Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
INTERPOL's Operation Ramz Dismantles SniperDz Phishing Platform
In a coordinated effort from October 2025 to February 2026, INTERPOL led Operation Ramz, targeting cybercriminal activities across 13 countries in the Middle East and North Africa. This operation resulted in 201 arrests, the identification of 3,867 victims, and the seizure of 53 servers. A significant outcome was the dismantling of SniperDz, a decade-old Phishing-as-a-Service platform, and the arrest of its primary developer in Algeria. SniperDz provided cybercriminals with ready-made phishing kits and infrastructure, facilitating global credential theft. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) The takedown of SniperDz underscores the persistent threat posed by Phishing-as-a-Service platforms, which lower the barrier to entry for cybercriminals and enable widespread credential theft. This incident highlights the importance of international collaboration in combating cybercrime and the need for organizations to remain vigilant against evolving phishing tactics.
3 months ago
Kill Chain
Critical RCE Vulnerability in LangGraph: Immediate Action Required
In February 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-27794, was discovered in LangGraph's caching layer. This flaw allowed attackers with write access to the cache backend to inject malicious serialized objects, leading to arbitrary code execution upon deserialization by the LangGraph process. The vulnerability affected versions of langgraph-checkpoint prior to 4.0.0 and was particularly concerning for applications utilizing cache backends inheriting from BaseCache with nodes opted into caching via CachePolicy. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27794/?utm_source=openai)) This incident underscores the persistent risks associated with deserialization of untrusted data, especially in AI frameworks. Organizations leveraging LangGraph for AI agent orchestration must ensure they have updated to version 4.0.0 or later to mitigate this vulnerability. The event highlights the critical need for secure coding practices and regular security assessments in AI development environments.
3 months ago
Kill Chain
CISA Adds CVE-2026-10520 to Known Exploited Vulnerabilities Catalog
In June 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-10520 to its Known Exploited Vulnerabilities (KEV) Catalog. This critical OS Command Injection vulnerability in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to execute code with root privileges. The flaw poses significant risks to federal enterprises and has been actively exploited in the wild. Organizations are urged to update to the patched versions immediately to mitigate potential threats. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-10520?utm_source=openai)) The inclusion of CVE-2026-10520 in the KEV Catalog underscores the ongoing threat posed by command injection vulnerabilities. This incident highlights the importance of timely patch management and proactive vulnerability assessments to prevent unauthorized access and potential data breaches.
3 months ago
Kill Chain
Agentjacking: Exploiting AI Coding Agents via Sentry Vulnerability
In June 2026, Tenet Security identified a novel attack method termed 'Agentjacking,' which exploits AI coding agents by injecting malicious code through manipulated error reports in Sentry, an open-source error-tracking platform. Attackers can send crafted error events to Sentry using publicly accessible Data Source Names (DSNs), embedding commands that AI agents interpret and execute as legitimate diagnostic steps. This technique allows unauthorized code execution on developer machines, potentially exposing sensitive data such as environment variables, Git credentials, and private repository URLs. The Agentjacking attack underscores the growing security risks associated with integrating AI coding agents into development workflows. As these agents gain broader access to codebases and tools, they become attractive targets for exploitation. This incident highlights the urgent need for robust security measures and governance frameworks to manage the deployment and operation of AI agents, ensuring they do not inadvertently become vectors for cyberattacks.
3 months ago
Kill Chain
Urgent: Ivanti Sentry Vulnerability Exploited – Immediate Action Required
In June 2026, a critical OS command injection vulnerability (CVE-2026-10520) was discovered in Ivanti Sentry, formerly known as MobileIron Sentry. This flaw allows remote, unauthenticated attackers to execute arbitrary commands with root privileges on affected devices. Ivanti released patches on June 9, 2026, addressing the issue in versions R10.5.2, R10.6.2, and R10.7.1. However, within 24 hours, reports emerged of active exploitation, with attackers backdooring exposed Sentry gateways. The Shadowserver Foundation identified multiple compromised instances, indicating widespread exploitation. Organizations using Ivanti Sentry are urged to apply the patches immediately to mitigate the risk of unauthorized access and potential data breaches. This incident underscores the critical importance of timely patch management and proactive vulnerability assessments to safeguard enterprise networks against rapidly evolving threats.
3 months ago
Kill Chain
CISA's BOD 26-04: Accelerated Patching Mandate for Federal Agencies
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 26-04, mandating Federal Civilian Executive Branch (FCEB) agencies to remediate high-risk vulnerabilities within accelerated timeframes, as short as three days. This directive supersedes previous directives and prioritizes patching based on factors such as public exposure, inclusion in CISA's Known Exploited Vulnerabilities catalog, potential for automated exploitation, and the level of control an attacker could gain. This directive underscores the escalating threat landscape and the necessity for rapid vulnerability management. Organizations beyond the federal scope are encouraged to adopt similar practices to mitigate risks associated with known exploited vulnerabilities.
3 months ago
Kill Chain
Coupang Data Breach 2025: A Wake-Up Call for E-Commerce Security
In June 2025, Coupang, South Korea's leading e-commerce platform, experienced a significant data breach that went undetected until November 2025. The breach compromised personal information of approximately 37.55 million customers, including names, email addresses, phone numbers, delivery addresses, and order histories. Investigations revealed that the breach resulted from inadequate security practices, such as poor authentication key management and insufficient access controls. This incident underscores the critical importance of robust cybersecurity measures in protecting sensitive customer data. The substantial fine imposed by South Korean authorities highlights the growing regulatory focus on data protection and the severe consequences of security lapses for organizations handling large volumes of personal information.
3 months ago
Kill Chain
Kyushu Electric Power Data Breach: 10.9 Million Customer Records Exposed
In April 2026, Kyushu Electric Power Co., Inc., a major Japanese utility company, experienced a significant data breach involving the loss of an external storage device containing personal information of approximately 10.9 million customers. The device, used for routine data backups, was stored in a server room cabinet with multiple physical security layers. On May 26, IT staff discovered the cabinet unlocked and the device missing. The data included customer names, service addresses, electricity usage data, telephone numbers, and names of retail electricity providers. Notably, no bank account or credit card information was stored on the device. The company has notified affected customers and relevant authorities, including Japan’s Personal Information Protection Commission and the Ministry of Economy, Trade, and Industry. Investigations are ongoing, with no evidence of data leakage confirmed as of now. This incident underscores the critical importance of robust physical security measures and strict access controls for sensitive data storage. It highlights the need for organizations to regularly review and enhance their data protection protocols to prevent unauthorized access and potential data breaches.
3 months ago
Kill Chain
Critical Security Flaws Discovered in OpenClaw AI Agent
In June 2026, security researchers from Imperva and Varonis identified critical vulnerabilities in OpenClaw, a widely used self-hosted AI agent. Imperva demonstrated that attackers could embed malicious instructions within shared contacts, vCards, and location pins, leading the agent to execute unauthorized code without user awareness. Varonis revealed that OpenClaw could be manipulated through standard emails to exfiltrate sensitive data, such as AWS keys and customer information, to external addresses. These findings underscore the agent's susceptibility to prompt injection attacks and its overreliance on unverified inputs, posing significant security risks to users. The rapid adoption of AI agents like OpenClaw has outpaced the development of robust security measures, highlighting the urgent need for comprehensive governance frameworks. Organizations must reassess their deployment strategies, implement stringent access controls, and ensure continuous monitoring to mitigate the risks associated with autonomous AI systems operating within their environments.
3 months ago
Kill Chain
Escalating Cyber Threats from North Korea and China Target Asia-Pacific Financial Institutions
In 2025, cyber threat groups linked to North Korea and China intensified their attacks on financial institutions and cryptocurrency assets in the Asia-Pacific region. North Korean adversaries, notably PRESSURE CHOLLIMA, executed the largest financial theft to date, stealing $1.46 billion in cryptocurrency through a supply chain compromise. Concurrently, Chinese threat actors like HOLLOW PANDA targeted financial institutions across multiple countries, including the Philippines, Indonesia, and Brazil. These operations leveraged advanced techniques, including AI-generated identities and sophisticated social engineering tactics, to infiltrate organizations and exfiltrate sensitive data. ([crowdstrike.com](https://www.crowdstrike.com/en-us/press-releases/crowdstrike-2026-financial-services-threat-landscape-report/?utm_source=openai)) The escalation of these cyber activities underscores a growing trend of state-sponsored cybercrime aimed at financial gain and intelligence collection. The increasing sophistication and frequency of these attacks highlight the urgent need for enhanced cybersecurity measures and international collaboration to protect financial infrastructures from such persistent threats.
3 months ago
Kill Chain
ServiceNow Security Alert: Understanding the June 2026 Incident
In early June 2026, ServiceNow identified a security issue that allowed unauthorized users to access certain customer data through a misconfigured API endpoint. The vulnerability, affecting customers on the Australia platform release and earlier versions with specific configurations, was exploited to query customer instance tables containing sensitive information. ServiceNow addressed the issue with a security update on June 5, 2026, restricting access to authenticated users. Subsequent investigations revealed that the anomalous activity was conducted by security researchers participating in bug bounty programs, not malicious actors. This incident underscores the importance of promptly addressing security vulnerabilities and the potential for security research activities to be misinterpreted as malicious threats.
3 months ago
Kill Chain
GitHub Enhances Security by Disabling npm Install Scripts by Default
In June 2026, GitHub announced significant changes to npm version 12, aiming to enhance security by disabling install scripts by default. This measure addresses vulnerabilities where attackers exploit npm lifecycle hooks during the 'npm install' process to execute malicious code. By requiring explicit user approval for script execution, GitHub seeks to mitigate risks associated with software supply chain attacks. This change is particularly relevant given the recent surge in supply chain attacks targeting npm packages. Incidents like the 'Mini Shai-Hulud' campaign have demonstrated the potential for widespread impact, emphasizing the need for proactive security measures in package management systems.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports