The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Information Technology/IT
Breach intelligence, attack campaigns, and threat reports targeting the Information Technology/IT sector.
Explore Other Sectors
Information Technology/IT Threat Reports
Romanian Hacker Sentenced for Breaching Oregon Government Network
In June 2021, Catalin Dragomir, a Romanian national operating under the alias "inthematrixl," unlawfully accessed the Oregon Department of Emergency Management's network. He extracted personally identifiable information, including names, email addresses, dates of birth, and passport numbers, and sold this data alongside unauthorized network access to potential buyers. Dragomir extended his cybercriminal activities by compromising nearly a dozen other U.S. networks, resulting in cumulative losses exceeding $250,000. Following his arrest in Romania in November 2024 and subsequent extradition to the United States in January 2025, Dragomir pleaded guilty to charges of aggravated identity theft and obtaining information from a protected computer. In May 2026, he was sentenced to 56 months in federal prison and ordered to forfeit approximately 23 Monero (XMR) cryptocurrency, valued at roughly $8,500. This case underscores the persistent threat posed by cybercriminals targeting government infrastructures and the critical need for robust cybersecurity measures to protect sensitive data. The incident also highlights the importance of international cooperation in apprehending and prosecuting cyber offenders.
3 months ago
Kill Chain
Carnival Cruise Data Breach 2026: A Wake-Up Call for Cybersecurity
In April 2026, Carnival Corporation, the world's largest cruise line operator, experienced a significant data breach affecting nearly 6 million individuals. The breach was initiated through a social engineering attack, where an unauthorized actor deceived an employee to gain access to a limited portion of the company's IT system. The attackers, identified as the ShinyHunters extortion gang, claimed responsibility for the breach, stating they stole documents containing over 8.7 million records with personally identifiable information and terabytes of internal corporate data. The compromised data includes names, dates of birth, email addresses, genders, geographic locations, and loyalty program details. Carnival promptly blocked the unauthorized activity and began working with third-party security experts to strengthen their security measures and conduct a thorough investigation. This incident underscores the persistent threat posed by sophisticated cybercriminal groups like ShinyHunters, who employ advanced social engineering tactics to infiltrate organizations. The breach highlights the critical need for robust cybersecurity protocols, employee training to recognize and resist social engineering attempts, and comprehensive incident response strategies to mitigate the impact of such attacks.
3 months ago
Kill Chain
Critical Gogs Zero-Day Vulnerability Exposes Code Repositories to Remote Code Execution
In May 2026, a critical zero-day vulnerability was discovered in Gogs, a self-hosted Git service. This argument injection flaw allows authenticated users to execute arbitrary code on servers running Gogs versions 0.14.2 and 0.15.0+dev. Exploitation involves creating a pull request with a malicious branch name that injects the --exec flag into git rebase during the 'Rebase before merging' operation. This vulnerability enables attackers to compromise the server, access all repositories, extract credentials, and potentially pivot to other systems. The incident underscores the persistent risks associated with self-hosted code repositories, especially those with default configurations that permit open registration. Organizations relying on Gogs should assess their exposure, apply available patches promptly, and consider implementing stricter access controls to mitigate similar threats.
3 months ago
Kill Chain
FortiClient EMS Vulnerability Leads to EKZ Infostealer Deployment
In May 2026, threat actors exploited a critical authentication bypass vulnerability (CVE-2026-35616) in Fortinet's FortiClient Enterprise Management Server (EMS) versions 7.4.5 and 7.4.6. This flaw allowed unauthenticated remote attackers to execute arbitrary code via specially crafted requests. Leveraging this vulnerability, attackers delivered the EKZ infostealer malware, disguised as a legitimate Fortinet endpoint update, through FortiClient-managed VPN scripting workflows. The malware targeted credentials and sensitive data stored in web browsers, exfiltrating them to attacker-controlled servers. Fortinet released emergency patches to address this issue, and organizations were urged to apply them promptly to mitigate the risk of compromise. This incident underscores the critical importance of timely patch management and vigilance against sophisticated social engineering tactics. The exploitation of trusted security infrastructure highlights the evolving strategies of threat actors, emphasizing the need for organizations to adopt a proactive and layered security approach to protect against such vulnerabilities.
3 months ago
Kill Chain
Cybercriminals Exploit Pirated Streaming Sites to Distribute Cryptocurrency Miners
In late April 2026, a client sought incident response support after discovering a cryptocurrency miner operating on users' computers. Investigation revealed that the malware was distributed via illegal movie and TV show streaming sites, employing a fake video player plugin update to deceive users into downloading a malicious ZIP archive. This archive contained a legitimate executable and a malicious DLL, which, upon execution, utilized DLL side-loading to inject the miner into the system. The campaign, active since at least 2022, has evolved over time, targeting users through various pirated content platforms, thereby expanding its potential victim base. ([security-portal.cz](https://www.security-portal.cz/aggregator/sources/71?utm_source=openai)) This incident underscores the persistent threat posed by cybercriminals leveraging popular but illicit platforms to distribute malware. The continued evolution of such campaigns highlights the need for heightened vigilance and robust security measures, especially as attackers refine their techniques to exploit user trust in widely used services.
3 months ago
Kill Chain
Critical Gogs RCE Vulnerability Discovered in 2026
In May 2026, a critical remote code execution (RCE) vulnerability was identified in Gogs, an open-source self-hosted Git service. This flaw allows authenticated users to execute arbitrary code on the server by creating a pull request with a malicious branch name that injects the --exec flag into git rebase during the 'Rebase before merging' operation. The vulnerability, rated 9.4 on the CVSS scale, does not require administrative privileges or interaction with other users, making exploitation straightforward for any registered user. ([thehackernews.com](https://thehackernews.com/2026/05/critical-gogs-rce-vulnerability-lets.html?utm_source=openai)) The discovery of this vulnerability underscores the ongoing risks associated with self-hosted development tools. Organizations relying on Gogs should promptly implement recommended mitigations, such as restricting user registration and repository creation, to prevent potential exploitation. ([thehackernews.com](https://thehackernews.com/2026/05/critical-gogs-rce-vulnerability-lets.html?utm_source=openai))
3 months ago
Kill Chain
JINX-0164's Sophisticated Attack on Cryptocurrency Firms
In mid-2025, a previously unidentified threat actor, JINX-0164, initiated a campaign targeting cryptocurrency organizations. Utilizing sophisticated social engineering tactics, the attackers posed as recruiters on LinkedIn, inviting victims to virtual meetings on counterfeit domains resembling legitimate teleconference services. During these meetings, victims were deceived into downloading a malicious file disguised as a meeting client, leading to the installation of a Python-based macOS malware named AUDIOFIX. This malware harvested sensitive data, including credentials from password managers, web browsers, and cryptocurrency wallet extensions, and facilitated lateral movement within the organizations' development infrastructure. ([thehackernews.com](https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html?utm_source=openai)) The campaign's relevance persists due to the increasing sophistication of social engineering attacks targeting the cryptocurrency sector. The use of custom macOS malware and the focus on compromising development pipelines underscore the evolving tactics of financially motivated threat actors. Organizations must remain vigilant against such multifaceted attacks to safeguard their digital assets. ([thehackernews.com](https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html?utm_source=openai))
3 months ago
Kill Chain
Microsoft Addresses Risks of Uncoordinated Zero-Day Disclosures
In May 2026, security researcher Chaotic Eclipse publicly disclosed multiple zero-day vulnerabilities affecting Windows components such as Defender and BitLocker. These disclosures were made without prior notification to Microsoft, leading to active exploitation of vulnerabilities like BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), and UnDefend (CVE-2026-45498). Microsoft criticized this uncoordinated approach, emphasizing the risks posed to customers and advocating for Coordinated Vulnerability Disclosure (CVD) to allow vendors time to address issues before public release. This incident underscores the ongoing tension between independent security researchers and software vendors regarding disclosure practices. The rapid exploitation of these vulnerabilities highlights the critical need for timely and coordinated communication to mitigate risks and protect end-users effectively.
3 months ago
Kill Chain
Akira Ransomware 2026 Attack: Lessons for Mid-Sized Organizations
In May 2026, a mid-sized organization fell victim to an Akira ransomware attack. The intrusion began with the exploitation of a forgotten local VPN account lacking multi-factor authentication, allowing attackers to gain initial access. Subsequently, they conducted network reconnaissance, escalated privileges, and moved laterally across systems. The attackers exfiltrated sensitive data before deploying ransomware to encrypt files, culminating in a ransom demand. This incident underscores the critical need for robust access controls and vigilant monitoring of network activities to prevent such breaches. The Akira ransomware group has demonstrated a rapid escalation in attack sophistication and frequency, particularly targeting organizations with vulnerable VPN configurations. Their ability to swiftly transition from initial access to full data encryption within hours highlights the urgency for organizations to implement comprehensive cybersecurity measures, including timely patching, multi-factor authentication, and continuous network monitoring.
3 months ago
Kill Chain
Zapier Vulnerabilities Exposed: Potential Account Takeover Risks
In May 2026, security researchers from Token Security identified a chain of five vulnerabilities within Zapier, a widely-used workflow automation service. Exploiting these flaws required only a free Zapier account and could have allowed attackers to impersonate any signed-in user, potentially accessing millions of user accounts and their connected applications. The attack vector involved manipulating user-generated code, retrieving discarded login credentials, and accessing internal storage systems containing private software images. One such image included a publishing key for code running in every logged-in user's browser, enabling attackers to create or alter automations and interact with connected services as legitimate users. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai)) This incident underscores the critical importance of securing automation platforms, especially as they gain increased authority to act on behalf of users across multiple services. The vulnerabilities were promptly reported and patched, with no evidence of exploitation. However, organizations are advised to review their automation logs for unauthorized activities and reauthorize connections to sensitive systems to mitigate potential risks. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai))
3 months ago
Kill Chain
FBI Issues Warning on Silent Ransom Group's In-Person Data Theft Tactics
In May 2026, the FBI issued a warning about the Silent Ransom Group (SRG), a Russia-linked data extortion gang targeting U.S. law firms. SRG employs a combination of social engineering tactics, including phone calls and phishing emails, to impersonate IT support staff. If these remote attempts fail, the group escalates to in-person visits, where operatives physically access computers to steal sensitive data using external storage devices. This method has led to the compromise of over 100 law firms, with data from more than 38 firms publicly leaked. The group's focus on law firms is strategic, exploiting the highly sensitive nature of legal data to exert pressure for ransom payments. SRG's unique approach, combining remote social engineering with physical intrusion, underscores the evolving threat landscape and the need for robust security measures in the legal sector.
3 months ago
Kill Chain
CISA Mandates Urgent Patching of LiteSpeed cPanel Plugin Vulnerability CVE-2026-48172
In May 2026, a critical privilege escalation vulnerability, CVE-2026-48172, was discovered in the LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4. This flaw allows unauthenticated remote attackers to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function, which mishandles Redis enable/disable features. The vulnerability has been actively exploited in the wild, leading to full system compromises on affected servers. LiteSpeed released urgent security updates to address the issue, urging users to update to version 2.4.5 or later. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-48172/?utm_source=openai)) The exploitation of CVE-2026-48172 underscores the critical importance of timely patch management and the need for robust privilege assignment mechanisms in web hosting environments. The incident highlights the potential risks associated with shared hosting platforms, where a single compromised account can lead to server-wide breaches. Organizations are advised to prioritize the implementation of security patches and to conduct thorough audits of their systems to prevent similar vulnerabilities from being exploited.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports