The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Internet
Breach intelligence, attack campaigns, and threat reports targeting the Internet sector.
Explore Other Sectors
Internet Threat Reports
AI-Driven Cyber Threats Targeting 2026 Election Campaign Systems
In the lead-up to the 2026 midterm elections, cybersecurity threats have increasingly targeted the digital infrastructure of political campaigns, including email accounts, websites, and fundraising platforms. A report by Check Point Software Technologies highlights that 82% of malicious attacks arrive through email, with significant numbers of stolen passwords from major fundraising sites like ActBlue and WinRed. Additionally, threat actors have registered numerous election-related domains, potentially for phishing scams. The use of AI has lowered the barrier to entry for attackers, enabling more realistic and effective attacks. ([cyberscoop.com](https://cyberscoop.com/2026-election-cyber-threats-campaign-systems/?utm_source=openai)) This trend underscores a broader shift in the cyber threat landscape, where attackers are leveraging AI to enhance the scale and sophistication of their operations. The focus on campaign systems, rather than voting machines, highlights the need for comprehensive security measures across all facets of the electoral process to safeguard democratic institutions.
3 months ago
Kill Chain
Tennessee Man Indicted for Child Exploitation Linked to Extremist Group '764'
In May 2026, Zachary Sweeney, a 30-year-old from Columbia, Tennessee, was indicted on multiple counts of child sexual exploitation. Sweeney allegedly groomed and coerced minors into producing child sexual abuse material (CSAM), which he distributed and, in some cases, sold. His activities, dating back to at least 2022, included traveling across several states to meet victims in person, where he reportedly drugged, raped, and filmed sexual acts with minors. Sweeney's involvement with the nihilistic violent extremist group '764' underscores the group's exploitation of vulnerable individuals to further their agenda of societal destabilization. ([justice.gov](https://www.justice.gov/usao-mdtn/pr/nashville-man-connected-nihilistic-violent-extremist-nve-group-indicted-sexual?utm_source=openai)) This case highlights the persistent and evolving threat posed by online extremist networks that exploit digital platforms to perpetrate and disseminate CSAM. The intersection of violent extremism and child exploitation necessitates heightened vigilance and coordinated efforts among law enforcement agencies to combat these multifaceted crimes.
3 months ago
Kill Chain
Dutch Authorities Dismantle Massive 17 Million-Device Botnet
In May 2026, Dutch authorities dismantled a massive botnet comprising 17 million infected devices, including computers, tablets, and smartphones. The operation involved seizing over 200 servers located in the Netherlands that controlled the botnet's infrastructure. This network was utilized for various cyberattacks, such as distributed denial-of-service (DDoS) attacks and malicious traffic proxying. The botnet was linked to a service called Asocks, which offered proxy services using compromised devices without the owners' knowledge. This incident underscores the growing threat posed by botnets leveraging residential devices, highlighting the need for enhanced security measures to protect consumer hardware from unauthorized exploitation.
3 months ago
Kill Chain
The Rise of DDoS-as-a-Service: Implications for Cybersecurity
In May 2026, cybersecurity researchers highlighted the rapid evolution of the DDoS-as-a-Service market, where Distributed Denial-of-Service (DDoS) attacks are commoditized and sold as services. This transformation has led to a significant increase in the scale and sophistication of DDoS attacks, exemplified by Cloudflare's mitigation of a record-breaking 31.4 Tbps attack in late 2025. The Aisuru-Kimwolf botnet, comprising millions of compromised devices, was identified as a primary source of these hyper-volumetric attacks, targeting various industries and critical infrastructure. ([blog.cloudflare.com](https://blog.cloudflare.com/ddos-threat-report-2025-q4?utm_source=openai)) The commodification of DDoS services has lowered the barrier to entry for cybercriminals, enabling even those with limited technical expertise to launch large-scale attacks. This trend underscores the urgent need for organizations to enhance their cybersecurity defenses and adopt proactive measures to mitigate the growing threat posed by DDoS-as-a-Service platforms.
3 months ago
Kill Chain
JINX-0164's Sophisticated Attack on Cryptocurrency Firms
In mid-2025, a previously unidentified threat actor, JINX-0164, initiated a campaign targeting cryptocurrency organizations. Utilizing sophisticated social engineering tactics, the attackers posed as recruiters on LinkedIn, inviting victims to virtual meetings on counterfeit domains resembling legitimate teleconference services. During these meetings, victims were deceived into downloading a malicious file disguised as a meeting client, leading to the installation of a Python-based macOS malware named AUDIOFIX. This malware harvested sensitive data, including credentials from password managers, web browsers, and cryptocurrency wallet extensions, and facilitated lateral movement within the organizations' development infrastructure. ([thehackernews.com](https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html?utm_source=openai)) The campaign's relevance persists due to the increasing sophistication of social engineering attacks targeting the cryptocurrency sector. The use of custom macOS malware and the focus on compromising development pipelines underscore the evolving tactics of financially motivated threat actors. Organizations must remain vigilant against such multifaceted attacks to safeguard their digital assets. ([thehackernews.com](https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html?utm_source=openai))
3 months ago
Kill Chain
CISA Mandates Urgent Patching of LiteSpeed cPanel Plugin Vulnerability CVE-2026-48172
In May 2026, a critical privilege escalation vulnerability, CVE-2026-48172, was discovered in the LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4. This flaw allows unauthenticated remote attackers to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function, which mishandles Redis enable/disable features. The vulnerability has been actively exploited in the wild, leading to full system compromises on affected servers. LiteSpeed released urgent security updates to address the issue, urging users to update to version 2.4.5 or later. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-48172/?utm_source=openai)) The exploitation of CVE-2026-48172 underscores the critical importance of timely patch management and the need for robust privilege assignment mechanisms in web hosting environments. The incident highlights the potential risks associated with shared hosting platforms, where a single compromised account can lead to server-wide breaches. Organizations are advised to prioritize the implementation of security patches and to conduct thorough audits of their systems to prevent similar vulnerabilities from being exploited.
4 months ago
Kill Chain
Glassworm Botnet Disrupted After Resilient C2 Infrastructure Takedown
In May 2026, a coordinated operation by CrowdStrike, Google, and The Shadowserver Foundation successfully disrupted the Glassworm botnet, which had been targeting software developers through the open-source supply chain since October 2025. The botnet employed resilient command-and-control (C2) infrastructure utilizing Solana blockchain transactions, BitTorrent Distributed Hash Table (DHT), Google Calendar events, and traditional virtual private servers (VPS). This sophisticated architecture enabled Glassworm to persistently deliver malicious payloads, compromising over 300 GitHub repositories and numerous npm packages, thereby posing significant risks to software supply chains. The takedown underscores a critical shift in cyber threats, with adversaries increasingly focusing on developers to infiltrate and compromise software supply chains. This incident highlights the necessity for enhanced security measures within development environments and the importance of safeguarding open-source ecosystems against such sophisticated attacks.
4 months ago
Kill Chain
Critical Privilege Escalation Vulnerability in LiteSpeed cPanel Plugin (CVE-2026-48172)
In May 2026, a critical privilege escalation vulnerability, CVE-2026-48172, was discovered in the LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4. This flaw allows authenticated cPanel users to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function. The vulnerability has been actively exploited in the wild, leading to unauthorized root-level access on affected servers. LiteSpeed has released version 2.4.5 to address this issue, and users are strongly advised to update immediately. ([thehackernews.com](https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html?utm_source=openai)) The exploitation of CVE-2026-48172 underscores the persistent threat posed by privilege escalation vulnerabilities in widely used web hosting platforms. This incident highlights the critical need for timely patching and vigilant monitoring of server environments to prevent unauthorized access and potential system compromises.
4 months ago
Kill Chain
Critical Vulnerability in LiteSpeed cPanel Plugin Exploited for Root Access
In May 2026, a critical vulnerability (CVE-2026-48172) was discovered in the LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4, allowing attackers to execute arbitrary scripts with root privileges. This flaw, stemming from incorrect privilege assignment in the 'lsws.redisAble' function, has been actively exploited in the wild, posing significant risks to affected systems. LiteSpeed has addressed this issue in version 2.4.5 and recommends immediate updates to mitigate potential threats. ([thehackernews.com](https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html?utm_source=openai)) The exploitation of this vulnerability underscores the persistent threat posed by privilege escalation attacks, emphasizing the need for organizations to maintain rigorous patch management practices. As cyber threats continue to evolve, staying vigilant and promptly addressing known vulnerabilities is crucial to safeguarding system integrity and data security.
4 months ago
Kill Chain
Dutch Authorities Dismantle Hosting Firm Enabling Cyberattacks
In May 2026, the Dutch Fiscal Information and Investigation Service (FIOD) arrested two individuals and seized 800 servers associated with Stark Industries, a web hosting company implicated in facilitating cyberattacks, interference operations, and disinformation campaigns. The suspects, aged 57 and 39, were linked to providing infrastructure that supported actions undermining democracy and security, including information manipulation and disruption of public and economic systems. Stark Industries, founded in February 2022, was added to the European Union's list of sanctioned entities in May 2025. Following the sanctions, the company's infrastructure was transferred to a newly established Dutch entity, WorkTitans B.V., operating under the brand THE.Hosting, which investigators believe acted as a front for the sanctioned organization. The FIOD's coordinated raids in Dronten, Schiphol-Rijk, Enschede, and Almere resulted in the confiscation of servers, laptops, phones, and administrative records. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/netherlands-seizes-800-servers-of-hosting-firm-enabling-cyberattacks/amp/?utm_source=openai)) This incident underscores the persistent threat posed by cybercriminals leveraging hosting services to conduct malicious activities. The involvement of entities like WorkTitans B.V. highlights the challenges in enforcing sanctions and the need for continuous vigilance against infrastructure providers that may serve as conduits for cyberattacks. Organizations must remain proactive in monitoring and securing their networks against such threats.
4 months ago
Kill Chain
Arrest of Kimwolf Botnet Operator Highlights IoT Security Risks
In May 2026, Canadian authorities arrested Jacob Butler, known online as "Dort," for allegedly creating and operating the Kimwolf botnet. This botnet infected millions of Internet-of-Things (IoT) devices, such as digital photo frames and web cameras, to execute massive distributed denial-of-service (DDoS) attacks. Some of these attacks reached nearly 30 terabits per second, causing financial losses exceeding one million dollars for certain victims. The U.S. Department of Justice has charged Butler with aiding and abetting computer intrusion, and he faces potential extradition to the United States. ([krebsonsecurity.com](https://krebsonsecurity.com/2026/05/alleged-kimwolf-botmaster-dort-arrested-charged-in-u-s-and-canada/?utm_source=openai)) The Kimwolf botnet's unprecedented scale and impact underscore the growing threat posed by IoT-based cyberattacks. This incident highlights the critical need for enhanced security measures in IoT devices and increased international cooperation to combat cybercrime effectively.
4 months ago
Kill Chain
Kimwolf DDoS Botnet Operator Arrested in Canada
In May 2026, Jacob Butler, a 23-year-old from Ottawa, Canada, was arrested for allegedly operating the Kimwolf botnet, a variant of the AISURU botnet. Kimwolf infected over a million IoT devices, including digital photo frames and web cameras, to execute massive distributed denial-of-service (DDoS) attacks. These attacks targeted global computers and servers, notably impacting the U.S. Department of Defense Information Network (DoDIN) with record-breaking volumes nearing 30 terabits per second. The botnet's operations resulted in significant financial losses, with some victims reporting damages exceeding one million dollars. ([justice.gov](https://www.justice.gov/usao-ak/pr/canadian-man-arrested-international-authorities-charged-administrating-kimwolf-ddos?utm_source=openai)) This incident underscores the escalating threat posed by IoT-based botnets and the critical need for robust cybersecurity measures. The arrest highlights the effectiveness of international collaboration in combating cybercrime, yet it also serves as a reminder of the persistent vulnerabilities within IoT ecosystems that can be exploited for large-scale attacks.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports