Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 6 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 61–72 / 3786 reports
How North Korean APTs Stole $6.43 Billion from Binance Using Fake Interviews, AI Tool Poisoning, and a Signing-Service Backdoor
How North Korean APTs Stole $6.43 Billion from Binance Using Fake Interviews, AI Tool Poisoning, and a Signing-Service Backdoor
Financial Services5 days ago

How North Korean APTs Stole $6.43 Billion from Binance Using Fake Interviews, AI Tool Poisoning, and a Signing-Service Backdoor

In a multi-stage supply-chain and social-engineering campaign spanning June through October 2026, North Korea-linked threat actors stole $6.43 billion from Binance—the largest cryptocurrency theft on record. Attackers first compromised a Wallet DevOps engineer via a trojanized Homebrew AI-tool installer, exposing team and infrastructure metadata. A second engineer was then targeted through a fake recruitment interview on a legitimate job platform, leading to the delivery of a malicious code repository. The attacker leveraged a compromised internal AI tool to pivot across engineer endpoints, steal a container-deployment token, and ultimately abuse Binance's internal wallet signing service to initiate unauthorized transactions outside normal withdrawal controls. This incident illustrates a dangerous convergence of AI-tool supply-chain poisoning, identity-pivoting through internal automation, and recruitment-themed social engineering—tactics now central to North Korean APT playbooks. As AI tooling becomes ubiquitous in developer workflows, the attack surface for similar campaigns is expanding rapidly across the financial services and Web3 sectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
How an AI Agent Breached Chainstack's Production Database in Five Days
How an AI Agent Breached Chainstack's Production Database in Five Days
Financial Services5 days ago

How an AI Agent Breached Chainstack's Production Database in Five Days

On October 26, 2026, blockchain infrastructure provider Chainstack suffered an AI-powered intrusion when an external threat actor leveraged the ARTEX autonomous AI agent framework to compromise a third-party component and gain initial access to a development environment. By October 31, the attacker had escalated privileges into production systems, accessing a database containing customer organization names, account holder names, email addresses, and password hashes, as well as systems holding node credentials. The intrusion was detected and contained on October 31, 2026. The incident is linked to a broader China-attributed campaign targeting high-value technology and blockchain firms using ARTEX to automate and accelerate multi-stage attacks. This breach is part of an accelerating wave of AI-orchestrated supply-chain intrusions hitting blockchain, API platform, and vulnerability-disclosure organizations simultaneously—including WorkOS, Chainalysis, and DIVD—signaling that ARTEX-enabled campaigns can pivot from dev environments to production databases faster than traditional detection cycles allow, raising the urgency for real-time lateral movement controls and segmentation.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Barracuda's Chained CVEs: How an Authorization Bypass and Command Injection Combine for Root Access
Barracuda's Chained CVEs: How an Authorization Bypass and Command Injection Combine for Root Access
Information Technology/IT5 days ago

Barracuda's Chained CVEs: How an Authorization Bypass and Command Injection Combine for Root Access

In November 2026, Barracuda disclosed two chained vulnerabilities—CVE-2026-116606 (CVSS 9.3), a pre-authentication authorization bypass affecting the Email Security Gateway, and CVE-2026-111560 (CVSS 8.6), a command injection flaw impacting six Barracuda products including the Web Application Firewall, Load Balancer ADC, and Web Security Gateway. When exploited in sequence, an unauthenticated attacker with network access to the administrative interface can bypass authorization controls and achieve root-level code execution on the appliance. Organizations exposing administrative interfaces to the internet face the highest risk. Barracuda urged immediate firmware patching and restriction of admin interface access to trusted internal networks. This disclosure follows a well-documented pattern of nation-state and cybercriminal actors targeting network edge appliances—most notably the 2023 Barracuda ESG zero-day campaign attributed to UNC4841. Chained appliance vulnerabilities that yield root access are increasingly weaponized within days of disclosure, making rapid patch deployment and administrative interface segmentation a board-level priority in 2026.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
One Compromised Laptop, $6.3 Billion Gone: Dissecting the Binance TraderTraitor Attack Path
One Compromised Laptop, $6.3 Billion Gone: Dissecting the Binance TraderTraitor Attack Path
Financial Services5 days ago

One Compromised Laptop, $6.3 Billion Gone: Dissecting the Binance TraderTraitor Attack Path

In late October 2026, North Korea's TraderTraitor threat group executed the largest cryptocurrency exchange breach in history, stealing $6.3 billion from Binance in approximately 20 minutes. The attackers began by compromising a developer's laptop, then pivoted into an internal service container with withdrawal-request privileges. Exploiting an Ethereum account-delegation mechanism, they obtained transaction approval authority over a hot wallet and drained assets while bypassing Binance's normal approval controls—without using any leaked wallet keys. Binance froze roughly $3 billion and used its own reserves to replenish approximately 95% of affected assets. This incident follows the February 2025 Bybit breach ($1.5 billion) and illustrates an accelerating pattern of North Korean state-sponsored actors targeting crypto infrastructure through insider-path exploitation—manipulating trust relationships and privileged workloads rather than breaking perimeter defenses. With crypto-related theft attributable to DPRK-linked actors now exceeding 76% of all reported 2026 losses, enterprises across all verticals must re-examine blast-radius containment and lateral privilege controls.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
When Ransomware Gets an AI Co-Pilot: Inside the 3AM School Estate Attack
When Ransomware Gets an AI Co-Pilot: Inside the 3AM School Estate Attack
Primary/Secondary Education5 days ago

When Ransomware Gets an AI Co-Pilot: Inside the 3AM School Estate Attack

In November 2026, a 3AM ransomware affiliate launched a sophisticated attack against a UK school estate, compromising an initial institution before leveraging Active Directory domain trusts to propagate across multiple schools. Attackers stole backup credentials, created rogue domain-admin accounts, and deployed living-off-the-land techniques using native Windows tools including PowerShell and WMI. Bitdefender's analysis revealed evidence of an agentic AI loop handling repetitive command generation and troubleshooting—such as numbered script revisions, self-labeled output, and sub-40-second retry cycles—while a human operator directed high-level decisions, representing a hybrid human-AI attack model with significant operational scale. This incident marks a notable evolution in ransomware tradecraft: rather than replacing human operators, AI appears to function as a force multiplier, automating the tedious retry and reconnaissance loops that previously required manual effort. As agentic AI tools become more accessible to financially motivated threat actors, defenders in education and other under-resourced sectors face an asymmetric threat that demands prevention-first, repetition-aware detection strategies.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
LLMjacking Is Now a Full Criminal Business Model—Here's What Cloud Security Teams Must Do
LLMjacking Is Now a Full Criminal Business Model—Here's What Cloud Security Teams Must Do
Information Technology/IT5 days ago

LLMjacking Is Now a Full Criminal Business Model—Here's What Cloud Security Teams Must Do

LLMjacking has evolved from an opportunistic tactic into a structured cybercriminal enterprise, as documented in a November 2026 Google Threat Intelligence Group and Mandiant report. Attackers gain initial access to cloud environments by stealing or exposing IAM credentials, service account keys, GitHub personal access tokens, and active session tokens. Once inside, they quietly validate stolen credentials using minimal API requests—sometimes a single output token—before routing paying customers through victim infrastructure via underground LLM Mixer services. Individual organizations have absorbed fraudulent resource charges exceeding $100,000 in a single day, with cumulative losses at some victims reaching $1 million before access was revoked. LLMjacking represents a structural shift in cloud-era cybercrime: attackers now monetize access rather than data. As enterprise AI adoption accelerates, exposed LLM endpoints and poorly governed cloud identities create a scalable revenue stream for financially motivated threat clusters operating globally, making identity hygiene, AI service visibility, and egress control urgent priorities for security teams in 2026 and beyond.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
C3RB3R Ransomware Exploits Unpatched Synology DSM Flaws — What Security Teams Must Do Now
C3RB3R Ransomware Exploits Unpatched Synology DSM Flaws — What Security Teams Must Do Now
Information Technology/IT5 days ago

C3RB3R Ransomware Exploits Unpatched Synology DSM Flaws — What Security Teams Must Do Now

In November 2026, Synology issued an urgent advisory after threat actors exploiting CVE-2024-10441 (CVSS 9.8) — a remote code execution flaw in DiskStation Manager patched in December 2024 — began deploying C3RB3R ransomware against NAS devices still running outdated DSM versions. The C3RB3R group, which has a documented history of targeting NAS infrastructure, encrypted victim files with a .L0CK3D extension and dropped ransom notes in every affected directory. Attackers also leveraged two newly disclosed 2026 DSM vulnerabilities (CVE-2026-13684 and CVE-2026-13639, both CVSS 9.8) affecting SCGI and login logic, enabling arbitrary file read/write and denial-of-service. Synology urged immediate patching and activation of automatic updates across all affected DSM branches. This incident underscores a persistent and escalating pattern: ransomware operators are increasingly targeting unpatched network-attached storage devices as primary encryption targets, exploiting months-old CVEs that organizations fail to remediate. With NAS devices frequently storing backup and archival data, successful encryption dramatically elevates recovery costs and operational disruption, amplifying ransom leverage.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CVE-2026-98432: The CVSS 9.8 Linux TCP Flaw That an AI Already Knows How to Exploit
CVE-2026-98432: The CVSS 9.8 Linux TCP Flaw That an AI Already Knows How to Exploit
Information Technology/IT5 days ago

CVE-2026-98432: The CVSS 9.8 Linux TCP Flaw That an AI Already Knows How to Exploit

In November 2026, Red Hat and Canonical disclosed CVE-2026-98432, a critical use-after-free vulnerability (CVSS 9.8) in the Linux kernel's IPv4 TCP stack present since kernel version 4.4. A remote, unauthenticated attacker can trigger a race condition by sending IPv4 TCP connection requests carrying Record Route or Timestamp IP options to any listening TCP port, potentially achieving remote code execution without credentials or user interaction. Red Hat shipped emergency errata for RHEL 8, 9, and 10 on November 1, 2026, while Ubuntu's fixes for its three current LTS releases remain in an opt-in testing channel. Anthropic disclosed that an internal AI research model independently developed a working remote root exploit requiring no credentials, with full root shell access achievable in under one hour. This incident underscores the accelerating intersection of AI-assisted exploit development and unpatched Linux infrastructure. As AI models demonstrate the capacity to autonomously construct kernel-level exploits, the window between vulnerability disclosure and weaponization is collapsing, demanding near-real-time patch cadence and compensating network controls across cloud and hybrid environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges
LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges
Financial Services5 days ago

LLMjacking 2026: Stolen API Keys Are Costing Enterprises Up to $1 Million in Cloud AI Charges

In 2026, Google Threat Intelligence Group and Mandiant documented a surge in LLMjacking attacks targeting enterprises across financial services, retail, technology, and transportation sectors in North America, South America, and Asia Pacific. Threat actors—including the tracked cluster UNC6993—obtained cloud credentials via phishing, misconfigured Service Account keys, exposed GitHub Personal Access Tokens, and public code repositories to gain unauthorized access to enterprise LLM APIs. After establishing a foothold, attackers escalated privileges, performed multi-region reconnaissance, cloned codebases for hard-coded secrets, and created backdoor service accounts. Fraudulent LLM consumption exceeded $100,000 USD in a single day at individual organizations, with cumulative charges reaching $1 million USD before access was revoked. LLMjacking represents a structural evolution beyond cryptojacking, exploiting the high per-token cost of frontier AI models and the emergence of underground LLM Mixer services that proxy and resell stolen enterprise LLM access. As agentic AI workflows proliferate in production cloud environments, the attack surface for credential-based API abuse is expanding rapidly, making cloud identity hygiene and real-time egress enforcement urgent priorities for security teams in 2026 and beyond.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
cPGuard's Update Channel Was the Weapon: How Attackers Backdoored Linux Servers and Stole Password Hashes
cPGuard's Update Channel Was the Weapon: How Attackers Backdoored Linux Servers and Stole Password Hashes
Information Technology/IT5 days ago

cPGuard's Update Channel Was the Weapon: How Attackers Backdoored Linux Servers and Stole Password Hashes

On November 2, 2026, attackers used compromised credentials to infiltrate the update distribution system of cPGuard, a Linux server security tool developed by OPSSHIELD. A malicious script was embedded into cPGuard versions 5.88.12 through 5.88.19 and pushed to customer servers. The script installed a persistent backdoor and exfiltrated sensitive files including /etc/shadow password hashes, MySQL configuration files, root shell history, and SSH authorization keys to an OPSSHIELD-controlled licensing server using a compromised account. At least 32 customer servers are confirmed to have had data stolen before the attack was detected within 12 hours of deployment. This incident is a textbook software supply-chain compromise, mirroring the techniques seen in SolarWinds and 3CX attacks—where trusted update channels become weaponized delivery mechanisms. As Linux-based infrastructure scales across cloud and hosting environments, attackers are increasingly targeting the tooling layer rather than the OS itself, exploiting implicit trust in vendor update pipelines to achieve broad initial access with minimal detection.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Inside XCPE: How a Google-Certified Android OEM Built a 1.3 Million-Device Botnet
Inside XCPE: How a Google-Certified Android OEM Built a 1.3 Million-Device Botnet
Consumer Electronics5 days ago

Inside XCPE: How a Google-Certified Android OEM Built a 1.3 Million-Device Botnet

In 2025, Google's Threat Intelligence Group dismantled XCPE, a large-scale botnet deliberately embedded by Chinese Android OEM Videostrong Technology Co. into more than 1.3 million certified TV set-top boxes and other Android devices sold across 170 countries. Videostrong bypassed Google's security certification process by loading malicious backdoor code after the device's first boot, allowing XCPE operators to conduct ad fraud, data exfiltration, and residential proxy abuse for years undetected. Google took legal action to seize command-and-control domains, banned Videostrong from the Android ecosystem, and partnered with law enforcement and industry peers to disrupt over a dozen affiliated malware families impacting an estimated 10 million additional devices. This incident exposes a systemic vulnerability in hardware supply chains where trusted certification processes can be subverted by malicious insiders at the manufacturer level. As enterprises increasingly deploy IoT and edge devices at scale, the risk of pre-compromised hardware entering corporate and consumer environments demands rigorous supply-chain vetting, firmware integrity verification, and network-layer behavioral monitoring that extends beyond traditional endpoint controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Three Zero-Days, One Root Shell: How UTA0576 Silently Owned Ivanti Connect Secure Gateways
Three Zero-Days, One Root Shell: How UTA0576 Silently Owned Ivanti Connect Secure Gateways
Information Technology/IT6 days ago

Three Zero-Days, One Root Shell: How UTA0576 Silently Owned Ivanti Connect Secure Gateways

Beginning at least October 1, 2026, a threat actor tracked as UTA0576 chained three Ivanti Connect Secure zero-day vulnerabilities—an authentication bypass (CVE-2026-104935), a privilege escalation flaw (CVE-2026-111357), and a file-upload weakness (CVE-2026-118527)—to achieve unauthenticated root-level code execution on fully patched gateway appliances. The attacker avoided deploying malware or web shells, instead re-exploiting the device for each command and actively tampering with logs to evade Ivanti's Integrity Checker Tool. With over 5,000 ICS instances exposed to the internet, CISA issued an emergency directive ordering federal agencies to patch by end of week. Ivanti has now released fixes for all three CVEs. This incident reinforces a persistent pattern: enterprise VPN and remote-access gateways remain primary targets for nation-state and sophisticated threat actors. The chaining of authentication bypass, privilege escalation, and file-upload vulnerabilities for fileless, log-evading intrusions signals a maturation of living-off-the-land techniques against network perimeter appliances, demanding zero-trust network segmentation beyond traditional perimeter controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports