Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 46 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 541–552 / 3786 reports
Ryuk Ransomware Operator Sentenced: Lessons for Enterprise Security
Ryuk Ransomware Operator Sentenced: Lessons for Enterprise Security
Health Care / Life Sciences1 month ago

Ryuk Ransomware Operator Sentenced: Lessons for Enterprise Security

Karen Vardanyan, a 35-year-old Armenian national, was sentenced to two years in prison for his role in Ryuk ransomware attacks that occurred between March 2019 and September 2020. Operating from Ukraine and Russia, Vardanyan and his co-conspirators deployed Ryuk ransomware on hundreds of compromised servers and workstations, targeting victims including a Michigan company, an Oregon technology firm, and a Texas school district. The group received approximately 1,160 bitcoins worth over $15 million in ransom payments during their campaign. This case highlights the continued enforcement actions against ransomware operators as law enforcement agencies prioritize dismantling cybercriminal networks. With ransomware attacks resurging in 2024 and targeting critical infrastructure, prosecutions like Vardanyan's demonstrate the long-term consequences facing cybercriminals even years after their crimes.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Salt Typhoon Attack Exposes Critical Telecom Vulnerabilities, Drives Senate Cybersecurity Action
Salt Typhoon Attack Exposes Critical Telecom Vulnerabilities, Drives Senate Cybersecurity Action
Telecommunications1 month ago

Salt Typhoon Attack Exposes Critical Telecom Vulnerabilities, Drives Senate Cybersecurity Action

The Salt Typhoon campaign represents one of the most significant nation-state espionage operations against U.S. telecommunications infrastructure, attributed to Chinese threat actors who infiltrated major telecom carriers including Verizon, AT&T, and T-Mobile. Beginning in 2022 and persisting through 2024, the attackers gained deep access to telecommunications networks, intercepting communications from high-profile political figures including presidential candidates, and accessing sensitive customer data and call records. The breach exposed critical vulnerabilities in telecom infrastructure security and prompted bipartisan legislative action to establish mandatory cybersecurity standards for the telecommunications sector. This incident highlights the urgent need for Zero Trust network segmentation and encrypted communications as nation-state actors increasingly target critical infrastructure. The persistence and scope of Salt Typhoon demonstrate how traditional perimeter-based security models fail against sophisticated adversaries who can maintain long-term access to compromise sensitive communications and national security information.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical F5 BIG-IP APM Zero-Day Under Active Attack: What Organizations Need to Know
Critical F5 BIG-IP APM Zero-Day Under Active Attack: What Organizations Need to Know
Financial Services1 month ago

Critical F5 BIG-IP APM Zero-Day Under Active Attack: What Organizations Need to Know

F5 disclosed CVE-2026-94127, a critical zero-day vulnerability in BIG-IP APM (Access Policy Manager) being actively exploited for remote code execution attacks in September 2026. The flaw affects instances configured as OAuth Authorization Servers and has prompted emergency patching advisories from both F5 and CISA, which added it to the Known Exploited Vulnerabilities catalog. With over 14,700 exposed BIG-IP APM instances detected by Shadowserver, the vulnerability poses significant risks to enterprise networks and critical infrastructure. This incident underscores the escalating threat to network access management solutions as attackers increasingly target authentication and authorization infrastructure to gain privileged network access and establish persistent footholds in enterprise environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Ryuk Ransomware Architect Sentenced: Lessons for Modern Enterprise Security
Ryuk Ransomware Architect Sentenced: Lessons for Modern Enterprise Security
Health Care / Life Sciences1 month ago

Ryuk Ransomware Architect Sentenced: Lessons for Modern Enterprise Security

Karen Serobovich Vardanyan, a 35-year-old Armenian national known online as 'Maneeken' or 'Karl Lagerfeld,' was sentenced to 24 months in prison for his role in Ryuk ransomware attacks between March 2019 and June 2020. Vardanyan specialized in gaining initial access to corporate networks, helping his cybercriminal group breach multiple U.S. organizations including companies in Michigan, Texas, and Oregon. The group collected over $15 million in ransom payments, with one Michigan company alone paying 200 BTC worth over $1.1 million. Vardanyan was extradited from Ukraine in 2025 and pleaded guilty in July 2026. This sentencing highlights the ongoing global law enforcement efforts to prosecute ransomware operators, even years after attacks occurred. As ransomware groups continue to evolve and fragment into smaller units, the Ryuk-to-Conti evolution demonstrates how cybercriminal organizations adapt and rebrand while maintaining similar attack methodologies.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
How One Kubernetes YAML File Can Compromise Your Entire Google Cloud Organization
How One Kubernetes YAML File Can Compromise Your Entire Google Cloud Organization
Computer Software/Engineering1 month ago

How One Kubernetes YAML File Can Compromise Your Entire Google Cloud Organization

A critical security vulnerability in Google Kubernetes Config Connector (KCC) allows attackers with limited Kubernetes namespace access to escalate privileges and gain complete control over entire Google Cloud organizations. The attack, dubbed ConfigConfusion, exploits a confused deputy problem where KCC's organization-level service account executes IAM changes requested by users who lack corresponding Google Cloud permissions. Attackers can submit a single YAML IAMPolicyMember resource to grant themselves roles/owner privileges across the entire organization, effectively bypassing all authentication controls without ever possessing Google Cloud credentials. This vulnerability highlights the growing risks of infrastructure-as-code systems where authorization gaps between Kubernetes RBAC and cloud provider IAM create unprecedented privilege escalation pathways, particularly as organizations increasingly adopt GitOps workflows and multi-cloud architectures.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
WordPress Under Siege: CVE-2026-87902 Exploitation Analysis
WordPress Under Siege: CVE-2026-87902 Exploitation Analysis
Computer Software/Engineering1 month ago

WordPress Under Siege: CVE-2026-87902 Exploitation Analysis

Threat actors began exploiting CVE-2026-87902, a critical WordPress path traversal vulnerability with a CVSS score of 9.2, within hours of patch release on September 22, 2026. The unauthenticated flaw allows remote code execution through path traversal attacks targeting the get_page_template() function, enabling attackers to include malicious PHP files outside theme directories. Initial reconnaissance activity escalated to active payload delivery within 24 hours, with attackers writing executable shell commands to /tmp directories on vulnerable WordPress installations running versions before 7.1.2. This incident highlights the accelerating weaponization timeline for critical web application vulnerabilities, as attackers now exploit high-severity flaws within hours rather than days or weeks. The widespread nature of WordPress deployments and the unauthenticated attack vector amplify the risk landscape significantly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
How Attackers Hijacked a Trusted Developer Domain for ClickFix Campaigns
Computer Software/Engineering1 month ago

How Attackers Hijacked a Trusted Developer Domain for ClickFix Campaigns

In September 2026, the commonly used placeholder domain third-party.com began serving ClickFix attacks targeting Windows users through a fake Cloudflare verification page. The attack copied malicious PowerShell commands to victims' clipboards, instructing them to execute the commands manually to bypass traditional security measures. Unlike reserved documentation domains like example.com, third-party.com was a registrable domain that had been referenced in thousands of code repositories and official documentation from trusted sources like Chromium and W3C. The attack represents a sophisticated supply chain threat that exploits developers' trust in documentation examples and demonstrates how attackers can weaponize commonly referenced infrastructure domains. While the payload servers were inactive during investigation, the incident highlights the risks of using non-reserved domains as placeholders in production code and documentation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication
MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication
Telecommunications1 month ago

MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication

In September 2026, attackers exploited the MikroTrick vulnerability chain (CVE-2026-67279 and CVE-2026-86060) to gain full administrative control of internet-exposed MikroTik routers without passwords or SSH keys. The attack combined an SSH state-machine flaw that bypassed authentication with an argument-injection vulnerability in RouterOS login process. Evidence shows active exploitation began September 2, 2026, one day before patches were released, with attackers creating privileged accounts and exfiltrating configuration data from compromised devices. This incident highlights the growing threat to network infrastructure devices as nation-state actors and cybercriminals increasingly target routers and edge devices for persistent access and lateral movement capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware
First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware
Computer Software/Engineering1 month ago

First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware

In September 2026, cybersecurity researchers discovered North Korean threat actors using HashiCorp's Terraform Registry to distribute Go-based malware for the first time. The attackers published four malicious packages across Terraform providers and Go modules, accumulating over 1,600 downloads before detection. The malware employed sophisticated dual command-and-control channels using blockchain dead drops and Slack APIs, with execution triggered only during specific cryptographic operations to avoid detection. This campaign represents an expansion of the previously identified Graphalgo operation, demonstrating DPRK actors' continued evolution of supply chain attack vectors beyond traditional npm and PyPI repositories. This incident highlights the growing sophistication of state-sponsored supply chain attacks as threat actors diversify their distribution channels to target infrastructure-as-code and cloud-native development workflows, making detection and prevention increasingly challenging for organizations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
ClickFix Attack Analysis: When Your Logo Becomes the Weapon
ClickFix Attack Analysis: When Your Logo Becomes the Weapon
Banking/Mortgage1 month ago

ClickFix Attack Analysis: When Your Logo Becomes the Weapon

ClickFix represents a sophisticated social engineering technique that leverages trusted brand logos and familiar verification prompts to deceive victims into executing malicious commands on their own systems. Unlike traditional malware campaigns, ClickFix attacks require no code injection or exploit delivery - instead, they manipulate users into becoming the attack vector themselves by mimicking legitimate CAPTCHA screens, brand verification pages, and system prompts. These campaigns adapt dynamically to victim operating systems, delivering tailored instructions for Windows or macOS environments, making detection through traditional signature-based methods ineffective. This attack method exemplifies the current shift toward human-centric attack vectors that bypass traditional security controls by exploiting psychological manipulation rather than technical vulnerabilities. As organizations increasingly deploy sophisticated endpoint protection and network security tools, threat actors are pivoting to techniques that leverage the weakest link in most security architectures - human trust and recognition patterns.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security
Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security
Financial Services1 month ago

Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security

In September 2026, Microsoft successfully disrupted EvilTokens, a sophisticated phishing-as-a-service (PhaaS) platform operated by threat actor Storm-2992. The AI-powered cybercrime service facilitated device code phishing attacks targeting Microsoft 365 accounts, compromising over 12,000 inboxes across 10,000+ organizations worldwide. Microsoft seized 50 websites and disabled 150+ domains, while UK authorities arrested two suspects. EvilTokens distinguished itself by automating device code authentication abuse at scale, using AI to craft tailored phishing lures, analyze compromised inboxes for high-value targets, and streamline business email compromise campaigns sold for $1,500 upfront plus $500 monthly via Telegram. This incident highlights the alarming evolution of phishing-as-a-service platforms leveraging AI to democratize sophisticated attacks. As threat actors increasingly weaponize legitimate authentication mechanisms and AI capabilities, organizations face unprecedented challenges in defending against automated, scalable identity-based attacks that bypass traditional security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Massive Chinese Relay Network Exposed Circumventing US AI Model Controls
Massive Chinese Relay Network Exposed Circumventing US AI Model Controls
Computer Software/Engineering1 month ago

Massive Chinese Relay Network Exposed Circumventing US AI Model Controls

In September 2026, Team Cymru researchers discovered a vast network of over 80,000 AI relay servers enabling Chinese users to access frontier AI models from US companies including OpenAI, Anthropic, Google, and xAI while masking their identities and locations. The relay infrastructure allows systematic circumvention of geographic restrictions and terms of service, with evidence suggesting large-scale model distillation attempts. Over an eight-day period, Chinese IP addresses transmitted 14TB of data through relay stations, with particularly suspicious traffic to Anthropic showing a 58:1 upload-to-download ratio consistent with AI model cloning operations. This campaign leverages open-source software packages like Claude Relay Service and sub2api, distributed through GitHub and Telegram channels with thousands of subscribers, pointing to widespread adoption of these circumvention techniques. This incident highlights the growing sophistication of AI intellectual property theft operations and the urgent need for enhanced detection capabilities as nation-state actors increasingly target frontier AI models for competitive advantage.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports