Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Understanding the 'LegacyHive' Windows Zero-Day Vulnerability
In July 2026, a security researcher known as 'Nightmare Eclipse' disclosed a zero-day vulnerability named 'LegacyHive' affecting fully patched Windows systems. This local privilege escalation flaw in the Windows User Profile Service allows attackers with local access to load other users' registry hives, including those of administrators, potentially leading to unauthorized access and control over sensitive data. The researcher released a proof-of-concept (PoC) exploit, which, while requiring additional user credentials, still poses a significant security risk. The release of 'LegacyHive' underscores a growing trend of public disclosure of zero-day vulnerabilities, often as a form of protest against perceived mishandling by software vendors. This incident highlights the critical need for organizations to implement robust security measures, including timely patch management and monitoring for unusual system activities, to mitigate the risks associated with such vulnerabilities.
2 months ago
Kill Chain
Understanding the HollowByte OpenSSL DoS Vulnerability
In July 2026, a critical vulnerability known as 'HollowByte' was identified in OpenSSL, allowing unauthenticated attackers to induce a denial-of-service (DoS) condition on servers by sending a mere 11-byte payload. This flaw exploits the TLS handshake process, where the server allocates memory based on the declared size in the handshake header without verifying the actual payload size. Consequently, attackers can cause excessive memory allocation, leading to server instability or crashes. The OpenSSL team has addressed this issue in version 4.0.1 and backported fixes to earlier versions. Organizations are urged to update their OpenSSL installations promptly to mitigate potential disruptions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai)) The HollowByte vulnerability underscores the persistent risks associated with foundational internet security protocols. As cyber threats evolve, it is imperative for organizations to remain vigilant, ensuring timely updates and robust security practices to safeguard against emerging vulnerabilities.
2 months ago
Kill Chain
NadMesh Botnet Exploits Exposed AI Services to Steal Cloud Credentials
In early July 2026, the NadMesh botnet emerged, targeting exposed AI services such as ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio. The botnet exploits these unsecured services to harvest sensitive cloud credentials, including AWS keys and Kubernetes tokens. QiAnXin's XLab reported that the botnet operator's dashboard claimed possession of 3,811 unique AWS keys, indicating a significant breach of cloud security. The malware employs a Shodan harvester to continuously scan for vulnerable AI services, emphasizing the critical need for securing such deployments. This incident underscores the growing trend of cyber attackers exploiting misconfigured AI and automation tools to gain unauthorized access to cloud infrastructures. Organizations must prioritize the security of AI services, ensuring proper authentication and network configurations to prevent such breaches.
2 months ago
Kill Chain
ViteVenom: Unveiling the Blockchain-Powered Supply Chain Attack on Vite npm Packages
In July 2026, cybersecurity researchers identified a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem. This campaign, dubbed ViteVenom, expanded upon the earlier ChainVeil attack by utilizing a sophisticated four-tier blockchain-based command-and-control (C2) infrastructure spanning Tron, Aptos, and Binance Smart Chain. The attackers, attributed to the group SuccessKey, employed this infrastructure to deliver a remote access trojan (RAT) capable of reverse shell operations, credential harvesting, file exfiltration, and persistent backdoor injection. The malicious packages, published between June 29 and July 3, 2026, impersonated legitimate Vite packages, thereby deceiving developers into incorporating them into their projects. This incident underscores the escalating complexity and persistence of supply chain attacks, particularly those leveraging decentralized technologies to evade detection and takedown efforts. The use of blockchain for C2 infrastructure presents significant challenges for traditional security measures, highlighting the need for enhanced vigilance and advanced threat detection capabilities within the software development community.
2 months ago
Kill Chain
BoryptGrab Malware Campaign Exploits Fake GitHub Repositories in 2026
In July 2026, cybersecurity researchers uncovered a large-scale malware campaign involving 292 fake GitHub repositories impersonating legitimate software projects. These repositories distributed a variant of the BoryptGrab infostealer, which targets sensitive data from web browsers, cryptocurrency wallets, and messaging applications. The malware was delivered through trojanized installers that exploited DLL side-loading techniques, allowing attackers to harvest credentials and financial information from unsuspecting users. The campaign primarily targeted users in the United States, Germany, Romania, and Venezuela, leading to significant data breaches and financial losses. This incident underscores the growing trend of cybercriminals leveraging trusted platforms like GitHub to distribute malware. The sophistication of the campaign, including the use of search engine optimization to promote malicious repositories, highlights the need for enhanced vigilance and verification processes when downloading software from online sources.
2 months ago
Kill Chain
Google's Agentic Defense: Revolutionizing Cybersecurity with AI
In March 2026, Google completed its $32 billion acquisition of cloud security firm Wiz, aiming to enhance its cloud-native security capabilities. Wiz's graph-based analysis technology enables correlation of cloud assets, identities, vulnerabilities, and exposures across multi-cloud environments. This acquisition led to the development of Google's 'agentic defense' platform, which automates threat detection, investigation, and remediation using intelligent security agents. The platform addresses the increasing speed and sophistication of AI-powered cyberattacks by shifting from human-led to AI-led cyber defense strategies. ([darkreading.com](https://www.darkreading.com/cloud-security/google-bets-agentic-defense-strategy-outpace-attackers?utm_source=openai)) The urgency of adopting AI-driven security measures is underscored by the rapid acceleration of machine-based attacks. According to Google Cloud's Mandiant threat detection unit, the average time from initial breach to handoff of access to another threat actor has decreased from 8 hours to just 22 seconds over the past three years. This trend highlights the necessity for organizations to implement automated, AI-driven defense mechanisms to effectively counteract evolving cyber threats. ([darkreading.com](https://www.darkreading.com/cloud-security/google-bets-agentic-defense-strategy-outpace-attackers?utm_source=openai))
2 months ago
Kill Chain
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
In July 2026, Microsoft disclosed CVE-2026-58644, a critical deserialization vulnerability in SharePoint Server, allowing unauthenticated remote code execution. This flaw affects SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016. Exploitation requires an attacker to send a specially crafted network request, leading to potential full server compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by July 19, 2026. The inclusion of CVE-2026-58644 in CISA's catalog underscores the urgency of addressing this vulnerability, as it has been actively exploited in the wild. Organizations using affected SharePoint versions should prioritize patching to mitigate the risk of unauthorized access and potential data breaches.
2 months ago
Kill Chain
GoSerpent Malware: A Persistent Threat to Southeast Asian Governments
In late 2025, cybersecurity researchers identified a new malware strain named GoSerpent, actively targeting government and diplomatic entities in Southeast Asia. Discovered by Kaspersky in February 2026, GoSerpent is designed to establish long-term access for intelligence gathering by connecting to external servers and deploying secondary payloads for data collection and credential dumping. The malware's capabilities include setting up SOCKS5 proxy servers, enabling attackers to route traffic through compromised hosts and mask their true IP addresses. Additional tools such as ThumbcacheService for file collection and Mimikatz for credential extraction have been employed to facilitate data exfiltration through network shared drives. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai)) The resurgence of GoSerpent in May 2026, with evolved tools like the Stowaway RAT and enhanced data exfiltration methods, underscores the persistent and adaptive nature of cyber threats targeting sensitive government information. This incident highlights the critical need for robust cybersecurity measures and continuous monitoring to detect and mitigate sophisticated espionage campaigns. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai))
2 months ago
Kill Chain
North Korean Hackers Exploit Fake Coding Tests to Deploy OtterCookie Malware via Steganography
In July 2026, North Korean state-sponsored hackers initiated a sophisticated campaign targeting software developers through fake job postings and coding assessments. These assessments contained repositories with malicious code concealed within SVG image files, employing steganography to evade detection. Upon execution, the code deployed a multi-stage payload associated with the OtterCookie malware, capable of stealing browser credentials, cryptocurrency wallets, and sensitive files, as well as establishing remote access via a Socket.IO-based trojan. This operation underscores the persistent threat posed by North Korean cyber actors to the software development community, aiming to exfiltrate valuable data and financial assets. The use of steganography in SVG files highlights the evolving tactics employed by these adversaries to bypass traditional security measures, emphasizing the need for heightened vigilance and advanced detection capabilities within the industry.
2 months ago
Kill Chain
AI-Driven Cyberattacks: Key Insights from Unit 42's 2026 Report
In 2025, Unit 42 responded to over 750 major cyber incidents across various industries and countries. The 2026 Global Incident Response Report highlights that adversaries are leveraging AI to accelerate attack timelines, with data exfiltration occurring up to four times faster than in previous years. Identity weaknesses were exploited in nearly 90% of investigations, and 87% of intrusions involved multiple attack surfaces, including endpoints, networks, cloud services, SaaS platforms, and identity systems. ([paloaltonetworks.com](https://www.paloaltonetworks.com/blog/2026/02/unit-42-global-ir-report/?utm_source=openai)) This trend underscores the urgent need for organizations to enhance their cybersecurity posture by addressing identity vulnerabilities, improving visibility across attack surfaces, and implementing AI-driven defense mechanisms to counteract the speed and complexity of modern cyber threats.
2 months ago
Kill Chain
Indictment of Russian Nationals for Bulletproof Hosting Services Facilitating Cyberattacks
In July 2026, U.S. federal prosecutors unsealed an indictment against three Russian nationals—Alexander Alexandrovich Volosovik, Yulia Vladimirovna Pankova, and Kirill Andreevich Zatolokin—accusing them of operating bulletproof hosting services through their companies, Media Land and ML.Cloud. These services allegedly facilitated cyberattacks on critical infrastructure across 21 U.S. states and several countries, resulting in over $62 million in damages. The indictment details how the accused provided infrastructure and technical support to cybercriminals, enabling malware distribution, ransomware attacks, and other illicit activities. ([cyberscoop.com](https://cyberscoop.com/russian-nationals-medialand-mlcloud-indicted-bulletproof-hosting/?utm_source=openai)) This case underscores the persistent threat posed by bulletproof hosting providers, which offer cybercriminals resilient infrastructure to conduct attacks with impunity. The indictment highlights the necessity for international cooperation in dismantling such networks and protecting critical infrastructure from cyber threats. ([cyberscoop.com](https://cyberscoop.com/russian-nationals-medialand-mlcloud-indicted-bulletproof-hosting/?utm_source=openai))
2 months ago
Kill Chain
Spirals Ransomware Attack on South Asian IT Firm in June 2026
In June 2026, an IT services firm in South Asia fell victim to a rapid and sophisticated ransomware attack orchestrated by a previously unknown group deploying the 'Spirals' ransomware. The attackers gained initial access through a publicly exposed Internet Information Services (IIS) server, where they uploaded an ASP.NET web shell. Within a three-hour window, they established persistent access, disabled security software, extracted credentials, and moved laterally across the network. Less than 24 hours after the initial breach, the Spirals ransomware was deployed, encrypting files and exfiltrating sensitive data. The attackers threatened to publish the stolen data within six days unless a ransom was paid. This incident underscores the evolving threat landscape, where cybercriminals are executing attacks with unprecedented speed and efficiency. Organizations must reassess their security postures, particularly concerning publicly accessible services and rapid response capabilities, to mitigate such swift and damaging intrusions.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports