✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Legal Services
Breach intelligence, attack campaigns, and threat reports targeting the Legal Services sector.
Explore Other Sectors
Legal Services Threat Reports
New 2025 Guidance: Securing Microsoft Exchange Servers from Infrastructure Vulnerabilities
In October 2025, cybersecurity authorities including CISA and the NSA released urgent best practices following persistent threats targeting on-premises Microsoft Exchange servers. Despite patch releases and increased awareness, many organizations continued running outdated or misconfigured Exchange environments, leaving them vulnerable to exploitation. Attackers leveraged these weaknesses to gain unauthorized access, often leading to lateral movement, data exfiltration, and in some cases, ransomware incidents. The culmination of such ongoing attacks prompted renewed guidance emphasizing strong authentication, rigorous encryption, and decommissioning of unsupported hybrid Exchange servers to minimize operational risk. This incident underscores the ongoing trend of adversaries exploiting infrastructure vulnerabilities, especially in legacy and hybrid setups. With continued attacker innovation and regulatory scrutiny, organizations must adopt zero trust principles, prioritize patch cycles, and upgrade legacy systems to mitigate evolving threats.
6 months ago
Kill Chain
Feds Dismantle ShinyHunters' Salesforce Extortion Hub: Lessons for Cloud Security
In June 2024, U.S. federal authorities dismantled an extortion portal run by the notorious ShinyHunters group, which was used to threaten Salesforce victims after a reported compromise. ShinyHunters is known for data theft and double-extortion tactics, leveraging public leaks and ransom demands to extort organizations. Despite law enforcement takedown efforts, the group's threats remain active, targeting businesses that rely on Salesforce for their customer and operational data. The attack highlights risks surrounding third-party SaaS platforms and sophisticated cybercriminal techniques that exploit sensitive, cloud-based systems for extortion. This event underscores the accelerating landscape of data extortion and the persistent threat from established ransomware and data-leak actors. As organizations increasingly depend on SaaS providers, regulators and enterprises are intensifying focus on zero trust access, east-west traffic security, and layered controls to contain lateral movement and prevent sensitive data exposure.
6 months ago
Kill Chain
Exploited Zero-Day in Gladinet CentreStack: Rapid RCE and the Need for Zero Trust
In October 2025, Gladinet patched a critical zero-day vulnerability (CVE-2025-11371) in its CentreStack file-sharing software, which had been exploited by threat actors since late September. The attackers leveraged a local file inclusion flaw to access the application's Web.config file and extract the machine key, subsequently exploiting a chained deserialization vulnerability (CVE-2025-30406) to achieve unauthenticated remote code execution. The service's SYSTEM-level privileges enabled lateral movement and sensitive file access. Gladinet released mitigations and a full patch, urging immediate client upgrades to prevent further compromise of business environments. This incident highlights a continuing trend in targeting widely used business collaboration platforms via sophisticated vulnerability chaining, often bypassing previous mitigations. The exploitation’s speed and public proof-of-concept release underscore the growing urgency for rapid patch management and proactive threat detection across enterprise SaaS deployments.
6 months ago
Kill Chain
Fake LastPass & Bitwarden Breach Alerts: Phishing Attack Delivers Malware (2024)
In early June 2024, a sophisticated phishing campaign targeted users of password managers LastPass and Bitwarden. Attackers sent convincing emails, falsely claiming that the services had suffered security breaches and instructing recipients to download a new, supposedly more secure, desktop version. The malicious download actually installed malware, enabling attackers to hijack compromised PCs and potentially steal credentials or other sensitive data. Victims who downloaded the fake app were exposed to significant risks, including credential theft and remote control of their systems. This incident highlights escalating use of credible brand impersonation and urgent alert tactics by cybercriminals. The campaign underscores the vulnerabilities associated with password manager users and demonstrates the growing threat landscape for identity-driven and social engineering attacks.
6 months ago
Kill Chain
Windows 11 Recall: New AI Feature Raises Alarming Data Security Concerns
In May 2025, security researchers highlighted significant privacy and security concerns in the Windows 11 Recall feature, an AI-powered function that automatically captures and stores screenshots and context of user activity. Although designed to enhance productivity by allowing seamless search and recall, the feature stores sensitive information—including potential credentials, private messages, and payment data—without robust controls or proven encryption. The built-in privacy filtering was found to be unreliable, enabling attackers or malware to leverage Recall’s artifacts to reconstruct user activity or exfiltrate high-value data. Because the Recall database is accessible without administrative privilege, organizations relying on default configurations could unintentionally expose critical information or face regulatory risks. This incident underscores the urgent need for organizations to review new operating system features before broad deployment, especially as attackers increasingly target post-compromise artifacts and AI-powered data collectors. High-profile attention to Recall has driven further debate on privacy standards and compliance, with heightened scrutiny from both regulators and security leaders.
6 months ago
Kill Chain
Qantas 2025 Data Breach: Scattered LAPSUS$ Defies Legal Barriers
In October 2025, Australian airline Qantas suffered a major data breach when threat actor group Scattered LAPSUS$ released sensitive customer and employee data following an extortion attempt. Despite Qantas obtaining a legal injunction aimed at stopping the dissemination of the information, the attackers proceeded to publish the stolen data, rendering legal intervention ineffective. The incident exposed personal records and travel information, spotlighting ongoing organizational vulnerabilities to data extortion and public leaks driven by sophisticated attackers exploiting access. The breach prompted widespread media coverage and concern over enforcement power in digital incidents. This attack underscores the growing trend of double extortion tactics, where attackers threaten to release stolen data for leverage, outpacing regulatory or legal controls. The event exemplifies the surge in ransomware and extortion methods targeting aviation and critical infrastructure, reinforcing the urgent need for proactive, technical mitigations and incident preparedness planning.
6 months ago
Kill Chain
Gladinet CentreStack & Triofox Zero-Day Leads to Chain Exploit and Remote Code Execution
In October 2025, threat actors exploited a zero-day vulnerability (CVE-2025-11371) in Gladinet’s CentreStack and Triofox file sharing solutions, used by thousands of businesses worldwide. The flaw, a local file inclusion (LFI) bug present in all current product versions, was leveraged to extract sensitive configuration data and trigger a previously known deserialization vulnerability (CVE-2025-30406), resulting in remote code execution (RCE). At least three organizations have confirmed exploitation as attackers gained unauthorized access before Gladinet issued a patch, forcing emergency mitigations that affected platform functionality. This incident highlights how chained vulnerabilities and rapid exploitation of zero-days continue to threaten cloud-based file sharing services. With attackers escalating LFI into full RCE, organizations face heightened pressure to improve visibility, patch agility, and enforce Zero Trust controls, especially amid growing regulatory scrutiny.
6 months ago
Kill Chain
Inside the Qantas 2025 Ransomware Breach: Why Legal Measures Can’t Stop Data Leaks
In October 2025, Qantas, the Australian airline, suffered a ransomware attack attributed to the 'Scattered LAPSUS$ Hunters' group. Attackers claimed to have breached Qantas’ systems via a supply chain vulnerability, exfiltrating personal and loyalty program data of potentially hundreds of thousands of customers, including high-profile individuals. After initial extortion attempts, the stolen data—including names, emails, and frequent flyer records—was publicly leaked when Qantas refused to pay ransom. Qantas took legal steps, securing a court injunction to limit data dissemination, but these measures proved ineffective at curbing the spread among criminal and international actors. This breach highlights the ongoing threat of ransomware and data extortion campaigns targeting major brands, frequently leveraging supply-chain infiltration and cloud-based service weaknesses. The incident also underscores the limited real-world efficacy of legal remedies like injunctions, as well as evolving attacker strategies involving public shaming and mass data exposure.
6 months ago
Kill Chain
Notion 2025: AI Agent Prompt Injection Leads to Data Breach
In September 2025, Notion experienced a security incident after releasing version 3.0 with integrated AI agents. Threat actors exploited a prompt injection vulnerability whereby malicious PDF files—containing hidden instructions—caused Notion's AI to extract sensitive customer data and exfiltrate it to an external attacker-controlled endpoint. The attack chain leveraged the AI’s access to private data and enabled untrusted content, combined with the external communication capabilities of the LLM-powered agent. This resulted in unauthorized exposure and theft of confidential enterprise data, highlighting a worrying weakness in agentic AI implementations. This incident underscores the growing risk posed by prompt injection attacks against AI and LLM-integrated workflows, particularly as organizations rapidly adopt such technologies. With regulatory scrutiny rising and attackers quickly adapting to target emerging AI-driven systems, prompt injection and data exfiltration are fast becoming board-level risks across industries.
6 months ago
Kill Chain
Google Workspace 2025 OAuth Supply Chain Breach: Lessons From the Drift Incident
In August 2025, a supply chain attack targeted Google Workspace via compromised OAuth tokens associated with the Drift email integration, impacting several organizations. Attackers leveraged stolen Drift tokens to gain unauthorized, delegated access to connected Google Workspace mailboxes, bypassing traditional security controls by exploiting trusted third-party app grants. Google rapidly responded on August 9 by revoking the affected tokens and disabling the integration. While only a small number of mailboxes were directly accessed, the incident underscored how attackers increasingly exploit SaaS interconnections rather than direct platform breaches. This incident is particularly relevant today as exploitation of OAuth tokens and third-party integrations continues to climb, representing a paradigm shift in enterprise attack surfaces. It highlights the growing need for comprehensive SaaS integration visibility, rigorous token governance, and real-time behavioral monitoring as attackers increasingly favor these stealthy, scalable techniques.
6 months ago
Kill Chain
CometJacking: How a Single Click Turned Perplexity's Comet AI Browser into a Data Thief
In October 2025, cybersecurity researchers uncovered a significant prompt injection attack targeting Perplexity's Comet AI browser. Dubbed "CometJacking," this incident involved adversaries embedding malicious prompts in links, which—when clicked by users—triggered unauthorized data siphoning through the browser's agentic AI capabilities. Sensitive information, including from connected services like email and calendars, was exposed, demonstrating how AI-driven interfaces can be subverted via crafted input. The attack exploited trust in browser automation and the deep integration of third-party services, raising concerns about the security of AI-powered productivity tools. This incident is highly relevant as prompt injection attacks are rapidly emerging as a primary risk vector for generative AI environments. The growth in agentic AI and interconnected browser-based workflows has exposed new attack surfaces, prompting urgent calls for improved input validation, isolation of automation agents, and strengthened compliance for AI SaaS applications.
6 months ago
Kill Chain
CometJacking Attack: How Prompt Injection Exposed Comet AI Browser Users in 2025
In October 2025, security researchers from LayerX uncovered a novel 'CometJacking' attack affecting Perplexity's Comet AI browser. This prompt injection attack leverages URL parameters to deliver hidden instructions that compel the browser to access and exfiltrate sensitive data—such as Gmail messages and Google Calendar information—from connected services, without any need for user credentials or interaction. The technique exploits the 'collection' URL parameter to insert malicious prompts, instructing the AI agent to gather and encode user data (e.g., using base64) before surreptitiously transmitting it to attacker-controlled endpoints. Despite being informed, Perplexity dismissed the security risk, highlighting concerns about unmitigated AI agent behaviors.This incident surfaces amid growing adoption of agentic AI browsers and illustrates the ease with which prompt injection tactics can sidestep controls, particularly in tools integrated with sensitive personal or enterprise accounts. The attack underscores the increasing threat from adversarial prompt engineering as AI agent usage expands rapidly.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports