The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Media Production
Breach intelligence, attack campaigns, and threat reports targeting the Media Production sector.
Explore Other Sectors
Media Production Threat Reports
Clop Ransomware Hits University of Pennsylvania in Oracle EBS Supply Chain Attack
In August 2023, the University of Pennsylvania became one of nearly 100 organizations targeted in a sweeping data theft and extortion campaign by the Clop ransomware group. Exploiting previously unknown vulnerabilities in Oracle E-Business Suite (EBS), attackers gained unauthorized access to sensitive university systems over several days. Personal data, including names, Social Security numbers, and financial information, was exposed for thousands of individuals, primarily detected when Clop issued extortion demands and Oracle disclosed the vulnerability late September. Patch deployment followed, with no public evidence of further data misuse. The mass exploitation of Oracle EBS by Clop highlights a rising trend of sophisticated ransomware groups targeting widely used enterprise applications through zero-day attacks. This incident underscores renewed urgency for robust patch management, vigilant monitoring, and segmentation in response to evolving ransomware tactics and large-scale supply chain risks.
8 months ago
Kill Chain
Critical W3 Total Cache Plugin Vulnerability Enables PHP Command Injection on WordPress Sites
In June 2024, a critical security vulnerability was disclosed in the W3 Total Cache WordPress plugin, which is widely used to optimize website performance. Attackers could exploit this flaw by submitting a specially crafted comment to a vulnerable website, enabling them to execute arbitrary PHP commands on the underlying server. This vulnerability, involving insufficient sanitization and validation within comment processing, exposes affected websites to full compromise, including unauthorized data access, web defacement, and further lateral movement inside hosting environments. Immediate patching is required as active exploitation has been observed in the wild. This incident underscores the persistent risk of supply chain attacks and plugin vulnerabilities in content management systems like WordPress. As attackers increasingly target high-profile plugins to gain initial access, maintaining up-to-date software and implementing robust security controls has never been more critical.
8 months ago
Kill Chain
WordPress Sites Under Siege: Critical Post SMTP Plugin Flaw Exposes 400,000+ Websites
In June 2024, a critical vulnerability was discovered in the Post SMTP mailer plugin for WordPress, widely used by over 400,000 sites. This flaw allows unauthenticated attackers to reset admin accounts and take full control of affected websites. Threat actors have already exploited the vulnerability by leveraging malicious password reset links, leading to complete site compromise, potential data theft, and abuse of compromised infrastructure for further attacks. The vulnerability prompted emergency patching and urgent advisories from both the plugin authors and security firms. This incident underscores the persistent threat posed by plugin vulnerabilities in the WordPress ecosystem, which remains a popular target for cybercriminals due to its vast user base. The surge in attacks exploiting supply chain and third-party plugin weaknesses highlights the need for rapid vulnerability management and robust security controls for web applications.
8 months ago
Kill Chain
WordPress Post SMTP Plugin Exploited in Mass Admin Account Hijacks (2024)
In early June 2024, cybersecurity researchers identified that a critical vulnerability in the Post SMTP WordPress plugin was being actively exploited by threat actors. This vulnerability allowed attackers to hijack administrator accounts across more than 400,000 affected WordPress sites, enabling complete site control and potentially permitting installation of malicious payloads. Attackers gained initial access through the plugin's weak nonce verification, escalating privileges to compromise sites, deploy backdoors, and exfiltrate sensitive data. The incident demonstrates how widespread web application vulnerabilities can be rapidly weaponized, putting enterprises and small businesses alike at risk of data loss, defacement, or further compromise. The Post SMTP exploitation highlights a recent surge in attacks leveraging zero-day or unpatched CMS plugins on large scales, reflecting attackers’ growing focus on supply chain and SaaS-adjacent targets. As organizations increasingly depend on third-party tools and platforms, maintaining rapid patch cycles and comprehensive visibility into software components is more critical than ever.
8 months ago
Kill Chain
Dentsu Subsidiary Employee Data Stolen in 2024 Breach: What Enterprises Must Know
In June 2024, a subsidiary of global marketing and PR giant Dentsu experienced a significant data breach in which unidentified threat actors accessed and stole sensitive employee information. The breach reportedly targeted internal personnel data, potentially exposing names, contact information, and other personally identifiable details, though Dentsu has not publicly shared whether client data was affected. The precise entry vector has not been disclosed, but the attack highlights vulnerabilities in east-west traffic inspection and data-in-transit encryption within subsidiary environments. Dentsu's management responded by initiating a comprehensive forensic investigation and notifying affected employees while enhancing internal security protocols. This breach accentuates the growing targeting of large holding companies and their subsidiaries, as attackers increasingly seek weak links in global enterprise ecosystems. With regulatory pressure mounting and privacy violations facing stiffer penalties worldwide, all large organizations must urgently reassess how they secure internal traffic and control access across decentralised operational units.
8 months ago
Kill Chain
WordPress Plugin Flaw Exposes Sensitive Data to Subscribers in 2024
In June 2024, a critical vulnerability was disclosed in the widely used WordPress 'Anti-Malware Security and Brute-Force Firewall' plugin, which is active on over 100,000 websites. The flaw enables authenticated subscriber-level users to exploit improperly validated file access mechanisms, granting them read access to arbitrary files stored on the web server. This could allow the exposure of sensitive configuration files, credentials, or proprietary business data, significantly undermining site security and user privacy. Plugin maintainers were alerted, and a patched version was released to mitigate the issue. This incident emphasizes the risks posed by third-party plugin vulnerabilities within content management platforms, which remain a persistent attack vector as organizations contend with rapid plugin adoption and reliance on open-source tools.
8 months ago
Kill Chain
Operation ForumTroll 2025: Memento Labs Revives APT Espionage with Chrome 0-day
In March 2025, Kaspersky uncovered Operation ForumTroll, a sophisticated espionage campaign targeting Russian government agencies, critical institutions, and media organizations. The threat actors employed personalized spear-phishing emails carrying unique, short-lived links; merely visiting these sites using Chrome or Chromium-based browsers enabled a zero-day exploit (CVE-2025-2783) to escape the browser sandbox. The attackers established system persistence via COM hijacking, then operated stealthy malware—LeetAgent and the commercial Dante spyware, attributed to Memento Labs (formerly Hacking Team)—to exfiltrate sensitive files and credentials, while leveraging cloud infrastructure for their C2 communications and tool delivery. This campaign exemplifies a new wave of highly targeted, sophisticated APT activity leveraging commercial spyware and advanced zero-day exploitation. As browser vulnerabilities and commercial surveillance tools increasingly intersect, organizations must urgently review security for endpoints, threat detection, and privileged access to counter fast-evolving espionage operations.
8 months ago
Kill Chain
WordPress Mass Exploitation 2024: The Risks of Outdated Plugin Vulnerabilities
In June 2024, a mass exploitation campaign targeted thousands of WordPress websites worldwide by abusing known critical vulnerabilities in the GutenKit and Hunk Companion plugins. Attackers leveraged outdated versions lacking essential security patches to achieve remote code execution (RCE), enabling full control over affected sites. The campaign's automated exploits installed malicious payloads, manipulated website content, and frequently enabled further lateral movement or data theft. Organizations relying on vulnerable plugins faced significant reputational and operational disruption, with site defacements, malware delivery, and potential customer data exposure as key impacts. The incident highlights the persistent security challenge posed by unpatched plugins in popular web platforms. Amid a surge in mass web exploitation and supply chain attacks against CMS ecosystems, adversaries are rapidly weaponizing public proof-of-concept exploits, putting organizations at immediate risk from even dated vulnerabilities.
8 months ago
Kill Chain
Zendesk's 2025 Email Bomb: How Lax Authentication Led to Mass Inbox Floods
In October 2025, a campaign exploited insecure ticket creation configurations across hundreds of Zendesk customer accounts, allowing attackers to bombard target inboxes with thousands of emails by abusing anonymous support workflows. Attackers submitted forged support requests via vulnerable Zendesk setups that lacked mandatory user authentication; as a result, victim inboxes were flooded with email notifications that appeared to originate from major brands like NordVPN, The Washington Post, and Discord. This distributed email flood (email bomb) compromised brand integrity, overloaded recipient systems, and created significant disruption for both targeted individuals and the affected organizations, highlighting the dangers of misconfigured application authentication and notification systems. Incidents like this reflect a rising trend in application-layer abuse, where attackers exploit lenient platform defaults and automated workflow triggers to amplify malicious campaigns. As business reliance on cloud-based customer service solutions increases, proper authentication and anti-abuse controls have become critical to both user and organizational protection.
8 months ago
Kill Chain
Vane Viper Powers 1 Trillion DNS Queries in 2025 Malvertising Mega-Breach
In September 2025, the threat actor group known as Vane Viper was revealed to be operating a vast and covert ad fraud and malvertising network, leveraging a staggering one trillion DNS queries to enable malware distribution globally. According to a detailed Infoblox technical report, Vane Viper manipulated core internet infrastructure using shell companies and complex ownership structures to obfuscate responsibility and perpetuate malicious adtech practices. Their operations enabled widespread malvertising campaigns, significantly impacting advertising platforms and exposing users worldwide to illicit downloads and credential theft. This breach underscores a recent surge in the use of advanced DNS tunneling and obfuscation tactics in cybercrime, particularly within ad fraud and malvertising schemes. The incident exemplifies how attackers increasingly exploit foundational internet protocols, challenging traditional detection and defense measures while prompting urgent regulatory attention and industry-wide response.
8 months ago
Kill Chain
Google Chrome Hit by Sixth Zero-Day Exploit in 2025—Emergency Patch Released
In September 2025, Google disclosed and urgently patched a high-severity zero-day vulnerability (CVE-2025-10585) in its Chrome browser, the sixth such flaw exploited in the wild this year. The vulnerability stemmed from a type confusion issue within the V8 JavaScript engine and was reportedly leveraged by threat actors—likely government-sponsored—primarily in targeted campaigns against high-risk individuals such as journalists, activists, and political dissidents. Google’s Threat Analysis Group discovered the flaw, leading to an accelerated patch rollout for Windows, Mac, and Linux platforms to mitigate potential compromise and data theft. This incident underscores the continued escalation in zero-day exploitation, particularly against ubiquitous software. As browser-based attacks become more sophisticated and frequent, organizations face mounting pressure to adopt rapid patching cycles and proactive threat mitigation strategies to defend against emergent threats.
8 months ago
Kill Chain
Fake Madgicx Plus & SocialMetrics Browser Extensions Hijack Meta Business Accounts in 2025
In September 2025, cybersecurity researchers reported a targeted infostealer campaign involving fake browser extensions, notably "Madgicx Plus" and "SocialMetrics Pro." Threat actors distributed these malicious extensions via malvertising and fraudulent websites, tricking users into installing them under the guise of gaining Meta Verified blue checkmarks on Facebook and Instagram. Once installed, the extensions stole business account credentials and session tokens, enabling attackers to hijack and monetize Meta Business accounts, potentially leading to widespread financial and reputational harm for affected organizations and individuals. This incident exemplifies the evolution of social engineering and supply-chain abuse targeting digital marketing and social media tools. The ongoing rise in sophisticated browser-based infostealers underscores the urgent need for organizations to monitor for fraudulent browser plugins, enforce software controls, and educate employees about new methods of business account compromise.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports