Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Internet

Breach intelligence, attack campaigns, and threat reports targeting the Internet sector.

359 threat reports
Page 25 of 30
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Internet Threat Reports

Showing 289–300 / 359 reports
WhiteDate 2026 Data Breach: Privacy, Doxing, and Sensitive Data Handling
Computer Software/Engineering9 months ago

WhiteDate 2026 Data Breach: Privacy, Doxing, and Sensitive Data Handling

In January 2026, a sensitive data breach occurred involving WhiteDate, a controversial dating platform, exposing the personal information of its user base. The breach involved the unauthorized disclosure of email addresses and other private attributes, potentially linking individuals to a site associated with significant social stigma and white supremacist ideologies. Cybersecurity experts flagged this incident as highly sensitive due to the risk of outing individuals based solely on their presence in the dataset, which could result in reputational, professional, and even physical harm. The case reignited debates on the ethics of breach data handling and the obligations for responsible disclosure, especially where the data intersects with legally defined sensitive categories. This breach is particularly relevant as privacy frameworks and legal standards, such as GDPR and CCPA, impose stricter requirements for classifying and handling sensitive data. The rise of doxing and moral-driven disclosures increases the urgency for robust zero trust governance and nuanced incident response.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Instagram 2026: Data Scraping Leak Exposes 17 Million Accounts
Marketing/Advertising/Sales10 months ago

Instagram 2026: Data Scraping Leak Exposes 17 Million Accounts

In January 2026, security researchers and several hacking forums circulated claims that data for over 17 million Instagram accounts was leaked online. The incident is believed to stem from large-scale data scraping leveraging a password reset email bug, combined potentially with prior years' API vulnerabilities. The leaked dataset included a variety of personal information such as usernames, phone numbers, email addresses, and physical addresses. No passwords were exposed, and Meta (Instagram's parent company) denies that a system breach or new API compromise occurred, noting existing issues were promptly addressed and account security remains uncompromised. This case underscores the ongoing threat of data scraping and API abuse, where publicly accessible or insufficiently protected endpoints are targeted by cybercriminals. With the proliferation of social engineering attacks using scraped personal data and the repeated emergence of similar incidents across major platforms, the need for robust API security and user vigilance has never been greater.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
The Kimwolf & Aisuru Botnets: How Android TV Devices Fueled a Global Proxyware Crisis
Consumer Electronics10 months ago

The Kimwolf & Aisuru Botnets: How Android TV Devices Fueled a Global Proxyware Crisis

In late 2025, the Kimwolf and Aisuru botnets collectively compromised over two million Android TV streaming boxes by leveraging factory-installed or bundled proxy malware. Attackers, operating through channels like Discord and Telegram, conscripted these devices for DDoS attacks, ad fraud, and mass content scraping. Investigations revealed overlapping cybercriminal operators, shared infrastructure, and direct monetization via residential proxy services such as Plainproxies, Maskify, and ByteConnect. The illicit operations exploited minimal device security, used decentralized technologies like Ethereum Name Service (ENS) for resilient command-and-control, and took advantage of poorly regulated server resellers in the U.S. and Europe. The incident underscores a rapidly evolving threat landscape where IoT/OTT devices are prime targets for distributed, difficult-to-mitigate botnets fueled by proxyware and privacy-invasive apps. It highlights urgent needs for better supply-chain security, IoT device hardening, and more robust detection and segmentation strategies to counter stealthy lateral movement and monetization tactics now seen across botnet campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Inside Vercel’s 2025 React2Shell Race: Supply-Chain RCE and the Open Source Security Wake-up Call
Computer Software/Engineering10 months ago

Inside Vercel’s 2025 React2Shell Race: Supply-Chain RCE and the Open Source Security Wake-up Call

In late 2025, Vercel—maintainers of the popular Next.js framework—faced a critical cybersecurity incident involving the React2Shell vulnerability (CVE-2025-55182). Discovered just after Thanksgiving, this supply-chain flaw in React Server Components enabled unauthenticated remote code execution across multiple frameworks and bundlers in default configurations. A rapid, global response mobilized Vercel, open-source contributors, major cloud providers, and security vendors who coordinated mitigations and validated patches within days. Despite these efforts, over 60 organizations were compromised, with attackers from cybercriminal, ransomware, and nation-state groups exploiting disclosed weaknesses, leading to millions of exploit attempts and sustained attack volumes. The React2Shell episode highlighted the ongoing risks inherent in reliance on open-source components and the urgent need for collaborative, industry-wide response standards. Attackers have rapidly adopted similar techniques, sustaining high exploitation rates and revealing critical gaps in software supply-chain security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
D-Link Legacy Router Flaw Exploited: CVE-2026-0625 Zero-Day Endangers Networks
Telecommunications10 months ago

D-Link Legacy Router Flaw Exploited: CVE-2026-0625 Zero-Day Endangers Networks

In early January 2026, a critical security incident involving D-Link legacy DSL routers came to light as attackers actively exploited a command injection vulnerability tracked as CVE-2026-0625. The flaw, caused by improper input sanitization in the dnscfg.cgi endpoint of several out-of-support D-Link DSL gateway models, allowed unauthenticated remote attackers to execute arbitrary shell commands and potentially gain full control over affected devices. Although the exploit was first detected by Shadowserver Foundation honeypots, the method was not previously public, raising the risk of widespread attacks on consumer and small business network infrastructure. Impacted routers—including the DSL-526B, DSL-2640B, DSL-2740R, and DSL-2780B—are end-of-life and will not receive security updates, leaving users exposed unless devices are decommissioned or isolated. This incident highlights the persistent risks associated with legacy, unsupported network hardware across both consumer and SMB environments, particularly as attackers increasingly exploit unpatched, remotely accessible routers. It underscores the urgent importance of retiring end-of-life devices or segmenting critical networks, as well as the need for improved asset management strategies in the face of rising supply-chain and infrastructure vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Kimwolf Botnet’s 2024 Assault: How Residential Proxies Fueled Widespread Android Device Infections
Telecommunications10 months ago

Kimwolf Botnet’s 2024 Assault: How Residential Proxies Fueled Widespread Android Device Infections

In 2024, the Kimwolf Android botnet rapidly expanded to over two million infected hosts by exploiting vulnerabilities in residential proxy networks to penetrate internal devices. This botnet, an evolution of Aisuru malware, leverages residential IP addresses to mask malicious activity and facilitate lateral movement inside targeted networks. By abusing these proxies, Kimwolf can bypass perimeter defenses, execute command-and-control operations, and enable wide-scale internal compromise of Android and IoT devices, causing extensive disruption and exposing organizations to data theft, downtime, and potential extortion. Kimwolf highlights a growing threat: attackers are increasingly leveraging residential proxies and internal lateral movement tactics to amplify reach and evade detection. Its success underscores the need for improved egress filtering, network segmentation, and east-west traffic monitoring as threat actors adopt more sophisticated methods to breach internal assets.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Brightspeed Hit by Crimson Collective: Major 2026 Data Breach Exposes Customer PII
Telecommunications10 months ago

Brightspeed Hit by Crimson Collective: Major 2026 Data Breach Exposes Customer PII

In January 2026, Brightspeed, one of the largest fiber broadband providers in the United States, launched an investigation after the Crimson Collective extortion gang claimed to have breached the company’s networks and stolen sensitive data. The group asserted they had accessed personal and account-related information of over 1 million customers, including names, addresses, emails, phone numbers, payment histories, and some payment card details. The threat actors reportedly targeted user account systems and exfiltrated personally identifiable information (PII), subsequently pressuring Brightspeed to respond to their extortion demands by threatening to publish samples of the stolen data. This attack underscores the persistent risk posed by targeted data breaches in the telecom sector, where expansive networks and large customer bases make attractive targets for financially motivated threat actors. The incident further highlights a concerning trend: extortion groups are increasingly leveraging cloud misconfigurations, stolen credentials, and lateral movement within corporate environments to maximize data theft and pressure on organizations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Kimwolf Botnet Compromises 2 Million+ Android Devices via Exposed ADB in 2026
Telecommunications10 months ago

Kimwolf Botnet Compromises 2 Million+ Android Devices via Exposed ADB in 2026

In early 2026, the Kimwolf botnet orchestrated one of the largest Android targeting campaigns to date, infecting over 2 million devices. Attackers exploited exposed Android Debug Bridge (ADB) interfaces and abused residential proxy networks to establish persistent control and monetize the compromised devices. Synthient researchers revealed that Kimwolf operators maintained access for lateral movement, facilitated app installations, sold network bandwidth, and weaponized infected endpoints for DDoS attacks. The attack chain emphasized exploiting weak or default security configurations on Android devices, allowing broad propagation and quick monetization at scale. The Kimwolf botnet illustrates the evolving risk landscape for mobile endpoints and the increasing use of cloud or residential proxy infrastructure by cybercriminals. Given the speed and scale of infection, this case underscores the urgent need for stronger defense-in-depth strategies and highlights regulatory scrutiny on IoT and mobile security postures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
RondoDox Botnet Leverages React2Shell to Breach Next.js Servers
Computer Software/Engineering10 months ago

RondoDox Botnet Leverages React2Shell to Breach Next.js Servers

In early 2024, the RondoDox botnet launched widespread attacks targeting exposed Next.js servers by exploiting a vulnerability known as React2Shell. The threat actors leveraged this exploit to install cryptomining malware, enroll compromised enterprise and IoT devices into their botnet, and facilitate lateral movement across affected networks. The campaign demonstrates advanced threat sophistication, including rapid deployment of botnet payloads and persistent communication over encrypted channels, resulting in operational disruption and the risk of sensitive data exposure for impacted organizations. This incident underscores an uptick in supply chain and application-layer attacks, particularly on modern frameworks like Next.js. With attackers automating exploitation of recently disclosed vulnerabilities, organizations must prioritize patch management and adopt Zero Trust controls to defend against evolving botnet campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
SmarterMail 2025: Critical Pre-Auth File Upload Flaw Threatens Global Email Servers
Information Technology/IT10 months ago

SmarterMail 2025: Critical Pre-Auth File Upload Flaw Threatens Global Email Servers

In December 2025, Singapore's Cyber Security Agency (CSA) issued an alert concerning a critical pre-authentication vulnerability (CVE-2025-52691) in SmarterTools SmarterMail email servers. The flaw allows unauthenticated remote attackers to upload arbitrary files to any location on the server, leveraging an unvalidated GUID parameter for path traversal via the '/api/upload' endpoint. An attacker could exploit this for remote code execution, potentially resulting in full compromise of the server, with malicious files executed under system privileges. Although no in-the-wild exploitation has been confirmed, more than 16,000 vulnerable public-facing servers were identified globally. This incident underscores growing risks from exposed infrastructure and rapid exploitation of high-severity application flaws. With threat actors increasingly targeting business-critical communication platforms, organizations face mounting pressure to quickly remediate vulnerabilities and bolster segmentation and detection capabilities in line with zero trust frameworks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Evasive Panda APT Uses DNS Poisoning for Prolonged Espionage: 2022–2024 Campaign
Telecommunications10 months ago

Evasive Panda APT Uses DNS Poisoning for Prolonged Espionage: 2022–2024 Campaign

Between November 2022 and November 2024, the China-linked Evasive Panda APT group conducted a sophisticated cyber espionage campaign targeting entities in Türkiye, China, and India. The attackers leveraged DNS poisoning techniques to redirect requests for popular software updates (such as SohuVA and Tencent QQ) to attacker-controlled infrastructure. Through adversary-in-the-middle attacks, victims received trojanized loaders, which proceeded to fetch and decrypt highly targeted MgBot backdoors. The attack chain involved supply chain and AitM vectors, advanced encryption and obfuscation methods, and allowed persistent compromise and broad data theft, including keylogging and credential exfiltration. This campaign highlights the growing sophistication of APT operations exploiting core network infrastructure such as DNS to evade perimeter defenses. The increased prevalence of similar DNS-manipulation campaigns and targeted malware delivery emphasizes the urgent need for robust segmentation, encrypted traffic, and thorough network and endpoint visibility.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Evasive Panda: APT Delivers MgBot via DNS Poisoning in Asia (2022–2024)
Telecommunications10 months ago

Evasive Panda: APT Delivers MgBot via DNS Poisoning in Asia (2022–2024)

Between November 2022 and November 2024, the Evasive Panda APT group executed a sophisticated campaign targeting victims primarily in Türkiye, China, and India. Leveraging adversary-in-the-middle (AitM) techniques and DNS poisoning, the attackers delivered a unique MgBot malware implant through fake software updates and stealthy loaders. The operation employed hybrid encryption, memory injection in signed executables, and evaded traditional defenses to maintain long-term persistence. Multiple new and legacy C2 infrastructures enabled sustained access while attackers tailored payloads based on the victim’s OS. This incident showcases the ongoing evolution of nation-state threat actors, utilizing advanced evasion, supply chain impersonation, and DNS manipulation to bypass security controls. It reflects a broader surge in attacks exploiting trust in software supply chains and underlines the need for continuously adaptive security strategies as actor sophistication grows.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports