The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Non-Profit/Volunteering
Breach intelligence, attack campaigns, and threat reports targeting the Non-Profit/Volunteering sector.
Explore Other Sectors
Non-Profit/Volunteering Threat Reports
One Click IP Exposure: How Telegram Proxy Links Created a Privacy Vulnerability in 2026
In January 2026, security researchers revealed that Telegram users could have their real IP address exposed by clicking specially crafted proxy links disguised as regular usernames or harmless URLs. When users clicked these links in Telegram's Android or iOS apps, the app would automatically attempt to connect to the attacker-controlled proxy server, revealing the user's actual IP without further confirmation. This behavior, demonstrated across various public channels, posed targeted privacy risks, including location tracking and the potential for follow-on attacks. Telegram acknowledged the issue and stated they would introduce warnings to alert users about proxy links but did not commit to a timeline for deployment. This incident highlights a growing trend of information disclosure vulnerabilities related to messaging apps and link-based attacks, demonstrating the persistent risk of metadata and IP leaks in platforms used for privacy and circumvention. It brings renewed urgency to strengthen client security and increase user awareness, especially amid rising concerns over digital privacy and targeted cyber threats.
8 months ago
Kill Chain
Kimsuky Leverages QR Code Phishing to Target U.S. Strategic Organizations in 2025
In June 2025, the FBI identified a sophisticated spearphishing campaign by North Korean state-backed group Kimsuky (APT43) targeting U.S. organizations involved in North Korea-related policy, research, and strategic consultancy. Attackers used emails containing malicious QR codes—an attack known as 'quishing'—to lure victims from think tanks, government agencies, and academic institutions into scanning codes with mobile devices. Scanned QR codes redirected victims to convincing phishing pages impersonating Microsoft 365, Okta, and other login portals, harvesting credentials and cloud session tokens to circumvent multi-factor authentication measures. The attacks bypassed traditional email security by exploiting unmanaged mobile endpoints and compromised inboxes, posing significant risks to identity security and ongoing policy work. This incident highlights an escalating trend of QR code phishing, enabling attackers to sidestep conventional defenses while targeting sensitive organizations. The campaign underscores the growing threat posed by identity-driven attacks, advanced social engineering, and multi-factor authentication bypass techniques, prompting urgent calls for improved mobile device security postures and enhanced employee awareness programs.
8 months ago
Kill Chain
Voice Phishing Attack Exposes Harvard Alumni and Donor Data in 2024 Breach
In June 2024, Harvard University disclosed a significant data breach after attackers compromised its Alumni Affairs and Development systems via a sophisticated voice phishing (vishing) attack. By deceiving university staff over the phone, the threat actors gained unauthorized access to sensitive databases containing personal information of students, alumni, donors, faculty, and staff. Although there is no evidence of misuse so far, the exposed data may include contact information, date of birth, employment and education history, and donation records, potentially increasing victims’ risk of targeted phishing and fraud. The breach has raised serious concerns about the vulnerabilities introduced by social engineering and legacy authentication systems among educational institutions. This incident is particularly relevant given the surge in identity-based and social engineering attacks across higher education, where attackers exploit human trust as the weakest link. Regulatory scrutiny and the growing value of academic donor databases place further pressure on institutions to adopt modern defenses, like multi-factor authentication and advanced detection capabilities.
8 months ago
Kill Chain
Konni APT Exploits Google’s Find Hub to Launch Data-Wiping Attacks
In late 2025, the North Korea-linked threat actor known as Konni (also referred to as Earth Imp, Opal Sleet, TA406, and Vedalia) launched a sophisticated campaign targeting Android and Windows users by abusing Google’s Find Hub functionality as a remote data-wiping weapon. The attackers impersonated psychological counselors and North Korean human rights activists, distributing malware via fake stress-relief applications that enabled remote access, data theft, and destructive wipes. The operation leveraged advanced evasion tactics, encrypted traffic channels, and targeted high-value individuals, resulting in significant loss and compromise of sensitive personal and organizational information. This incident exemplifies the growing risk from state-affiliated actors using social engineering and legitimate platform abuse to bypass defenses. With threat techniques evolving, organizations must now prioritize threat hunting, advance east-west traffic visibility, and enforce robust segmentation policies to catch and contain similar attacks.
8 months ago
Kill Chain
Chinese Nation-State Hackers Breach U.S. Non-Profit Using Legacy Bugs
In early 2025, a China-linked advanced persistent threat (APT) group carried out a sophisticated cyber espionage campaign targeting a prominent U.S. non-profit focused on policy issues. Leveraging legacy vulnerabilities such as Log4j and Microsoft IIS flaws, the attackers gained initial access, established persistent footholds, and conducted covert data exfiltration operations while remaining undetected for several months. According to detailed analyses by Symantec and Carbon Black, the group focused on harvesting sensitive documents related to U.S. government policy and influencing discussions through clandestine activity within compromised systems, amplifying strategic risk to both the organization and its stakeholders. This incident exemplifies a broader trend of nation-state actors weaponizing unpatched, well-known vulnerabilities for long-term espionage. Organizations with legacy infrastructure are increasingly attractive targets, underscoring the urgent need for proactive vulnerability management, encrypted traffic controls, and robust east-west security to counter evolving, identity-driven threats.
8 months ago
Kill Chain
University of Pennsylvania Breach Exposes 1.2 Million Donor Records in 2024
In June 2024, a hacker claimed responsibility for breaching the University of Pennsylvania, exposing sensitive information on approximately 1.2 million donors as well as internal documentation. The threat actor infiltrated the university's IT environment, potentially exploiting weaknesses in data encryption and network segmentation. The attack resulted in the unauthorized access and potential leak of donor personal details, which could include names, contact information, and possibly financial data. The incident became publicly known after a 'We got hacked' email was sent from university channels, alerting stakeholders to the scale of the compromise. This incident highlights the increasing prevalence of large-scale data breaches targeting higher education and non-profit institutions. As threat actors employ more advanced techniques to exploit internal network gaps, organizations face mounting regulatory pressure to strengthen defenses and prevent sensitive data exposure.
8 months ago
Kill Chain
PhantomCaptcha Spearphishing Attack Targets Ukraine War Relief Orgs
On June 22, 2024, a coordinated spearphishing campaign dubbed 'PhantomCaptcha ClickFix' targeted Ukrainian regional government entities and major international humanitarian organizations, such as the International Committee of the Red Cross and UNICEF. The attackers used convincing phishing emails distributing malicious links intended to compromise users through browser exploits and credential harvesting, aiming to disrupt relief efforts amid ongoing conflict. Although the operation was short-lived, lasting just one day, it exposed staff to significant risk of account takeover and disruption of war relief operations. This incident spotlights the expanding use of highly targeted, short-duration spearphishing campaigns against NGOs and governmental organizations, reflecting the broader trend of cyber-enabled disruption in geopolitical conflict zones. Attacks exploiting human trust and exploiting organizational urgency are on the rise, demanding renewed vigilance.
8 months ago
Kill Chain
PhantomCaptcha: How Ukraine Aid Groups Were Targeted with Spear-Phishing PDFs in 2025
On October 8, 2025, a sophisticated spear-phishing campaign, dubbed PhantomCaptcha, targeted Ukraine war relief organizations, including members of the International Red Cross and Norwegian Refugee Council. Attackers sent counterfeit Zoom invitations and weaponized PDF attachments designed to lure aid workers into executing a remote access trojan (RAT). Leveraging WebSockets for covert command-and-control, the threat actors gained unauthorized access, potentially jeopardizing sensitive wartime humanitarian data and operations. The campaign showcased precise targeting, the use of specially crafted lures reflecting victims’ work environments, and advanced C2 techniques to evade detection. This incident underscores the increasing cyber threats facing humanitarian sectors amid ongoing geopolitical conflicts. As military and civilian support organizations become more digitalized and visible, spear-phishing and RAT-based compromises are on the rise, necessitating urgent security enhancements and compliance vigilance.
8 months ago
Kill Chain
Iran MOIS Targets Diplomatic Missions Worldwide in Sophisticated Phishing Campaign (2024)
Between August and September 2024, the Iranian state-affiliated APT group 'Homeland Justice,' linked to Iran’s Ministry of Intelligence (MOIS), orchestrated a sophisticated phishing campaign targeting over 50 embassies, government ministries, and international organizations across six continents. Attackers leveraged more than 100 hijacked, legitimate email accounts, using them to distribute infostealing malware concealed in macro-laden Word documents, often themed around timely geopolitical topics. These emails were sent via VPNs to obfuscate their true origin and bypassed basic email filtering due to the use of authentic sender addresses. This incident highlights the sustained threat posed by nation-state actors employing classic social engineering methods with modern evasion techniques. The resurgence of macro-enabled attacks and increasing abuse of compromised trusted accounts point to evolving risk vectors for governmental and international bodies, underscoring the need for continuous vigilance and upgraded detection capabilities.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports