverage AI-enhanced reconnaissance to map family relationships through social media, then execute impersonation attacks, device compromises, and sophisticated phishing campaigns targeting spouses, children, and trusted associates. The consequences extend beyond digital breach to physical surveillance, extortion, and fraudulent financial transfers. This trend represents a critical evolution in social engineering tactics, where the weakest link in an executive's personal ecosystem becomes the entry point for enterprise compromise, demanding immediate expansion of security awareness programs beyond corporate boundaries.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Social Engineering AI Agents: The Evolution of Business Email Compromise
Social Engineering AI Agents: The Evolution of Business Email Compromise
Financial Services1 month ago

Social Engineering AI Agents: The Evolution of Business Email Compromise

As artificial intelligence agents become increasingly integrated into business operations with elevated system privileges, cybercriminals are developing sophisticated social engineering techniques to manipulate these autonomous systems. Unlike traditional business email compromise (BEC) attacks that target human decision-makers, threat actors are now crafting attacks specifically designed to exploit AI agents' logical processes and decision trees. These attacks leverage prompt injection techniques, context manipulation, and adversarial inputs to trick AI systems into executing unauthorized transactions, data transfers, or administrative actions. The financial and operational impact mirrors traditional BEC schemes but with potentially greater scale and automation capabilities. This emerging threat vector represents a critical evolution in social engineering as organizations rapidly deploy AI agents for financial transactions, supply chain management, and customer service operations without adequate security controls.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Flax Typhoon Exploits Five Critical Flaws as CISA Sets Federal Compliance Deadline
Flax Typhoon Exploits Five Critical Flaws as CISA Sets Federal Compliance Deadline
Government Administration1 month ago

Flax Typhoon Exploits Five Critical Flaws as CISA Sets Federal Compliance Deadline

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added five security vulnerabilities to its Known Exploited Vulnerabilities catalog following active exploitation by the China-linked threat actor Flax Typhoon. The vulnerabilities span multiple systems including ProFTPD, ONLYOFFICE Docs, Strapi, Apache Struts, and ISC BIND, with CVSS scores ranging from 7.2 to 10.0. The attacks were facilitated by China-based cybersecurity company Integrity Technology Group, targeting organizations through scanning tools, cross-site scripting attacks, and password spraying on Microsoft Exchange servers to establish persistence and exfiltrate sensitive data including emails and credentials. This incident highlights the escalating threat from state-sponsored actors positioning themselves within critical infrastructure networks, including operational technology systems, with the strategic intent to disrupt critical functions at predetermined times. The coordinated international response from seven nations underscores the global recognition of this persistent threat landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports