Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Management Consulting

Breach intelligence, attack campaigns, and threat reports targeting the Management Consulting sector.

27 threat reports
Page 1 of 3
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Management Consulting Threat Reports

Showing 1–12 / 27 reports
Fake AI Malware Campaigns Target 1,258 US Companies in 2026
Fake AI Malware Campaigns Target 1,258 US Companies in 2026
Computer Software/Engineering3 weeks ago

Fake AI Malware Campaigns Target 1,258 US Companies in 2026

Between April and October 2026, cybercriminals launched sophisticated fake AI campaigns targeting US businesses, with attackers impersonating popular AI services like Claude, ChatGPT, GitHub Copilot, and Gemini to distribute infostealer malware. ANY.RUN identified 1,258 public sandbox analyses linked to these campaigns, with US companies accounting for 16% of targeted victims. The attacks used deceptive download pages and malicious PowerShell commands to steal browser sessions, compromise business accounts, and establish persistent access to corporate networks through legitimate-appearing AI software installations. These campaigns represent a significant evolution in social engineering tactics, exploiting the widespread adoption of AI tools in enterprise environments to bypass traditional security awareness training and detection mechanisms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AhsayCBS Zero-Day Chain Enables Stealthy Crypto Mining Campaign
AhsayCBS Zero-Day Chain Enables Stealthy Crypto Mining Campaign
Information Technology/IT1 month ago

AhsayCBS Zero-Day Chain Enables Stealthy Crypto Mining Campaign

In October 2026, threat actors exploited two unpatched vulnerabilities in AhsayCBS backup management platform - CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (OS command injection) - to deploy webshells and cryptocurrency miners. The attackers chained these vulnerabilities to gain initial access, conduct reconnaissance, and install XMRig miners disguised as Microsoft Edge services across at least five organizations. The malware included sophisticated evasion techniques using AI-assisted PowerShell scripts that detect Task Manager activity and automatically suspend mining operations to avoid detection. This incident highlights the growing trend of cryptomining attacks targeting unpatched enterprise software, particularly backup solutions used by managed service providers. The exploitation of critical infrastructure components like backup systems poses significant operational risks and demonstrates how attackers are increasingly using AI-enhanced tools for stealth and persistence.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FBI Breach Exposes Critical Third-Party Risk: ShinyHunters Exploit Unpatched Oracle System
FBI Breach Exposes Critical Third-Party Risk: ShinyHunters Exploit Unpatched Oracle System
Government Administration1 month ago

FBI Breach Exposes Critical Third-Party Risk: ShinyHunters Exploit Unpatched Oracle System

In October 2026, the FBI removed an Accenture contractor following a security breach orchestrated by the ShinyHunters cybercriminal group that exposed personal details of thousands of FBI employees. The breach occurred through Oracle PeopleSoft's job portal after the contractor failed to implement a critical security patch. ShinyHunters exploited CVE-2026-35273 using a URL-encoding bypass technique to circumvent web application firewall protections on the vulnerable Environment Management Hub endpoint, demonstrating sophisticated evasion capabilities. This incident highlights the critical importance of third-party risk management and timely patch deployment as organizations increasingly rely on external contractors for sensitive operations, making supply chain security a top priority for government agencies and enterprises alike.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CSuite Phishing Campaign Demonstrates Evolution of Executive-Targeted Cyber Attacks
CSuite Phishing Campaign Demonstrates Evolution of Executive-Targeted Cyber Attacks
Information Technology/IT1 month ago

CSuite Phishing Campaign Demonstrates Evolution of Executive-Targeted Cyber Attacks

In September 2026, ANY.RUN researchers identified a sophisticated CSuite phishing campaign targeting U.S. executives and C-suite personnel across 351 analyzed incidents. The operation used convincing business lures mimicking Adobe, DocuSign, Zoom, and Microsoft 365 services to deliver dual-payload attacks. Attackers deployed both credential harvesting mechanisms to steal Microsoft 365 sessions and remote management tools like ScreenConnect and Action1 for persistent endpoint access. The campaign primarily affected technology, manufacturing, government, and consulting sectors, with 51% of incidents originating in the United States. This incident highlights the evolving threat landscape where attackers increasingly combine identity theft with endpoint compromise to maximize impact. As organizations adopt hybrid work models and cloud-first strategies, these multi-vector attacks exploit the expanded attack surface between email systems and remote access infrastructure, making traditional perimeter defenses insufficient against modern business email compromise schemes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
N0va Phishing Campaign Exploits Trusted Business Platforms to Compromise Enterprise Identities
N0va Phishing Campaign Exploits Trusted Business Platforms to Compromise Enterprise Identities
Government Administration1 month ago

N0va Phishing Campaign Exploits Trusted Business Platforms to Compromise Enterprise Identities

The N0va phishing campaign has emerged as a sophisticated threat targeting organizations across North America and Europe in 2026, focusing on government, technology, consulting, and healthcare sectors. Unlike traditional phishing attacks, N0va impersonates trusted business platforms including Microsoft Teams, SharePoint, OneDrive, DocuSign, and Google Drive, then guides victims through legitimate authentication flows to capture access and refresh tokens. Once successful, attackers abuse token-exchange mechanisms to establish SSO access across corporate resources, enabling access to email, files, and cloud applications without deploying obvious malware. The campaign's use of legitimate authentication processes and trusted brand impersonation makes detection challenging and can lead to significant financial losses, data exposure, operational disruption, and compliance violations. This incident highlights the evolving sophistication of identity-based attacks that exploit trust in legitimate business platforms and authentication mechanisms, representing a growing trend where attackers move beyond traditional malware deployment to abuse valid business processes for initial access and persistence.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical N-able N-central RCE Vulnerability Exploited: MSP Supply Chain Under Attack
Critical N-able N-central RCE Vulnerability Exploited: MSP Supply Chain Under Attack
Information Technology/IT2 months ago

Critical N-able N-central RCE Vulnerability Exploited: MSP Supply Chain Under Attack

In September 2026, CISA added CVE-2026-86218, a maximum-severity remote code execution vulnerability in N-able N-central, to its Known Exploited Vulnerabilities catalog after evidence of active exploitation in the wild. The pre-authentication static code injection flaw allows attackers to execute arbitrary code without authentication on N-central servers, which are widely used by managed service providers (MSPs) and large IT organizations to manage entire customer environments. Huntress reported investigating a compromise of a customer's fully patched N-central production environment, though the exact exploit vector remains unclear. The vulnerability was patched in N-central 2026.3 Hotfix 4, but organizations must also hunt for indicators of compromise as patching alone may be insufficient. This incident highlights the escalating threat to MSP infrastructure as ransomware groups increasingly target supply chain chokepoints to maximize their reach across multiple organizations simultaneously.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Scottish Government Data Breach: Lessons in Third-Party Security
Government Administration2 months ago

Scottish Government Data Breach: Lessons in Third-Party Security

In August 2026, Scotland's Crown Office and Procurator Fiscal Service (COPFS) disclosed a data breach involving an external supplier managing an online data maturity assessment. The breach exposed personal information of approximately 300 employees, including names, roles, and work email addresses. The incident was detected on August 5, 2026, when the third-party noticed suspicious activity on its network. While COPFS's case-related data remained unaffected, the breach raises concerns about the security of third-party vendors handling sensitive government information. This incident underscores the growing risks associated with third-party service providers in the public sector. As government agencies increasingly rely on external vendors for data management and assessments, ensuring robust security measures and continuous monitoring of these partners becomes imperative to prevent unauthorized access and data breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Critical N-able N-central Vulnerability Exploited: Immediate Action Required
Information Technology/IT3 months ago

Critical N-able N-central Vulnerability Exploited: Immediate Action Required

In August 2026, N-able's N-central platform, widely used by Managed Service Providers (MSPs) for remote IT management, was found to have a critical vulnerability (CVE-2026-18577) that allowed unauthenticated attackers to gain full administrative access. Exploiting this flaw, attackers could run scripts, deploy tools, and open remote sessions across all managed endpoints. The vulnerability stemmed from an incomplete fix of a previous issue (CVE-2026-18556). N-able released Hotfix 2 to address this, urging all on-premise users to apply the patch immediately. Hosted instances received automatic updates. Organizations were also advised to monitor their environments closely for signs of compromise. ([itpro.com](https://www.itpro.com/security/cyber-attacks/msps-urged-to-patch-immediately-after-n-able-issues-hotfix-for-n-central-god-mode-flaw?utm_source=openai)) This incident underscores the critical importance of timely patch management and vigilant monitoring in IT environments. The rapid exploitation of such vulnerabilities highlights the evolving tactics of threat actors and the necessity for organizations to stay ahead with proactive security measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
UNC6671's Vishing Tactics: A Wake-Up Call for SaaS Security
Financial Services3 months ago

UNC6671's Vishing Tactics: A Wake-Up Call for SaaS Security

In early 2026, the financially motivated threat group UNC6671, operating under the 'BlackFile' brand, initiated a series of sophisticated voice phishing (vishing) attacks targeting employees' personal mobile devices. Posing as internal IT support, the attackers directed victims to fraudulent login portals designed to harvest credentials and multi-factor authentication (MFA) tokens. Utilizing adversary-in-the-middle (AiTM) techniques, UNC6671 gained unauthorized access to cloud environments, including Microsoft 365 and Okta, and exfiltrated sensitive data using automated scripts. The stolen information was then leveraged for extortion, with demands often reaching seven figures. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/?utm_source=openai)) This campaign underscores a significant shift in cyberattack methodologies, emphasizing the exploitation of human factors over technical vulnerabilities. The success of UNC6671's operations highlights the critical need for organizations to implement phishing-resistant MFA solutions and enhance employee awareness to mitigate social engineering threats. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerabilities in TP-Link Omada ZTP Mechanism Pose Security Risks
Information Technology/IT3 months ago

Critical Vulnerabilities in TP-Link Omada ZTP Mechanism Pose Security Risks

In August 2026, TP-Link addressed 15 vulnerabilities in the Zero-Touch Provisioning (ZTP) mechanism of its Omada network devices, as disclosed by Forescout’s Vedere Labs at the Black Hat USA security conference. These flaws, encompassing hard-coded cryptographic keys, information disclosure, remote code execution, and device hijacking, could be exploited to infiltrate networks by compromising Omada’s chain of trust. Notably, attackers could combine these vulnerabilities with previously identified command-injection flaws (CVE-2025-7850 and CVE-2025-7851) to achieve remote code execution. The affected products include Omada Controllers, Gateways, Switches, Access Points, OLT platforms, Cloud services, and TP-Link mobile applications. This incident underscores the critical importance of securing network infrastructure, especially as routers and switches have become primary threat vectors, surpassing traditional endpoints. Organizations are urged to promptly apply firmware updates, enforce strong authentication measures, and monitor network traffic to mitigate potential exploits stemming from these vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ernst & Young's 2026 Data Breach: A Supply Chain Attack by ShinyHunters
Accounting3 months ago

Ernst & Young's 2026 Data Breach: A Supply Chain Attack by ShinyHunters

In April 2026, Ernst & Young (EY) detected unauthorized access to a third-party IT service management platform used for client tax services. The breach occurred between March 28 and April 12, 2026, during which attackers downloaded multiple documents containing personal and financial information related to client tax filings. EY secured its systems, removed unauthorized access, and notified federal law enforcement. Affected clients were offered 24 months of identity monitoring and restoration services through Experian. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-data-breach-claimed-by-shinyhunters-extortion-gang/?utm_source=openai)) On July 27, 2026, the ShinyHunters extortion gang claimed responsibility for the breach, alleging they obtained EY credentials via a supply-chain attack. They threatened to release the stolen data if EY did not contact them by July 31, 2026. EY has not confirmed ShinyHunters' involvement. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-data-breach-claimed-by-shinyhunters-extortion-gang/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Ernst & Young Data Breach Exposes Client Tax Information in 2026
Accounting3 months ago

Ernst & Young Data Breach Exposes Client Tax Information in 2026

In April 2026, Ernst & Young (EY) identified unauthorized access to a third-party IT service management platform used for client tax services. The breach occurred between March 28 and April 12, 2026, during which attackers downloaded documents containing personal and financial information used in tax filings. EY promptly secured the affected systems, notified federal law enforcement, and offered 24 months of identity monitoring services to impacted clients. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ernst-and-young-discloses-data-breach-after-support-system-hack/?utm_source=openai)) This incident underscores the critical need for robust third-party risk management, especially as organizations increasingly rely on external platforms for sensitive operations. The breach highlights the importance of continuous monitoring and rapid response strategies to mitigate potential damages from such compromises.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports