The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Management Consulting
Breach intelligence, attack campaigns, and threat reports targeting the Management Consulting sector.
Explore Other Sectors
Management Consulting Threat Reports
N0va Phishing Campaign Exploits Trusted Business Platforms to Compromise Enterprise Identities
The N0va phishing campaign has emerged as a sophisticated threat targeting organizations across North America and Europe in 2026, focusing on government, technology, consulting, and healthcare sectors. Unlike traditional phishing attacks, N0va impersonates trusted business platforms including Microsoft Teams, SharePoint, OneDrive, DocuSign, and Google Drive, then guides victims through legitimate authentication flows to capture access and refresh tokens. Once successful, attackers abuse token-exchange mechanisms to establish SSO access across corporate resources, enabling access to email, files, and cloud applications without deploying obvious malware. The campaign's use of legitimate authentication processes and trusted brand impersonation makes detection challenging and can lead to significant financial losses, data exposure, operational disruption, and compliance violations. This incident highlights the evolving sophistication of identity-based attacks that exploit trust in legitimate business platforms and authentication mechanisms, representing a growing trend where attackers move beyond traditional malware deployment to abuse valid business processes for initial access and persistence.
1 week ago
Kill Chain
Critical N-able N-central RCE Vulnerability Exploited: MSP Supply Chain Under Attack
In September 2026, CISA added CVE-2026-86218, a maximum-severity remote code execution vulnerability in N-able N-central, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation in the wild. The pre-authentication static code injection flaw allows attackers to execute arbitrary code without authentication on N-central servers, which are widely used by managed service providers (MSPs) and large IT organizations to manage entire customer environments. Huntress reported investigating a compromise of a customer's fully patched N-central production environment, though the exact exploit vector remains unclear. The vulnerability was patched in N-central 2026.3 Hotfix 4, but organizations must also hunt for indicators of compromise as patching alone may be insufficient. This incident highlights the escalating threat to MSP infrastructure as ransomware groups increasingly target supply chain chokepoints to maximize their reach across multiple organizations simultaneously.
2 weeks ago
Kill Chain
Scottish Government Data Breach: Lessons in Third-Party Security
In August 2026, Scotland's Crown Office and Procurator Fiscal Service (COPFS) disclosed a data breach involving an external supplier managing an online data maturity assessment. The breach exposed personal information of approximately 300 employees, including names, roles, and work email addresses. The incident was detected on August 5, 2026, when the third-party noticed suspicious activity on its network. While COPFS's case-related data remained unaffected, the breach raises concerns about the security of third-party vendors handling sensitive government information. This incident underscores the growing risks associated with third-party service providers in the public sector. As government agencies increasingly rely on external vendors for data management and assessments, ensuring robust security measures and continuous monitoring of these partners becomes imperative to prevent unauthorized access and data breaches.
1 month ago
Kill Chain
Critical N-able N-central Vulnerability Exploited: Immediate Action Required
In August 2026, N-able's N-central platform, widely used by Managed Service Providers (MSPs) for remote IT management, was found to have a critical vulnerability (CVE-2026-18577) that allowed unauthenticated attackers to gain full administrative access. Exploiting this flaw, attackers could run scripts, deploy tools, and open remote sessions across all managed endpoints. The vulnerability stemmed from an incomplete fix of a previous issue (CVE-2026-18556). N-able released Hotfix 2 to address this, urging all on-premise users to apply the patch immediately. Hosted instances received automatic updates. Organizations were also advised to monitor their environments closely for signs of compromise. ([itpro.com](https://www.itpro.com/security/cyber-attacks/msps-urged-to-patch-immediately-after-n-able-issues-hotfix-for-n-central-god-mode-flaw?utm_source=openai)) This incident underscores the critical importance of timely patch management and vigilant monitoring in IT environments. The rapid exploitation of such vulnerabilities highlights the evolving tactics of threat actors and the necessity for organizations to stay ahead with proactive security measures.
1 month ago
Kill Chain
UNC6671's Vishing Tactics: A Wake-Up Call for SaaS Security
In early 2026, the financially motivated threat group UNC6671, operating under the 'BlackFile' brand, initiated a series of sophisticated voice phishing (vishing) attacks targeting employees' personal mobile devices. Posing as internal IT support, the attackers directed victims to fraudulent login portals designed to harvest credentials and multi-factor authentication (MFA) tokens. Utilizing adversary-in-the-middle (AiTM) techniques, UNC6671 gained unauthorized access to cloud environments, including Microsoft 365 and Okta, and exfiltrated sensitive data using automated scripts. The stolen information was then leveraged for extortion, with demands often reaching seven figures. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/?utm_source=openai)) This campaign underscores a significant shift in cyberattack methodologies, emphasizing the exploitation of human factors over technical vulnerabilities. The success of UNC6671's operations highlights the critical need for organizations to implement phishing-resistant MFA solutions and enhance employee awareness to mitigate social engineering threats. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/?utm_source=openai))
1 month ago
Kill Chain
Critical Vulnerabilities in TP-Link Omada ZTP Mechanism Pose Security Risks
In August 2026, TP-Link addressed 15 vulnerabilities in the Zero-Touch Provisioning (ZTP) mechanism of its Omada network devices, as disclosed by Forescout’s Vedere Labs at the Black Hat USA security conference. These flaws, encompassing hard-coded cryptographic keys, information disclosure, remote code execution, and device hijacking, could be exploited to infiltrate networks by compromising Omada’s chain of trust. Notably, attackers could combine these vulnerabilities with previously identified command-injection flaws (CVE-2025-7850 and CVE-2025-7851) to achieve remote code execution. The affected products include Omada Controllers, Gateways, Switches, Access Points, OLT platforms, Cloud services, and TP-Link mobile applications. This incident underscores the critical importance of securing network infrastructure, especially as routers and switches have become primary threat vectors, surpassing traditional endpoints. Organizations are urged to promptly apply firmware updates, enforce strong authentication measures, and monitor network traffic to mitigate potential exploits stemming from these vulnerabilities.
1 month ago
Kill Chain
Ernst & Young's 2026 Data Breach: A Supply Chain Attack by ShinyHunters
In April 2026, Ernst & Young (EY) detected unauthorized access to a third-party IT service management platform used for client tax services. The breach occurred between March 28 and April 12, 2026, during which attackers downloaded multiple documents containing personal and financial information related to client tax filings. EY secured its systems, removed unauthorized access, and notified federal law enforcement. Affected clients were offered 24 months of identity monitoring and restoration services through Experian. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-data-breach-claimed-by-shinyhunters-extortion-gang/?utm_source=openai)) On July 27, 2026, the ShinyHunters extortion gang claimed responsibility for the breach, alleging they obtained EY credentials via a supply-chain attack. They threatened to release the stolen data if EY did not contact them by July 31, 2026. EY has not confirmed ShinyHunters' involvement. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-data-breach-claimed-by-shinyhunters-extortion-gang/?utm_source=openai))
1 month ago
Kill Chain
Ernst & Young Data Breach Exposes Client Tax Information in 2026
In April 2026, Ernst & Young (EY) identified unauthorized access to a third-party IT service management platform used for client tax services. The breach occurred between March 28 and April 12, 2026, during which attackers downloaded documents containing personal and financial information used in tax filings. EY promptly secured the affected systems, notified federal law enforcement, and offered 24 months of identity monitoring services to impacted clients. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-discloses-data-breach-after-support-system-hack/?utm_source=openai)) This incident underscores the critical need for robust third-party risk management, especially as organizations increasingly rely on external platforms for sensitive operations. The breach highlights the importance of continuous monitoring and rapid response strategies to mitigate potential damages from such compromises.
2 months ago
Kill Chain
Accenture Confirms Data Breach After Hacker Offers Stolen Data for Sale
In July 2026, Accenture, a global professional services company, confirmed a security breach after a threat actor known as "888" claimed to have stolen 35 GB of data, including source code, RSA keys, SSH keys, Azure personal access tokens, Azure Storage access keys, and configuration files. The threat actor began offering this data for sale on a cybercrime forum. Accenture stated that they were aware of the incident, had remediated its source, and that there was no impact on their operations and service delivery. However, the company did not disclose how the attackers gained access or whether customer data was affected. This incident underscores the persistent threat posed by cybercriminals targeting large enterprises for sensitive data. The exposure of source code and access keys can lead to further exploitation, including intellectual property theft and potential supply chain attacks. Organizations must remain vigilant, continuously assess their security postures, and implement robust measures to protect against such breaches.
2 months ago
Kill Chain
Salesforce Disables Klue App Integration Following OAuth Token Abuse Incident
In June 2026, Salesforce detected unauthorized access to customer data through the Klue Battlecards app integration. Threat actors exploited OAuth tokens associated with the app to gain access to sensitive information within Salesforce instances. Upon discovery, Salesforce promptly disabled the Klue app integration to prevent further data exposure and initiated a comprehensive investigation into the breach. This incident underscores the escalating threat posed by OAuth token abuse, a technique increasingly leveraged by cybercriminals to bypass traditional authentication mechanisms. Organizations must remain vigilant and implement robust security measures to safeguard against such sophisticated attacks.
3 months ago
Kill Chain
Klue OAuth Breach 2026: A Wake-Up Call for Third-Party Integration Security
In June 2026, market intelligence platform Klue experienced a security breach where attackers, identified as the 'Icarus' group, exploited OAuth tokens to access and exfiltrate Salesforce CRM data from multiple organizations. The attackers infiltrated Klue's backend systems, deployed malicious code to harvest OAuth tokens, and utilized these tokens to query and extract sensitive data from connected Salesforce instances. This incident led to significant data theft and subsequent extortion attempts targeting the affected organizations. This breach underscores the critical vulnerabilities associated with third-party integrations and the exploitation of OAuth tokens. It highlights the necessity for organizations to implement stringent security measures, including regular audits of third-party applications, prompt revocation of compromised tokens, and continuous monitoring of API activities to detect and mitigate unauthorized access promptly.
3 months ago
Kill Chain
UNC3753's 2026 Data Theft Campaign: A Blend of Vishing and Physical Intrusions
Between January and May 2026, the threat actor UNC3753, also known as Chatty Spider, Luna Moth, and Silent Ransom Group (SRG), targeted numerous U.S. organizations in the professional, legal, and financial sectors. Utilizing voice phishing (vishing) and social engineering tactics, they impersonated IT support to gain remote access via screen-sharing sessions and remote monitoring tools. In some cases, attackers physically infiltrated offices, posing as IT technicians to exfiltrate data using USB devices. Stolen information included proprietary legal agreements, personally identifiable information (PII), and financial records. The group rapidly demanded ransoms, threatening to publish the stolen data if payments were not made promptly. This incident underscores the evolving tactics of cybercriminals, combining traditional social engineering with physical intrusion methods. The rapid execution of these attacks, often completed within a single business day, highlights the need for organizations to enhance their security awareness training and implement robust verification processes for IT support interactions.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports