Software vendors, SaaS, MSPs and semiconductors — supply-chain leverage makes one intrusion into many.
Deterministic keyword + taxonomy matches over the live threat graph — a daily sweep, not analyst attribution. Zero LLM. Last rebuilt 2026-10-16.
Actors whose feed descriptions reference this sector, ranked by graph connectivity.
| Actor | What the feeds say | Graph links |
|---|---|---|
| Scattered Spider | [Scattered Spider](https://attack.mitre.org/groups/G1015) is a native English-speaking cybercriminal group active since at least 2022. (Citation: CrowdStrike Scattered Spider Profile) (Citation: MSTIC Octo Tempest Operations October 2023) T… | 417 |
| APT17 | [APT17](https://attack.mitre.org/groups/G0025) is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and no… | 206 |
| Chimera | [Chimera](https://attack.mitre.org/groups/G0114) is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Ch… | 109 |
| APT12 | [APT12](https://attack.mitre.org/groups/G0005) is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citat… | 104 |
| Operation Wocao | [Operation Wocao](https://attack.mitre.org/groups/G0116) described activities carried out by a China-based cyber espionage adversary. [Operation Wocao](https://attack.mitre.org/groups/G0116) targeted entities within the government, managed … | 1 |
Campaigns and intel pulses mentioning this sector, most recent first.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Indian Critical Infrastructure Intrusions | [Indian Critical Infrastructure Intrusions](https://attack.mitre.org/campaigns/C0043) is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly [RedEcho](https://attack.m… | — | — |
| Operation Wocao | [Operation Wocao](https://attack.mitre.org/campaigns/C0014) was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and th… | — | — |
| Versa Director Zero Day Exploitation | [Versa Director Zero Day Exploitation](https://attack.mitre.org/campaigns/C0039) was conducted by [Volt Typhoon](https://attack.mitre.org/groups/G1017) from early June through August 2024 as zero-day exploitation of Versa Director servers c… | Volt Typhoon | — |
| J-magic Campaign | The [J-magic Campaign](https://attack.mitre.org/campaigns/C0050) was active from mid-2023 to at least mid-2024 and featured the use of the [J-magic](https://attack.mitre.org/software/S1203) backdoor, a custom cd00r variant tailored for use … | — | — |
| Malicious Twitch Browser Extension Exposes 30,000 Users' OAuth Tokens to Russian Bot Service | A malicious browser extension called 'Twitch Enhanced Viewer | JeetBot' distributed on Chrome Web Store and Firefox Add-ons captures and forwards users' live Twitch OAuth session tokens to Russian-controlled proxy servers. The extension, wi… | — | 2026-10-11 |
| Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer | Beginning October 7, 2026, threat actors exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to achieve unauthenticated remote code execution on exposed systems. The attackers chained thes… | — | 2026-10-09 |
| Node.js: Old Technique Makes a Comeback | A resurgence in Node.js abuse has been observed since February 2026, targeting government departments, technology companies, and hotels. Attackers leverage the legitimate, signed node.exe binary to execute malicious JavaScript payloads, eva… | — | 2026-10-03 |
| An Inside Look at Voice Phishing Campaigns in Microsoft Teams | Between January and April 2026, a coordinated social engineering operation named Spring Ring leveraged external Microsoft Teams accounts to impersonate IT help desk personnel, targeting over 150 employees across at least 10 companies. Adver… | — | 2026-09-30 |
| Major vulnerability found in ancient TACACS+ networking protocol | Australian security firm Elttam discovered a critical pre-authentication remote code execution vulnerability in TACACS+, a 33-year-old protocol handling authentication on networking equipment. The protocol, released by Cisco in 1993 and now… | — | 2026-09-25 |
| Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | In 2026, the DPRK-sponsored Lazarus subgroup TraderTraitor continued campaigns targeting cryptocurrency entities, including a high-profile attack on LayerZero resulting in $292 million theft from KelpDAO. Following this disclosure, an addit… | — | 2026-09-21 |
| How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino Garbage | Illegal online gambling infrastructure spans three distinct cybercrime categories that defenders often overlook. First, over 1.7 million Chinese-language casino domains facilitate illegal gambling and transnational money laundering, primari… | — | 2026-09-16 |
| The banana stand: brokering and managing infections across Asia using MQTT | BambooToken is an emerging multiplatform malware family active since at least February 2023, utilizing the Message Queueing and Telemetry Transport (MQTT) protocol for covert command and control operations. The campaign targets Windows and … | — | 2026-09-16 |
| Active Cloud Data Theft and Extortion Campaign Targeting Microsoft 365 and SaaS Platforms | A widespread IT impersonation and voice-phishing campaign designated PREY-0058 is actively targeting Microsoft 365 and SaaS platforms. Threat actors impersonate IT helpdesk staff via phone or text to trick executives and senior personnel in… | — | 2026-09-10 |
| Authentication Bypass Vulnerability in N-central Exploited In-The-Wild | An authentication bypass vulnerability, CVE-2026-18577, affecting N-able N-central Remote Monitoring and Management platform has been actively exploited since August 1, 2026. This vulnerability emerged after an incomplete fix for a previous… | — | 2026-09-05 |
| Fake AI Tools Deliver Infostealer | In April 2026, a Malware-as-a-Service NodeJS infostealer campaign evolved its delivery methods, shifting from ClickFix social engineering to weaponized GitHub repositories. Attackers clone legitimate AI-related repositories and developer to… | — | 2026-09-04 |
Techniques used by the actors above — what to detect for, ranked by how many of them use it.
| Technique | ATT&CK | Used by | Actors |
|---|---|---|---|
| Browser Information Discovery | T1217 | Chimera, Scattered Spider | 2 |
| Domain Account | T1087.002 | Chimera, Scattered Spider | 2 |
| Exfiltration Over C2 Channel | T1041 | Chimera, Scattered Spider | 2 |
| Exfiltration to Cloud Storage | T1567.002 | Chimera, Scattered Spider | 2 |
| External Remote Services | T1133 | Chimera, Scattered Spider | 2 |
| File and Directory Discovery | T1083 | Chimera, Scattered Spider | 2 |
| Ingress Tool Transfer | T1105 | Chimera, Scattered Spider | 2 |
| NTDS | T1003.003 | Chimera, Scattered Spider | 2 |
| PowerShell | T1059.001 | Chimera, Scattered Spider | 2 |
| Protocol Tunneling | T1572 | Chimera, Scattered Spider | 2 |
| Remote Desktop Protocol | T1021.001 | Chimera, Scattered Spider | 2 |
| Remote System Discovery | T1018 | Chimera, Scattered Spider | 2 |
| System Network Configuration Discovery | T1016 | Chimera, Scattered Spider | 2 |
| Tool | T1588.002 | Chimera, Scattered Spider | 2 |
| Valid Accounts | T1078 | Chimera, Scattered Spider | 2 |
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2021-25320 | 10.0 | A vulnerability was discovered in Rancher 2.2.0 through the aforementioned patched versions, where cloud credentials weren't being properly validated through the Rancher API. Specifically through a proxy designed to comm… | |
| CVE-2026-27702 | 9.9 | ## Summary A critical unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. **This vul… | |
| GHSA-3hfp-gqgh-xc5g | 9.7 | ### Impact A supply chain attack on the `axios` npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency (`[email protected]`) that deploys a cross-platform remote access trojan (RAT) on… | |
| CVE-2026-45758 | 9.6 | ### Impact On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `guardrails-ai` (0.10.1) to PyPI. **Affected:** any user who installed `guardrails-ai==0.10.1` from PyPI on May … | |
| GHSA-jpvj-wpmj-h7rv | 9.6 | ### Impact On May 19, 2026, a compromised version of @cap-js/[email protected] was published. The malicious packages harvested credentials and attempted self-propagation. If a compromised version was installed, all credenti… | |
| GHSA-gr3r-crp5-qrrm | 9.3 | ### Impact On April 30, 2026, a malicious commit was pushed to the intercom/intercom-php repository and tagged as version 5.0.2, using a compromised service account (github-management-service). This occurred as part of … | |
| CVE-2026-15143 | 9.3 | A flaw was found in the file_type content detector of guardrails-detectors. This vulnerability allows a remote attacker to supply an arbitrary XML Schema Definition (XSD) string, which is processed without proper restric… | |
| GHSA-54pg-9963-v8vg | 9.3 | ### Impact On April 30, 2026, version 7.0.4 of intercom-client was published to npm using credentials obtained from a compromised developer account. This version was not produced by Intercom's build pipeline. The malic… | |
| CVE-2026-27197 | 9.1 | ### Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via our private bug bounty program. The vulnerability allows an attacker to take over any user account b… | |
| CVE-2026-42354 | 9.1 | ### Impact A critical vulnerability was discovered in the SAML SSO implementation of Sentry. It was reported to us via Sentry's private bug bounty program. The vulnerability allows an attacker to take over any user acco… | |
| CVE-2026-81093 | 8.6 | The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, … | |
| CVE-2025-67508 | 8.4 | gardenctl is a command-line client for the Gardener which configures access to clusters and cloud provider CLI tools. When using non‑POSIX shells such as Fish and PowerShell, versions 2.11.0 and below of gardenctl allow … | |
| CVE-2026-49260 | 8.2 | ### Summary `pontedilana/php-weasyprint` builds the shell command for WeasyPrint by passing the binary path through `escapeshellarg()` first and then checking the *quoted* result with `is_executable()`. On POSIX `escape… | |
| CVE-2026-41654 | 8.1 | ### Impact An authenticated user with `project.add` permission (default on hosted Weblate SaaS and for any user holding an active billing/trial plan) can import a crafted project backup ZIP whose `components/<name>.json`… | |
| GHSA-48m6-ch88-55mj | 8.1 | ### Summary An improper mass assignment (JSON injection) vulnerability in the account registration endpoint of Flowise Cloud allows unauthenticated attackers to inject server-managed fields and nested objects during acc… |
Named leak-site victims classified into this sector (ransomware.live taxonomy), most recent first.
No ransomware victims currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
Get a daily email when something new touches technology — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.