Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Venture Capital/VC

Breach intelligence, attack campaigns, and threat reports targeting the Venture Capital/VC sector.

13 threat reports
Page 1 of 2
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Venture Capital/VC Threat Reports

Showing 1–12 / 13 reports
CrowdSec Breach: How TanStack NPM Supply Chain Attack Exposed 170 Private Repositories
CrowdSec Breach: How TanStack NPM Supply Chain Attack Exposed 170 Private Repositories
Computer Software/Engineering1 month ago

CrowdSec Breach: How TanStack NPM Supply Chain Attack Exposed 170 Private Repositories

In May 2026, CrowdSec suffered a significant data breach when attackers leveraged the TanStack npm supply chain attack (CVE-2026-45321) to compromise a former employee's laptop and steal GitHub credentials. The attackers used these credentials to copy 170 private GitHub repositories containing source code, consensus algorithms, and sensitive data including 83 user email addresses and 51 potential investor details. The breach was discovered in September 2026 when the stolen code appeared on online forums, revealing critical intellectual property and operational thresholds. This incident exemplifies the growing threat of supply chain attacks targeting developer environments and highlights the cascading impact when credential hygiene practices fail during employee transitions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
North Korean WaterPlum Campaign: How Fake AI Job Offers Led to $11M Cryptocurrency Heist
North Korean WaterPlum Campaign: How Fake AI Job Offers Led to $11M Cryptocurrency Heist
Computer Software/Engineering1 month ago

North Korean WaterPlum Campaign: How Fake AI Job Offers Led to $11M Cryptocurrency Heist

North Korean threat actors operating under WaterPlum (aka Contagious Interview) have compromised over 30,000 devices across 100+ countries by posing as legitimate AI, cryptocurrency, and NFT company recruiters targeting software developers and IT professionals. The campaign, linked to North Korea's 313 General Bureau, uses fake job opportunities to deliver malware and establish persistent access for cryptocurrency theft and data exfiltration. The operation has successfully stolen approximately $11 million in cryptocurrency from over 7,000 wallets while maintaining extensive overlap with broader North Korean IT worker infiltration efforts. This incident highlights the evolution of North Korean cyber operations beyond traditional state-sponsored espionage toward systematic financial crime integrated with legitimate IT workforce infiltration, representing a new paradigm where threat actors blend cybercriminal activities with long-term economic penetration strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
South Korean Government Platform Breach Exposes 5,000 Records Due to Key Management Failures
Government Administration2 months ago

South Korean Government Platform Breach Exposes 5,000 Records Due to Key Management Failures

In July 2026, South Korea's government-backed startup support platform Modu-ui Changup suffered a data breach affecting approximately 5,000 applicants. The incident occurred when encryption keys were improperly exposed through API responses, allowing attackers to decrypt previously encrypted personal information including email addresses, startup ideas, and evaluation comments. Investigators identified 39 South Korean IP addresses involved in accessing the leaked data through AI-based web crawling techniques, with the breach attributed to fundamental failures in encryption key management architecture. This incident highlights the growing threat landscape where traditional encryption approaches fail when key management practices are inadequate, particularly as AI-driven attack methods become more sophisticated and government platforms face increased scrutiny for data protection failures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Injective SDK npm Supply-Chain Attack Exposes Cryptocurrency Wallets
Computer Software/Engineering4 months ago

Injective SDK npm Supply-Chain Attack Exposes Cryptocurrency Wallets

In July 2026, attackers compromised the GitHub repository of Injective Labs' SDK project, leading to the publication of a malicious version (1.20.21) of the @injectivelabs/sdk-ts package on npm. This package, widely used for developing applications on the Injective blockchain, was altered to steal cryptocurrency wallet private keys and mnemonic seed phrases. The breach was detected promptly, and a clean version (1.20.23) was released. However, the malicious package was downloaded 310 times before deprecation, potentially compromising numerous developer systems. This incident underscores the escalating threat of supply-chain attacks targeting open-source ecosystems, particularly within the cryptocurrency sector. The rapid detection and response highlight the importance of vigilant monitoring and swift action in mitigating such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
UNC1069's Social Engineering Compromise of Axios: A 2026 Supply Chain Attack
Computer Software/Engineering7 months ago

UNC1069's Social Engineering Compromise of Axios: A 2026 Supply Chain Attack

In late March 2026, the popular JavaScript HTTP client library Axios, with over 100 million weekly downloads, was compromised through a sophisticated social engineering attack. The North Korean state-sponsored group UNC1069 targeted lead maintainer Jason Saayman, gaining access to his npm account. The attackers published two malicious versions of Axios (1.14.1 and 0.30.4) that included a trojanized dependency, 'plain-crypto-js@4.2.1', which executed a post-install script to deploy a cross-platform Remote Access Trojan (RAT) upon installation. The malicious packages were available for approximately two to three hours before being removed, but the potential impact was significant due to Axios's widespread use. This incident underscores the increasing industrialization of social engineering attacks targeting open-source maintainers, highlighting the need for enhanced security measures within the software supply chain. The rapid detection and removal of the compromised packages prevented a more extensive breach, but the event serves as a critical reminder of the vulnerabilities inherent in widely used open-source projects.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Drift Protocol's $280M Loss: A Case Study in Advanced Social Engineering
Computer Software/Engineering7 months ago

Drift Protocol's $280M Loss: A Case Study in Advanced Social Engineering

In April 2026, Drift Protocol, a decentralized finance platform on the Solana blockchain, suffered a sophisticated cyberattack resulting in the theft of approximately $280 million in digital assets. The attackers, identified as the North Korean state-sponsored group UNC4736, infiltrated the organization over a six-month period by posing as a legitimate quantitative trading firm. They engaged with Drift contributors at multiple industry conferences, building trust through in-person meetings and continued communication via Telegram. This prolonged social engineering campaign allowed them to gain unauthorized access to Drift's Security Council administrative powers, leading to the rapid exfiltration of funds. This incident underscores the evolving tactics of state-sponsored cyber actors, who are increasingly leveraging extended social engineering strategies to compromise high-value targets. The attack highlights the critical need for organizations to implement robust security protocols, including stringent verification processes and continuous monitoring, to defend against such sophisticated infiltration methods.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Alerts Developers to Malicious Next.js Repositories Delivering In-Memory Malware
Computer Software/Engineering8 months ago

Microsoft Alerts Developers to Malicious Next.js Repositories Delivering In-Memory Malware

In February 2026, Microsoft identified a coordinated campaign targeting developers through malicious repositories disguised as legitimate Next.js projects. Attackers created fake repositories on platforms like Bitbucket, using names such as "Cryptan-Platform-MVP1," to deceive developers into executing code that establishes persistent access to compromised machines. The campaign employed multiple execution methods, including Visual Studio Code workspace automation, build-time execution via modified JavaScript libraries, and server startup execution through environment exfiltration. These methods led to the in-memory execution of attacker-controlled JavaScript, facilitating command-and-control operations and potential data exfiltration. This incident underscores the increasing sophistication of supply chain attacks targeting developers. By embedding malicious code into trusted development tools and processes, attackers can gain deep access to sensitive systems and data. Organizations must enhance their security measures to protect against such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PurpleBravo’s North Korean Supply-Chain Attack Exposes Hidden Risks to IT Outsourcing in 2025
Computer Software/Engineering9 months ago

PurpleBravo’s North Korean Supply-Chain Attack Exposes Hidden Risks to IT Outsourcing in 2025

Between August 2024 and September 2025, North Korean state-backed group PurpleBravo orchestrated a software supply-chain campaign targeting IT services and software development firms worldwide. Posing as recruiters or fictitious brands, the attackers lured victims—often developers and job seekers—into executing malicious code on corporate endpoints. Through malware like BeaverTail, PyLangGhost, and GolangGhost, PurpleBravo exfiltrated browser credentials and cryptocurrency wallet data while leveraging GitHub, fake websites, and VPN-based command-and-control infrastructure. Over 3,100 IP addresses and 20 organizations in South Asia, Europe, the Middle East, and Central America were exposed as probable victims, amplifying downstream risk to clients of affected IT service providers. This incident underscores a growing trend of sophisticated, targeted software supply-chain attacks exploiting developer trust and recruitment platforms. The campaign’s overlap with other North Korean IT worker operations and its focus on outsourcing regions highlight urgent risks to organizations relying on distributed and third-party development partners.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Unleash Protocol Breach: $3.9M Stolen in 2024 DeFi Multisig Contract Hijack
Financial Services10 months ago

Unleash Protocol Breach: $3.9M Stolen in 2024 DeFi Multisig Contract Hijack

In May 2024, decentralized intellectual property platform Unleash Protocol suffered a major security breach in which hackers exploited a vulnerability within its multisignature governance contract. Threat actors successfully assumed control of the protocol’s multisig wallet to execute an unauthorized smart contract upgrade, granting them illicit withdrawal rights. As a result, approximately $3.9 million in cryptocurrency assets were drained from the platform. The incident forced Unleash Protocol to suspend operations to assess damage control, freezing its ecosystem and raising questions about the security of decentralized financial infrastructure. This breach highlights the persistent risks facing DeFi platforms, particularly surrounding contract governance and multisig controls. Threat actors continue to target decentralized protocols using sophisticated social engineering and smart contract exploitation methods, emphasizing fintech’s urgent need for comprehensive, proactive security measures.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
AI Advertising Firm Doublespeed Breached: Over 1,000 Smartphones Compromised in 2025 Attack
Marketing/Advertising/Sales10 months ago

AI Advertising Firm Doublespeed Breached: Over 1,000 Smartphones Compromised in 2025 Attack

In October 2025, AI advertising startup Doublespeed suffered a major security breach when a hacker exploited a vulnerability in the company’s backend systems to gain unauthorized access to its phone farm managing over 1,000 AI-generated social media accounts. The attacker was able to both extract confidential data about undisclosed advertising campaigns and seize remote control of the smartphones used to operate the accounts. This exposure illuminated the company’s covert promotion practices and presented significant risks of both data exfiltration and operational compromise. Despite being notified on October 31, the company had not fully remediated access at the time of reporting, heightening concerns about internal controls and disclosure procedures. The breach underscores growing vulnerabilities in companies that use automation at scale, especially in the context of AI-driven influence operations and digital marketing. It reflects broader industry trends: increasing use of phone farms, sophisticated identity evasion, and regulatory scrutiny around undeclared digital ads, all contributing to a shifting cyber threat landscape.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
North Korean BlueNoroff APT Hits Fintech and Web3 in Sophisticated 2024 Crypto Heist
Financial Services10 months ago

North Korean BlueNoroff APT Hits Fintech and Web3 in Sophisticated 2024 Crypto Heist

In early 2024, the North Korean APT group BlueNoroff (a sub-group of Lazarus) launched sophisticated cross-platform campaigns against fintech executives and Web3 developers worldwide. The attackers utilized fake business collaboration and job recruitment lures distributed via phishing documents and messaging apps to implant malware on both Windows and macOS devices. Once in the network, BlueNoroff leveraged their established toolkits—including custom backdoors and credential stealers—to escalate privileges and ultimately exfiltrate cryptocurrency assets. This activity resulted in significant fund theft for several organizations, eroding trust in targeted fintech sectors. This incident highlights the continuous evolution of state-sponsored cybercrime groups, who now use highly adaptive social engineering paired with platform-agnostic malware. The financial sector, especially emerging blockchain and crypto startups, remains a primary focus amid a surge of advanced financially-motivated nation-state attacks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
GitHub Notification Phishing Abuses Y Combinator Brand for Crypto Theft (2025)
Computer Software/Engineering10 months ago

GitHub Notification Phishing Abuses Y Combinator Brand for Crypto Theft (2025)

In September 2025, a widespread phishing campaign exploited GitHub's notification system to target software developers for cryptocurrency theft. Attackers impersonated the reputable startup accelerator Y Combinator and generated hundreds of fake issue notifications across GitHub repositories, tagging users to trigger authentic-looking emails. Victims were lured to a spoofed Y Combinator website with a subtle domain misspelling, where they were prompted to connect cryptocurrency wallets for 'verification.' Behind the scenes, obfuscated scripts authorized malicious transactions, draining wallets once users signed in. The fraudulent repositories were quickly reported and taken down, but it's unclear how many users suffered financial losses. This attack highlights the growing trend of threat actors leveraging trusted platforms for sophisticated social engineering, particularly as notification-based phishing campaigns increase and cryptocurrency remains a lucrative target. The evolving tactics underscore the urgent necessity for enhanced vigilance, technical controls, and authentication checks across digital collaboration tools.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports