Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Information Technology/IT

Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.

3786 threat reports
Page 7 of 316
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Information Technology/IT Threat Reports

Showing 73–84 / 3786 reports
C3RB3R Ransomware Is Encrypting Synology NAS Devices — Here Is What You Need to Know
C3RB3R Ransomware Is Encrypting Synology NAS Devices — Here Is What You Need to Know
Information Technology/IT6 days ago

C3RB3R Ransomware Is Encrypting Synology NAS Devices — Here Is What You Need to Know

In late October 2026, Synology issued an urgent advisory warning customers that threat actors were actively exploiting a critical remote-code-execution vulnerability (CVE-2024-10441, patched December 2024) in unpatched DiskStation Manager (DSM) software to deploy C3RB3R ransomware against internet-exposed NAS devices. Attackers encrypted victim data and appended a .L0CK3D extension, then demanded thousands of dollars for a decryption tool sold via a dark-web portal. With Shadowserver tracking over 380,000 internet-facing Synology NAS devices, the attack surface is substantial, and user reports on Reddit and BleepingComputer forums confirmed widespread infections well before Synology's formal advisory. C3RB3R (also called CerberImposter) has a documented history of pivoting from enterprise servers—Atlassian Confluence and GitLab—to edge storage appliances, demonstrating ransomware operators' strategy of targeting high-value, often-neglected network perimeter devices. The campaign underscores how unpatched NAS gear exposed directly to the internet continues to be a reliable ransomware entry point, elevating urgency for patch discipline and perimeter access controls across all industries.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
1,000+ GitLab Servers Still Exposed to Active RCE Exploits Weeks After Max-Severity Patch
1,000+ GitLab Servers Still Exposed to Active RCE Exploits Weeks After Max-Severity Patch
Computer Software/Engineering6 days ago

1,000+ GitLab Servers Still Exposed to Active RCE Exploits Weeks After Max-Severity Patch

In late October 2026, CISA added CVE-2026-97229 to its Known Exploited Vulnerabilities catalog after confirming active exploitation of a maximum-severity integer overflow flaw in GitLab's CI/CD Regular Expression Compiler. The vulnerability allows unauthenticated attackers to execute arbitrary code on unpatched self-managed GitLab instances by submitting a specially crafted regular expression via pipeline configuration files. GitLab issued patches on October 12, 2026 across CE and EE versions 19.4.2, 19.3.5, and 19.2.8, yet Shadowserver reported over 1,000 internet-exposed servers remained unpatched as of early November, with 11,300 additional instances still vulnerable to a related RCE flaw (CVE-2026-110264). This incident underscores a persistent and dangerous pattern: critical patches for widely used DevSecOps platforms go undeployed for weeks, leaving CI/CD pipelines — the backbone of software supply chains at Fortune 100 companies and beyond — exposed to unauthenticated remote code execution. With GitLab serving over 70 million users, the blast radius of delayed patching is enormous and continues to grow as active exploitation campaigns intensify.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
XCPE Botnet Takedown: How Firmware-Level Supply-Chain Malware Hijacked 1.3 Million Android TV Boxes
XCPE Botnet Takedown: How Firmware-Level Supply-Chain Malware Hijacked 1.3 Million Android TV Boxes
Consumer Electronics6 days ago

XCPE Botnet Takedown: How Firmware-Level Supply-Chain Malware Hijacked 1.3 Million Android TV Boxes

In November 2026, Google and industry partners dismantled the XCPE botnet—a supply-chain-embedded Android malware operation comprising more than 1.3 million streaming TV boxes deliberately backdoored during manufacturing by Chinese firm Videostrong Technology Co. The malware, embedded directly in device firmware with Android system-level privileges, connected to command-and-control infrastructure via MQTT brokers to deploy modular payloads enabling ad fraud, residential proxy abuse, keylogging, and silent app installation. Google revoked Videostrong's Android certification, took down C2 servers servicing over 10 million additional compromised devices, and coordinated with Japan's NPA and security firms including Lumen, HUMAN Security, and Synthient. This incident marks a critical escalation in firmware-level supply-chain attacks, where malware is intentionally baked into hardware before retail sale—rendering traditional endpoint and network defenses largely ineffective at initial compromise. The XCPE case reinforces growing concerns about hardware provenance, OEM certification integrity, and the weaponization of consumer IoT devices as persistent botnet infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
November 2026 Threat Roundup: Record Crypto Heist, Nation-State Relay Networks, AI Ransomware, and 50+ Critical CVEs
November 2026 Threat Roundup: Record Crypto Heist, Nation-State Relay Networks, AI Ransomware, and 50+ Critical CVEs
Financial Services6 days ago

November 2026 Threat Roundup: Record Crypto Heist, Nation-State Relay Networks, AI Ransomware, and 50+ Critical CVEs

The week of November 2, 2026 surfaced a convergence of high-severity threats spanning ransomware, nation-state intrusion, supply-chain compromise, infostealer campaigns, and DDoS botnets. North Korean group TraderTraitor set a new record by stealing $6.43 billion in cryptocurrency from Binance across 11 blockchains. Chinese state actor Volt Typhoon deployed a covert relay infrastructure called Silent Train using compromised SOHO, IoT, and enterprise devices to execute zero-day attacks against critical infrastructure. Supply-chain incidents hit Cursor Marketplace via a backdoored Claude Code extension and Polymarket via a hijacked third-party JavaScript service, while the Go-based Kairos botnet and uCreator Android spyware rounded out a broad and escalating threat landscape. This week's incidents underscore a structural shift: attackers are increasingly weaponizing trusted tools, third-party integrations, and covert relay networks to bypass perimeter defenses. The convergence of AI-assisted ransomware development (Aur0ra/Gold Ogre), supply-chain poisoning, and nation-state pre-positioning signals that organizations relying on implicit trust in software ecosystems and internal network flows face compounding, intersecting risks with shrinking detection windows.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CyberStrikeAI in the Wild: When the Attacker's Brain Is an LLM
CyberStrikeAI in the Wild: When the Attacker's Brain Is an LLM
Education Management6 days ago

CyberStrikeAI in the Wild: When the Attacker's Brain Is an LLM

In early 2025, Kaspersky's Cyber Threat Intelligence team uncovered an active campaign leveraging CyberStrikeAI, an open-source Go-based C2 framework that embeds a large language model orchestrator server-side to automate post-exploitation decisions. Threat actors—assessed with moderate confidence as Chinese-speaking based on script comments, timezone patterns, and tool provenance—compromised SQL Server 16.0.1000 instances at education-sector organizations across Africa and Latin America. Within hours of deploying the AI-driven implant, attackers achieved domain compromise via automated Kerberoasting, LSASS dumping, DCSync, Golden Ticket attacks, and SMB/WMI lateral movement, culminating in database exfiltration. The entire operation from agent deployment to domain administrator compromise completed in three to four days. This campaign marks one of the first publicly documented in-the-wild uses of an LLM embedded directly into attack orchestration rather than used for preparatory tasks. The AI layer did not introduce novel techniques but dramatically lowered operator skill requirements and compressed the post-exploitation timeline from weeks to hours, signaling a structural shift in how advanced persistent threats will operate at scale going forward.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Inside the XCPE Botnet: How a Chinese TV Box Maker Sold Backdoor Access to 1.3 Million Devices
Inside the XCPE Botnet: How a Chinese TV Box Maker Sold Backdoor Access to 1.3 Million Devices
Consumer Electronics6 days ago

Inside the XCPE Botnet: How a Chinese TV Box Maker Sold Backdoor Access to 1.3 Million Devices

In late October 2026, Google led a coordinated takedown of the XCPE botnet, a supply-chain-embedded operation infecting over 1.3 million Android TV set-top boxes and other consumer devices with a firmware-level backdoor. Device manufacturer Videostrong, based in Shenzhen, China, intentionally embedded the x.cpe backdoor into firmware across hundreds of models and sold criminal access. Operators disabled Google Play Protect, silently installed modules, harvested credentials, opened reverse shells, and monetized devices as residential proxies and ad-fraud engines. Google banned Videostrong from the Android ecosystem and partnered with Japan's NPA, Lumen, HUMAN Security, Plume, Synthient, and TrendAI to seize C2 infrastructure across more than a dozen malware families, with downstream impact estimated at 10 million additional devices. This incident marks a critical escalation in supply-chain weaponization, where hardware manufacturers themselves serve as the threat actor. As enterprise networks increasingly absorb unmanaged consumer and IoT devices—especially through remote-work hybrid environments—firmware-embedded backdoors bypassing platform security checks represent a systemic risk that perimeter and endpoint controls alone cannot address.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
SysGoRAT and AI-Generated Scripts: How CL-UNK-1211 Weaponized LLMs Against Government Linux Infrastructure
SysGoRAT and AI-Generated Scripts: How CL-UNK-1211 Weaponized LLMs Against Government Linux Infrastructure
Government Administration6 days ago

SysGoRAT and AI-Generated Scripts: How CL-UNK-1211 Weaponized LLMs Against Government Linux Infrastructure

Between October 2025 and April 2026, a threat cluster designated CL-UNK-1211 conducted a sustained cyber espionage campaign against government Linux server infrastructure. Attackers deployed SysGoRAT, a custom Go-based remote access trojan communicating over WebSocket C2, alongside AI-generated PHP and shell scripts for reconnaissance, credential harvesting, and email exfiltration. The group replaced .bashrc files, injected code into PHP login pages, and scanned configuration files for cleartext credentials. Attempts to compress and exfiltrate government mailboxes and social media account data were observed, alongside deliberate log wiping and deployment of red-team markers to disguise malicious activity as legitimate penetration testing. This campaign reflects an accelerating trend of state-affiliated threat actors integrating large language models and agentic AI frameworks to compress attack timelines, reduce manual overhead, and rapidly adapt post-exploitation tooling. As agentic offensive frameworks like ARTEX, PentAGI, and Hexstrike proliferate, defenders must reckon with machine-speed intrusion cycles that outpace conventional detection and response cadences.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
VOLTA Infostealer: How AI-Powered Malware Is Automating Victim Monetization in 2026
VOLTA Infostealer: How AI-Powered Malware Is Automating Victim Monetization in 2026
Financial Services6 days ago

VOLTA Infostealer: How AI-Powered Malware Is Automating Victim Monetization in 2026

In November 2026, Cisco Talos researchers disclosed VOLTA-AUTODOXER (VOLTA), a novel Windows infostealer that harvests credentials, cookies, payment cards, cryptocurrency seeds, OAuth tokens, SSH keys, and session data from compromised endpoints. What distinguishes VOLTA from commodity stealers is its embedded AI triage layer: stolen data is serialized into a structured evidence bundle and routed through OpenRouter to Anthropic Claude Opus 4.6, with fallbacks to Moonshot AI Kimi K2 and Google Gemini 2.5 Flash. The AI generates a monetization-ranked dossier and victim OPSEC assessment, then exfiltrates all output to a Telegram channel across three staged drops, effectively automating the analyst function for low-sophistication threat operators. VOLTA signals a structural shift in the infostealer economy: generative AI is no longer a research curiosity but an operationalized feature in commoditized malware builders. As adversarial GenAI adoption accelerates, security teams face a narrowing detection window because AI-assisted triage collapses the offline processing delay that historically gave defenders time to act after initial compromise.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
How Fake IT Help Desks on Teams and a Forgotten Certificate Turned Into a Full Domain Compromise
How Fake IT Help Desks on Teams and a Forgotten Certificate Turned Into a Full Domain Compromise
Information Technology/IT6 days ago

How Fake IT Help Desks on Teams and a Forgotten Certificate Turned Into a Full Domain Compromise

In late 2026, Microsoft investigated two intrusions in which attackers impersonated IT help desk staff via Microsoft Teams, convincing employees to grant remote access through Windows Quick Assist. The threat actors then exploited misconfigured Active Directory Certificate Services (AD CS) — specifically ESC1 and ESC8 vulnerabilities disclosed in 2021 — to obtain authentication certificates for privileged accounts, including domain controllers. In the first case, a single privileged account excluded from automatic containment allowed the attacker to reach a file server and exfiltrate data to an external SFTP server using a renamed Rclone binary. The second case was contained after workstation isolation. These intrusions underscore a dangerous convergence of social engineering, identity-based persistence, and misconfigured PKI infrastructure. As organizations accelerate cloud adoption and hybrid work, AD CS misconfigurations remain widespread, and Teams-based impersonation continues to scale — making identity hygiene and certificate auditing critical defensive priorities heading into 2027.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Two Critical Unauthenticated RCE Flaws in Langflow Put AI Agent Infrastructure at Immediate Risk
Two Critical Unauthenticated RCE Flaws in Langflow Put AI Agent Infrastructure at Immediate Risk
Information Technology/IT6 days ago

Two Critical Unauthenticated RCE Flaws in Langflow Put AI Agent Infrastructure at Immediate Risk

In late October 2026, IBM disclosed four vulnerabilities in Langflow, the widely deployed open-source AI agent and workflow builder, affecting every release from version 1.0.0 through 1.12.8. Two of the flaws—CVE-2026-93680 and CVE-2026-110186—carry CVSS scores of 9.8 (Critical) and require no authentication, allowing remote attackers to bypass security controls entirely or execute arbitrary code on the host server. A third flaw enables a low-privileged user to abuse Langflow's Agentic Assistant to run operating system commands server-side. A public Metasploit module already targets the authentication bypass via the Model Context Protocol (MCP) endpoint. The sole remediation is upgrading to Langflow 1.13.0, released October 22, 2026; IBM offers no interim workaround. These vulnerabilities illustrate a fast-maturing AI supply-chain risk: widely adopted open-source AI orchestration frameworks carry the same critical vulnerability classes as traditional enterprise software, yet their security maturity lags significantly. With six prior Langflow CVEs already in CISA's Known Exploited Vulnerabilities catalog and a Metasploit module publicly available within days of disclosure, organizations deploying AI agent infrastructure face immediate, weaponized exploit risk.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
DarkBlinders 2026: How an Iran-Nexus APT Compromised Israeli and Iraqi Kurdish Government Cloud Infrastructure
DarkBlinders 2026: How an Iran-Nexus APT Compromised Israeli and Iraqi Kurdish Government Cloud Infrastructure
Government Administration6 days ago

DarkBlinders 2026: How an Iran-Nexus APT Compromised Israeli and Iraqi Kurdish Government Cloud Infrastructure

Between August and October 2026, the Iran-nexus threat actor DarkBlinders conducted an active cyber espionage campaign targeting a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. The group combined spear-phishing, fake recruitment lures impersonating Dubai Airports, and trojanized Visual Studio coding challenges to deliver SHELBYLOADER V2 and SHELBYC2, a GitHub-based backdoor. Credential-harvesting lookalike domains, AppDomainManager injection, DLL sideloading, and a tunneling utility called Blackwood were used to establish persistent, covert access to sensitive government infrastructure. DarkBlinders is assessed with medium confidence to be a sub-cluster of APT34 (OilRig), Iran's most prolific state-sponsored group. Its expanding victimology, novel delivery chains, and growing overlap with clusters UNC5795 and UNC5187 signal a deliberate escalation in Iranian cyber operations against Middle Eastern government targets at a time of heightened geopolitical tensions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Alpine Linux's GitLab Rebuild: What a Near-Miss CI/CD Supply-Chain Attack Reveals About Egress Blind Spots
Alpine Linux's GitLab Rebuild: What a Near-Miss CI/CD Supply-Chain Attack Reveals About Egress Blind Spots
Computer Software/Engineering1 week ago

Alpine Linux's GitLab Rebuild: What a Near-Miss CI/CD Supply-Chain Attack Reveals About Egress Blind Spots

On October 20–21, 2026, threat actors attempted to exploit CVE-2026-97229, a maximum-severity remote code execution vulnerability in GitLab's CI/CD regex compiler (Onigmo/Ruby), against Alpine Linux's development infrastructure. Attackers submitted malicious CI configurations that caused eight worker process crashes, with four attempts coming close to full exploitation. Alpine Linux had inadvertently deployed unpatched container images that omitted the required Ruby fix. Unable to rule out a successful compromise due to missing logs and absent outbound connection records, Alpine rebuilt its GitLab instance from scratch and reset all credentials. No confirmed code tampering or package poisoning was found, but the incident exposed the fragility of custom container build pipelines as a supply-chain attack surface. This incident underscores a growing attacker pattern: targeting open-source project infrastructure—specifically CI/CD and GitLab environments—to achieve downstream supply-chain impact at scale. With Docker-based Alpine images underpinning millions of containerized workloads globally, even an attempted compromise at this layer carries outsized risk, amplifying urgency for CI/CD pipeline hardening and patch governance.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports