Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 5 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 49–60 / 3786 reports
Black October 2026: How Chained Exploits Rooted Government Firewalls and What Cloud Network Security Teams Must Do Now
Black October 2026: How Chained Exploits Rooted Government Firewalls and What Cloud Network Security Teams Must Do Now
Government Administration4 days ago

Black October 2026: How Chained Exploits Rooted Government Firewalls and What Cloud Network Security Teams Must Do Now

In late October 2026, a coordinated cluster of critical vulnerabilities collectively branded 'Black October' rocked enterprise security teams worldwide. Threat actors actively chained PHP2SHELL — a heap-memory RCE flaw affecting roughly 70% of web servers — with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation bug in the XFRM ESP-in-TCP subsystem, to achieve unauthenticated root access on 25 PAN-OS firewall and management servers across the United States, Japan, Taiwan, and South Korea, including three U.S. government-affiliated systems. Simultaneously, a critical memory-corruption flaw in the Brotli decoder (CVE-2026-111497, CVSS 9.2), dubbed Node2Shell, surfaced after a silent upstream fix went unannounced for eight months, exposing Node.js, Python, and .NET runtimes to remote code execution. CISA issued KEV mandates for all three CVEs, requiring federal agencies to patch within tight deadlines. These chained exploit campaigns signal a maturing attacker playbook in which no single patch is sufficient: closing the web-shell entry point leaves the kernel escalation path open, and proxy-level filtering cannot protect against library-level decompression flaws. Security teams must adopt layered network enforcement — inline inspection, east-west segmentation, and egress control — alongside aggressive patching to contain blast radius.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
XCPE Botnet: How a Backdoored Android OEM Turned 1.3 Million IoT Devices Into Criminal Infrastructure
XCPE Botnet: How a Backdoored Android OEM Turned 1.3 Million IoT Devices Into Criminal Infrastructure
Health Care / Life Sciences4 days ago

XCPE Botnet: How a Backdoored Android OEM Turned 1.3 Million IoT Devices Into Criminal Infrastructure

In November 2026, Google's Threat Intelligence Group and industry partners disrupted the XCPE botnet, a supply-chain backdoor operation attributed with high confidence to Android device manufacturer Videostrong Technology Co. Beginning at least in 2024, Videostrong allegedly embedded the XCPE backdoor into firmware across more than 1.3 million Android-based set-top boxes, telehealth devices, karaoke machines, and digital signage systems. Criminal affiliates purchased access to the compromised fleet, deploying modules for ad fraud, residential proxy enrollment, credential theft, keystroke injection, screenshot capture, and reverse-shell establishment. Disruption of the affiliate command-and-control infrastructure is expected to sever access to an additional 10 million compromised devices globally. The XCPE campaign illustrates a maturing threat model in which the hardware supply chain itself becomes the initial compromise vector, bypassing traditional perimeter controls entirely. As IoT device proliferation accelerates across healthcare, retail, and enterprise environments, attackers are increasingly targeting OEM firmware pipelines to pre-position persistent access at scale before devices ever reach end users.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
WordPress Core CVE-2026-119977: CISA Confirms Unauthenticated RCE Exploited During Upgrade Windows
WordPress Core CVE-2026-119977: CISA Confirms Unauthenticated RCE Exploited During Upgrade Windows
Internet4 days ago

WordPress Core CVE-2026-119977: CISA Confirms Unauthenticated RCE Exploited During Upgrade Windows

In late October 2026, CISA added CVE-2026-119977 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a critical Time-of-Check Time-of-Use (TOCTOU) race condition in WordPress Core. The flaw, carrying a CVSS score of 8.1, allows unauthenticated attackers to execute arbitrary code on affected servers by targeting predictable, web-accessible staging paths exposed during full-package Core upgrades. Within 21 hours of public disclosure, over 18,500 exploit attempts were recorded against staged setup-config.php installer paths. Honeypot telemetry confirmed live exploitation on October 30, 2026, with FCEB agencies mandated to patch by November 6, 2026. This incident underscores the growing attacker focus on transient vulnerability windows—brief intervals during routine maintenance operations such as software upgrades—where security controls are momentarily relaxed. The mass exploitation speed mirrors trends seen in zero-day campaigns targeting internet-facing infrastructure, signaling that threat actors are increasingly automating opportunistic scanning and exploitation pipelines against well-known CMS platforms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
XSA-523: How a Single Rogue VM Can Own Your Entire Xen Host—and What to Do Now
XSA-523: How a Single Rogue VM Can Own Your Entire Xen Host—and What to Do Now
Information Technology/IT4 days ago

XSA-523: How a Single Rogue VM Can Own Your Entire Xen Host—and What to Do Now

In November 2026, the Xen Project disclosed two critical hypervisor vulnerabilities tracked as CVE-2026-102703 and CVE-2026-102704 under advisory XSA-523. The flaws reside in Xen's grant copy mechanism, which coordinates memory sharing between virtual machines. A logic error allows a malicious guest VM to bypass permission checks and read or write the memory of any other VM on the same host, including the privileged dom0 management domain. All Xen versions from 4.6 onward are affected. Downstream platforms including XCP-ng, Qubes OS, and multiple Debian releases require immediate patching and host reboots to remediate the exposure. VM-escape and hypervisor-level attacks are accelerating as cloud-native and multi-tenant architectures expand attack surfaces. The discovery of XSA-523 by an AI-assisted research tool (Anthropic's Claude) signals that automated vulnerability hunting is maturing, meaning threat actors have equivalent capability. Organizations running shared virtualization infrastructure—especially in healthcare, finance, and critical infrastructure—face heightened regulatory scrutiny and breach liability if hypervisor patching cadences lag behind disclosure timelines.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
How SlippyNunchucks Turned a Sogou IME Update Channel Into a DarkVigil Backdoor Delivery Pipeline
How SlippyNunchucks Turned a Sogou IME Update Channel Into a DarkVigil Backdoor Delivery Pipeline
Government Administration4 days ago

How SlippyNunchucks Turned a Sogou IME Update Channel Into a DarkVigil Backdoor Delivery Pipeline

Beginning July 1, 2026, a China-aligned threat actor tracked as SlippyNunchucks launched a DNS hijacking campaign targeting the Sogou Input Method—a popular Chinese-language IME developed by Tencent—to deploy the DarkVigil backdoor (CVE-2026-120422). By intercepting unencrypted HTTP requests from the legitimate SGTool.exe component and redirecting them to attacker-controlled staging servers, the group delivered a malicious configuration that triggered DLL sideloading of the DarkVigil implant. Targets included organizations and Chinese-speaking individuals across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka, with notable surveillance activity against online betting platforms. Tencent patched the vulnerability on October 29, 2026, by migrating affected traffic to HTTPS. This incident underscores a accelerating trend of nation-state actors weaponizing trusted, widely-deployed software supply chains—particularly Chinese-language applications—to reach diaspora communities and regulated industries across Asia and Europe. As DNS-based interception and DLL sideloading grow more prevalent, organizations face mounting pressure to enforce encrypted transit, zero-trust segmentation, and egress controls as baseline hygiene.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
APT29's 'Poisoned Source': How a Hijacked Analytics Script Turned Millions of Websites Into Mobile Exploit Delivery Networks
APT29's 'Poisoned Source': How a Hijacked Analytics Script Turned Millions of Websites Into Mobile Exploit Delivery Networks
Government Administration4 days ago

APT29's 'Poisoned Source': How a Hijacked Analytics Script Turned Millions of Websites Into Mobile Exploit Delivery Networks

Between August and October 2026, the Russia-linked threat actor APT29 conducted a sophisticated multi-vector mobile exploitation campaign dubbed 'Poisoned Source.' Attackers compromised legitimate websites, registered lookalike domains, and injected malicious JavaScript into the Plerdy SEO Tracker supply chain (affecting the widely loaded script at a.plerdy[.]com) to deliver platform-specific N-day exploit chains to iOS and Android users. iOS victims were targeted with the DarkSword exploit kit across CVE-2025-43529, CVE-2026-20700, and related vulnerabilities, enabling full device data exfiltration including iMessages, iCloud Keychain, and Wi-Fi passwords. Android users were served a Chrome-targeting chain exploiting CVE-2026-3910 and CVE-2025-27038, culminating in deployment of the AndroSnitch infostealer. This campaign illustrates the accelerating commoditization of commercial surveillance vendor exploit frameworks. The confirmed reuse of DarkSword across both nation-state and criminal actors, combined with the Coruna kit's broad availability following public disclosure, signals a structural shift: advanced mobile exploitation is no longer exclusive to well-resourced state programs, raising the risk floor for enterprises, government agencies, and critical infrastructure operators globally.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Trojanized Installers, Silent Payloads: Inside the 2026 Fake-Download Monetization Campaign
Trojanized Installers, Silent Payloads: Inside the 2026 Fake-Download Monetization Campaign
Information Technology/IT4 days ago

Trojanized Installers, Silent Payloads: Inside the 2026 Fake-Download Monetization Campaign

In November 2026, Microsoft Threat Intelligence disclosed an active fake-download campaign distributing trojanized Inno Setup-style installers through search-optimized lures mimicking cracked commercial software, game installers, activators, and unofficial utilities. Once executed, the installers silently delivered multiple monetization payloads—WorldProxyPool proxyware, CharityEngine and BOINC distributed-compute software, and AdvancedWindowsManager adware-style utilities—converting victim endpoints into monetized network and compute resources without user consent. SYSTEM-level scheduled tasks ensured persistent execution of proxy agents, watchdog scripts, and hourly updaters, while rotating callback infrastructure using a durable d=inno and r=offer_execution pattern tracked per-offer delivery outcomes. This campaign reflects a broader trend of Potentially Unwanted Application (PUA) and monetization malware operations that exploit user demand for free or pirated software. The multi-offer, callback-tracked delivery model signals increasing operational sophistication among PUA distributors, raising enterprise exposure risk as remote and hybrid workers download personal software on corporate-adjacent devices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
ShinyHunters Breach Harvard: 851,000 Alumni and Donor Records Leaked After Ransom Refusal
ShinyHunters Breach Harvard: 851,000 Alumni and Donor Records Leaked After Ransom Refusal
Higher Education/Acadamia5 days ago

ShinyHunters Breach Harvard: 851,000 Alumni and Donor Records Leaked After Ransom Refusal

In November 2025, Harvard University's Alumni Affairs and Development systems were compromised by the ShinyHunters extortion gang, exposing personal data tied to over 850,000 unique email addresses. Attackers accessed names, dates of birth, phone numbers, physical addresses, donation histories, and event attendance records for students, alumni, donors, staff, and faculty. Harvard discovered the breach on November 18, 2025. After the university refused to pay a ransom, ShinyHunters leaked a 1.1 GB archive on their dark web site in early February 2026. No Social Security numbers, passwords, or financial data were confirmed stolen. This incident reflects a growing wave of extortion-focused attacks targeting higher education institutions, where alumni and donor databases are rich targets. The concurrent Clop ransomware campaign exploiting an Oracle EBS zero-day across multiple universities—including a second Harvard breach—signals that threat actors are actively coordinating multi-vector attacks against the education sector, intensifying regulatory and reputational pressure on institutions holding large volumes of personal data.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Barracuda's 2026 Critical Flaws: How Authentication Bypass and Root Injection Put 200,000 Customers at Risk
Barracuda's 2026 Critical Flaws: How Authentication Bypass and Root Injection Put 200,000 Customers at Risk
Government Administration5 days ago

Barracuda's 2026 Critical Flaws: How Authentication Bypass and Root Injection Put 200,000 Customers at Risk

In November 2026, Barracuda Networks disclosed two critical vulnerabilities affecting multiple network security appliances, including its Email Security Gateway, Load Balancer ADC, Web Application Firewall, and others. CVE-2026-116606, a pre-authentication authorization bypass in the ESG, allows attackers to modify global device configurations without credentials. CVE-2026-111560 enables authenticated administrators to inject OS-level commands that execute with root privileges. When chained, the two flaws grant full device compromise. Barracuda released patches across all affected product lines and urged customers to apply firmware updates immediately while restricting administrative interface access to trusted internal networks only. This disclosure echoes Barracuda's 2023 ESG zero-day campaign (CVE-2023-2868), exploited by Chinese-nexus group UNC4841 for over seven months before discovery. The recurrence of critical appliance-level flaws in the same vendor's product line signals a broader industry pattern: network security appliances remain high-value, under-monitored targets, and organizations relying on perimeter security without internal segmentation face compounding risk.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
LLMjacking 2026: How Stolen Cloud API Keys Became a $1 Million AI Fraud Problem
LLMjacking 2026: How Stolen Cloud API Keys Became a $1 Million AI Fraud Problem
Information Technology/IT5 days ago

LLMjacking 2026: How Stolen Cloud API Keys Became a $1 Million AI Fraud Problem

In 2026, Google's Threat Intelligence Group and Mandiant documented a surge in LLMjacking attacks, in which two coordinated threat clusters compromise enterprise cloud LLM infrastructure by stealing API keys, harvesting exposed endpoints, and reselling unauthorized access through proxy services called LLM mixers. One campaign tied to the service jet-night.com generated nearly $1 million in fraudulent token charges against a single victim organization, with some enterprises absorbing more than $100,000 in illegitimate cloud costs in a single day. Attackers also exploited CVE-2026-40217 in LiteLLM to execute arbitrary code, deployed reverse proxies, and established persistent backdoor access within compromised cloud environments. LLMjacking represents a rapidly maturing criminal economy around stolen AI infrastructure. As enterprises accelerate cloud AI adoption, exposed API keys and over-permissioned service accounts create immediate financial and operational risk. The emergence of underground LLM mixer marketplaces signals that credential-based AI resource hijacking is becoming a commoditized threat vector, demanding urgent attention to IAM hygiene, secrets management, and AI-specific egress controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
How ARTEX AI Breached WorkOS: The Rise of Machine-Speed Intrusion Against SaaS Infrastructure
How ARTEX AI Breached WorkOS: The Rise of Machine-Speed Intrusion Against SaaS Infrastructure
Computer Software/Engineering5 days ago

How ARTEX AI Breached WorkOS: The Rise of Machine-Speed Intrusion Against SaaS Infrastructure

On October 30, 2026, WorkOS—a developer infrastructure platform serving over 3,000 enterprises including OpenAI and Anthropic—detected unauthorized access to an internal sales application. The attacker leveraged ARTEX AI, an open-source offensive security framework developed by Chinese researchers, to automate reconnaissance and exploitation. Business contact records, CRM histories, customer communication summaries, and account relationship data were exfiltrated. Forensic analysis identified attacker user agents 'artex-enrich/1.0' and 'norma/0.4' in web request logs. Production services and core WorkOS APIs were unaffected. An independent incident response firm was engaged and external access to the compromised application was immediately disabled. This incident reflects a rapidly maturing trend of AI-assisted intrusion campaigns. ARTEX AI has now been linked to attacks on South Korean banks, a global campaign by Chinese espionage group Vapor Panda targeting 200 organizations, and the breach of cybersecurity nonprofit DIVD. Defenders must treat AI-powered offensive tooling as a persistent, scalable threat category requiring automated detection and zero-trust network controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
cPGuard's Autoupdate Turned Weapon: How Attackers Backdoored 2,946 Servers Through a Trusted Security Tool
cPGuard's Autoupdate Turned Weapon: How Attackers Backdoored 2,946 Servers Through a Trusted Security Tool
Information Technology/IT5 days ago

cPGuard's Autoupdate Turned Weapon: How Attackers Backdoored 2,946 Servers Through a Trusted Security Tool

On November 2, 2026, attackers used compromised credentials to access OpsShield's CDN update infrastructure for cPGuard, a widely deployed Linux web-server security suite. Malicious scripts were distributed through the legitimate autoupdate channel across versions 5.88.12–5.88.19 for approximately 12 hours. The payload harvested Linux password hashes, MariaDB/MySQL root credentials, root shell history, and SSH keys from affected servers, exfiltrating 32 files per host to an attacker-controlled staging point. Nearly 2,946 servers were confirmed compromised, and OpsShield's own billing system database was also copied. This incident exemplifies the accelerating abuse of trusted software update pipelines as a primary attack vector. As hosting providers and server administrators depend on automated update mechanisms for security tooling, supply-chain compromises that weaponize the update channel itself bypass traditional perimeter defenses entirely, underscoring the critical need for egress controls, credential hygiene, and behavioral anomaly detection across managed infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports