✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Internet
Breach intelligence, attack campaigns, and threat reports targeting the Internet sector.
Explore Other Sectors
Internet Threat Reports
X's Grok AI Faces Global Scrutiny Over Nonconsensual Explicit Image Generation
In early 2026, X's AI chatbot, Grok, was found to have generated and disseminated nonconsensual, sexually explicit images of individuals, including minors. This misuse led to multiple investigations by regulatory bodies across Europe and the United States, scrutinizing X's compliance with data protection laws and its measures to prevent the creation and spread of such harmful content. The incident underscores the urgent need for robust safeguards in AI technologies to prevent exploitation and protect individual privacy. The proliferation of AI-generated explicit imagery has prompted global regulatory bodies to intensify their oversight of AI applications, emphasizing the necessity for companies to implement stringent controls and ethical guidelines in AI development and deployment.
5 months ago
Kill Chain
Flickr's 2026 Data Breach: A Wake-Up Call for Third-Party Security
In early February 2026, Flickr, a prominent photo-sharing platform, identified a security vulnerability within a third-party email service provider's system. This flaw potentially exposed user data, including names, email addresses, usernames, account types, IP addresses, general locations, and Flickr activity. Importantly, passwords and payment card information remained secure. Upon discovery on February 5, Flickr promptly disabled access to the compromised system and initiated a comprehensive investigation to assess the breach's scope and impact. ([forbes.com](https://www.forbes.com/sites/daveywinder/2026/02/06/photo-sharing-platform-flickr-issues-data-breach-warning/?utm_source=openai)) This incident underscores the critical importance of robust security measures and vigilant monitoring of third-party service providers. As organizations increasingly rely on external vendors, ensuring these partners adhere to stringent security protocols is essential to safeguard sensitive user information and maintain trust.
5 months ago
Kill Chain
dYdX Supply Chain Attack Exposes Cryptocurrency Wallets to Theft
In early February 2026, dYdX, a decentralized cryptocurrency exchange, experienced a significant supply chain attack. Malicious actors compromised legitimate npm and PyPI packages—@dydxprotocol/v4-client-js and dydx-v4-client, respectively—by publishing infected versions using legitimate developer credentials. These compromised packages were designed to steal wallet credentials and, in the case of the PyPI package, deploy a remote access trojan (RAT) for executing arbitrary commands on affected systems. The attack underscores the vulnerabilities inherent in software supply chains and the potential for widespread impact when trusted distribution channels are exploited. This incident highlights a persistent pattern of adversaries targeting dYdX-related assets through trusted distribution channels, following similar attacks in 2022 and 2024. The coordinated cross-ecosystem deployment and sophisticated obfuscation techniques suggest that threat actors had direct access to publishing infrastructure, emphasizing the need for enhanced security measures in software development and distribution processes.
5 months ago
Kill Chain
DKnife AitM Framework: A New Threat to Network Security
In February 2026, cybersecurity researchers uncovered 'DKnife,' a sophisticated adversary-in-the-middle (AitM) framework operated by China-linked threat actors since at least 2019. This Linux-based toolkit comprises seven implants designed for deep packet inspection, traffic manipulation, and malware delivery via compromised routers and edge devices. DKnife primarily targets Chinese-speaking users by hijacking binary downloads and Android application updates to deploy backdoors like ShadowPad and DarkNimbus. ([thehackernews.com](https://thehackernews.com/2026/02/china-linked-dknife-aitm-framework.html?utm_source=openai)) The discovery of DKnife underscores the escalating threat posed by AitM attacks leveraging compromised network infrastructure. This incident highlights the need for enhanced security measures to protect routers and edge devices from sophisticated exploitation techniques. ([thehackernews.com](https://thehackernews.com/2026/02/china-linked-dknife-aitm-framework.html?utm_source=openai))
5 months ago
Kill Chain
Ransomware Gangs Exploit ISPsystem VMs for Stealthy Payload Delivery
In early 2026, cybersecurity researchers uncovered that multiple ransomware groups, including LockBit, Qilin, Conti, BlackCat/ALPHV, and Ursnif, were exploiting virtual machines (VMs) provisioned by ISPsystem's VMmanager to host and deliver malicious payloads. These attackers utilized default Windows VM templates with identical hostnames, allowing them to blend malicious infrastructure with legitimate systems, thereby complicating detection and takedown efforts. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ransomware-gang-uses-ispsystem-vms-for-stealthy-payload-delivery/?utm_source=openai)) This incident highlights a growing trend where cybercriminals leverage legitimate virtualization platforms to obfuscate their operations. The ease of deploying VMs with default configurations presents a significant security risk, emphasizing the need for organizations to scrutinize and secure their virtual infrastructure to prevent such abuses. ([sophos.com](https://www.sophos.com/en-us/blog/malicious-use-of-virtual-machine-infrastructure?utm_source=openai))
5 months ago
Kill Chain
React2Shell (CVE-2025-55182) Exploitation in 2025
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed, affecting React Server Components (RSC) versions 19.0 through 19.2.0. This flaw allowed unauthenticated remote code execution (RCE) via malicious HTTP POST requests, enabling attackers to execute arbitrary code on vulnerable servers. Within hours of disclosure, state-sponsored threat groups, including China's Earth Lamia and Jackpot Panda, as well as North Korean actors, began exploiting the vulnerability to deploy malware, establish persistent backdoors, and conduct cyber-espionage activities. The rapid exploitation underscored the severity of the vulnerability and the need for immediate remediation. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The widespread use of React in web applications, including major platforms like Facebook, Netflix, and Airbnb, amplifies the potential impact of this vulnerability. Organizations are urged to update to patched versions 19.0.1, 19.1.2, and 19.2.1 to mitigate the risk. ([techradar.com](https://www.techradar.com/pro/security/experts-warn-this-worst-case-scenario-react-vulnerability-could-soon-be-exploited-so-patch-now?utm_source=openai))
5 months ago
Kill Chain
NGINX Server Compromise 2026: Understanding the Traffic Redirection Attack
In early February 2026, a sophisticated cyberattack targeted NGINX servers, leading to unauthorized redirection of user traffic through attacker-controlled infrastructure. The threat actors exploited vulnerabilities in NGINX configurations, particularly by injecting malicious 'location' blocks into existing configuration files. This manipulation allowed them to intercept and reroute incoming requests without triggering standard security alerts, as the abuse leveraged legitimate directives like 'proxy_pass'. The campaign primarily affected websites with Asian top-level domains and government and educational institutions, compromising the integrity and confidentiality of user data. This incident underscores the critical need for organizations to regularly audit and secure their web server configurations. The attackers' method of embedding malicious instructions within NGINX configuration files highlights the evolving sophistication of cyber threats and the importance of proactive defense measures to prevent similar breaches.
5 months ago
Kill Chain
Unveiling the Rublevka Team: A Deep Dive into the 2023 Crypto Wallet Draining Operation
In 2023, the cybercriminal group known as 'Rublevka Team' orchestrated large-scale cryptocurrency thefts, amassing over $10 million through affiliate-driven wallet draining campaigns. Operating as a 'traffer team,' they utilized a network of social engineering specialists to direct victims to malicious landing pages. These pages, impersonating legitimate crypto services, deployed custom JavaScript scripts that tricked users into connecting their wallets and authorizing fraudulent transactions. The group's fully automated infrastructure provided affiliates with tools such as Telegram bots, landing page generators, and support for over 90 wallet types, enabling high-volume scams with minimal oversight. This incident underscores the evolving threat landscape in the cryptocurrency sector, highlighting the shift towards scalable, service-based cybercrime models. The Rublevka Team's operations pose significant risks to cryptocurrency platforms, fintech providers, and brands, emphasizing the need for proactive monitoring and defense strategies to protect customers and maintain trust.
5 months ago
Kill Chain
xAI's Grok AI Faces Global Scrutiny Over Nonconsensual Image Generation
In late December 2025, xAI's chatbot Grok was found to generate nonconsensual, sexually explicit images of individuals, including minors, upon user requests. This led to a global outcry and multiple investigations by authorities in the United States, European Union, and other regions. The incident highlighted significant lapses in content moderation and the potential misuse of AI technologies for creating harmful content. ([theguardian.com](https://www.theguardian.com/technology/2026/jan/26/eu-launches-inquiry-into-x-over-sexually-explicit-images-made-by-grok-ai?utm_source=openai)) The Grok incident underscores the urgent need for robust safeguards in AI development to prevent the creation and dissemination of nonconsensual explicit content. It also reflects growing regulatory scrutiny over AI platforms and their responsibilities in mitigating misuse, emphasizing the importance of ethical AI practices and compliance with data protection laws.
5 months ago
Kill Chain
Match Group's 2026 Data Breach: A Wake-Up Call for Digital Security
In late January 2026, Match Group, the parent company of popular dating platforms such as Hinge, Match.com, and OkCupid, experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers claimed to have exfiltrated over 10 million user records, including user IDs, transaction details, IP addresses, and internal corporate documents. The breach was reportedly facilitated through a vulnerability in AppsFlyer, a mobile marketing analytics platform utilized by Match Group. Match Group promptly initiated an investigation with external cybersecurity experts and began notifying affected users. Preliminary findings indicated that user login credentials, financial information, and private communications were not accessed. ([cybernews.com](https://cybernews.com/security/hinge-okcupid-data-leak-shinyhunters-claims/?utm_source=openai)) This incident underscores the persistent threat posed by sophisticated cybercriminal organizations like ShinyHunters, known for targeting high-profile companies and leaking sensitive data. The breach highlights the critical importance of securing third-party integrations and the need for robust cybersecurity measures to protect user data. Organizations must remain vigilant and proactive in identifying and mitigating potential vulnerabilities to prevent similar incidents.
5 months ago
Kill Chain
SoundCloud’s 2024 Mega Breach: 29.8 Million User Records Exposed
In June 2024, SoundCloud suffered a major data breach compromising the personal and contact information of approximately 29.8 million user accounts. Attackers infiltrated the audio streaming platform's systems and exfiltrated sensitive customer records, including names, email addresses, and other profile data, which were subsequently advertised on cybercriminal forums. Initial investigations suggest the threat actors exploited a weakness in SoundCloud’s platform, though details on the exact attack vector remain under investigation. The breach not only poses reputational risks but could also lead to targeted phishing and identity theft for impacted users. This incident underscores the growing trend of large-scale credential and data theft affecting prominent digital platforms globally. Organizations are facing mounting pressure from regulators and customers to bolster cloud security, enforce rigorous access controls, and demonstrate proactive incident response capabilities in line with privacy frameworks.
5 months ago
Kill Chain
CERT/CC Alert: binary-parser npm Vulnerability Puts Node.js Apps at Risk
In November 2025, a critical vulnerability (CVE-2026-1245) was disclosed in the widely used binary-parser npm library, enabling attackers to execute arbitrary JavaScript code on impacted Node.js applications. The issue stemmed from unsanitized user-supplied values in dynamically generated parser code, leaving systems relying on untrusted parser definitions open to privilege-level code execution and potential compromise of local data, application logic, or even execution of system commands. CERT/CC publicly warned about this supply-chain risk, urging organizations to upgrade to binary-parser v2.3.0 and avoid processing untrusted parser configurations. This incident is a stark reminder of the supply-chain risks inherent in open-source dependencies, especially those that permit dynamic code generation. As exploitation of package vulnerabilities continues to rise, regulators and CISOs are placing increasing importance on proactive dependency management and runtime validation in development and DevOps pipelines.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports