Technology threat landscape
Software vendors, SaaS, MSPs and semiconductors — supply-chain leverage makes one intrusion into many.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 21
- Actively-attacked vulnerabilities (CISA KEV)
- 5
- Ransomware victims, last 90 days
- 364
- Ransomware victims, since 2026-06
- 508
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity. Showing 15 of 21.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| UNC3886 | UNC3886 is a China-nexus cyberespionage group that has been active since at least 2022, targeting defense, technology, and telecommunication organizations located in the United States and the Asia-Pa… | 574 |
| Scattered Spider | Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. T… | 423 |
| LAPSUS$ | LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion opera… | 365 |
| Aquatic Panda | Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org… | 238 |
| Threat Group-3390 | Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has target… | 224 |
| APT41 | APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, [APT41](https://atta… | 210 |
| APT17 | APT17 is a China-based threat group that has conducted network intrusions against U.S. government entities, the defense industry, law firms, information technology companies, mining companies, and no… | 209 |
| POLONIUM | POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February… | 194 |
| Tonto Team | Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded… | 168 |
| FIN8 | FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology,… | 166 |
| Fox Kitten | Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North Am… | 164 |
| WIRTE | WIRTE is a cyberespionage actor, believed to be a subgroup of the Hamas-affiliated Gaza Cybergang, that has been active since at least August 2018. WIRTE has… | 153 |
| menuPass | menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Mi… | 153 |
| Chimera | Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Ch… | 121 |
| APT12 | APT12 is a threat group that has been attributed to China. The group has targeted a variety of victims including but not limited to media outlets, high-tech companies, and multiple governments.(Citat… | 110 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 86.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| SolarWinds Compromise | The SolarWinds Compromise was a sophisticated supply chain cyber operation conducted by APT29 that was discovered in mid-December 2020. [APT29](https://att… | APT29 | — |
| Cutting Edge | Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of… | — | — |
| Operation Wocao | Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and th… | — | — |
| Versa Director Zero Day Exploitation | Versa Director Zero Day Exploitation was conducted by Volt Typhoon from early June through August 2024 as zero-day exploitation of Versa Director servers c… | Volt Typhoon | — |
| Indian Critical Infrastructure Intrusions | Indian Critical Infrastructure Intrusions is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly [RedEcho](https://attack.m… | — | — |
| J-magic Campaign | The J-magic Campaign was active from mid-2023 to at least mid-2024 and featured the use of the J-magic backdoor, a custom cd00r variant tailored for use… | — | — |
| Operation CuckooBees | Operation CuckooBees was a cyber espionage campaign targeting technology and manufacturing companies in East Asia, Western Europe, and North America since at least 2019. Security researchers noted… | — | — |
| Anthropic AI-orchestrated Campaign | The Anthropic AI-orchestrated Campaign was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The [Anthropic AI-orchestrated Campaign](https://attack.mitre… | — | — |
| AOMEI Backupper update servers hijacked to push malware: Check your PC | Between April and July 2026, attackers compromised AOMEI Technology's update and notification infrastructure to distribute malware to users of AOMEI Backupper, backup software used by over 100 million people worldwide. During three confirme… | — | 2026-10-19 |
| Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | In 2026, the DPRK-sponsored Lazarus subgroup TraderTraitor continued campaigns targeting cryptocurrency entities, including a high-profile attack on LayerZero resulting in $292 million theft from KelpDAO. Following this disclosure, an addit… | — | 2026-10-19 |
| Lazarus luring employees with trojanized coding challenges: The case of a Spanish aerospace company | ESET researchers uncovered a Lazarus attack against a Spanish aerospace company where attackers masqueraded as Meta recruiters on LinkedIn, sending trojanized coding challenges to employees. The campaign deployed multiple tools including Li… | — | 2026-10-18 |
| How Money Laundering, Scams, and Espionage Hide in a Web Full of Casino Garbage | Illegal online gambling infrastructure spans three distinct cybercrime categories that defenders often overlook. First, over 1.7 million Chinese-language casino domains facilitate illegal gambling and transnational money laundering, primari… | — | 2026-10-16 |
| The banana stand: brokering and managing infections across Asia using MQTT | BambooToken is an emerging multiplatform malware family active since at least February 2023, utilizing the Message Queueing and Telemetry Transport (MQTT) protocol for covert command and control operations. The campaign targets Windows and… | — | 2026-10-16 |
| DragonForce Ransomware Profile: From Affiliate Program to Cybercrime Cartel | DragonForce is a financially motivated ransomware operation that emerged in August 2023, initially using leaked LockBit 3.0 code and later transitioning to Conti v3-based variants. Operating as a Ransomware-as-a-Service model, they offer af… | — | 2026-10-15 |
| Malicious Twitch Browser Extension Exposes 30,000 Users' OAuth Tokens to Russian Bot Service | A malicious browser extension called 'Twitch Enhanced Viewer | JeetBot' distributed on Chrome Web Store and Firefox Add-ons captures and forwards users' live Twitch OAuth session tokens to Russian-controlled proxy servers. The extension, wi… | — | 2026-10-11 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 278.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 5 total, latest below.
| CVE | Vulnerability | Vendor / product | KEV added |
|---|---|---|---|
| CVE-2025-24993 | Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability | Microsoft · Windows | 2025-03-11 |
| CVE-2025-24991 | Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability | Microsoft · Windows | 2025-03-11 |
| CVE-2025-24984 | Microsoft Windows NTFS Information Disclosure Vulnerability | Microsoft · Windows | 2025-03-11 |
| CVE-2017-5689 | Intel Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability Privilege Escalation Vulnerability | Intel · Active Management Technology (AMT), Small Business Technology (SBT), and Standard Manageability | 2022-01-28 |
| CVE-2021-31956 | Microsoft Windows NTFS Privilege Escalation Vulnerability | Microsoft · Windows | 2021-11-03 |
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2025-9846 | 10.0 | Unrestricted Upload of File with Dangerous Type vulnerability in TalentSys Consulting Information Technology Industry Inc. Inka.Net allows Command Injection. This issue affects Inka.Net: before 6.7.1.… | |
| CVE-2021-25320 | 10.0 | A vulnerability was discovered in Rancher 2.2.0 through the aforementioned patched versions, where cloud credentials weren't being properly validated through the Rancher API. Specifically through a proxy designed to comm… | |
| CVE-2026-106126 | 9.9 | A command injection vulnerability in the Active Directory Events Listener of Tenable Identity Exposure (SaaS) allows an authenticated, low-privileged attacker to execute arbitrary commands as SYSTEM on the PDCe.… | |
| CVE-2026-27702 | 9.9 | ## Summary A critical unsafe `eval()` vulnerability in Budibase's view filtering implementation allows any authenticated user (including free tier accounts) to execute arbitrary JavaScript code on the server. **This vul… | |
| CVE-2026-5134 | 9.8 | Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Loca Software Informatics Technology Ltd. Co. CMS allows SQL Injection. This issue affects CMS: through 06082026. NOT… | |
| CVE-2025-15228 | 9.8 | BPMFlowWebkit developed by WELLTEND TECHNOLOGY has a Arbitrary File Upload vulnerability, allowing unauthenticated remote attackers to upload and execute web shell backdoors, thereby enabling arbitrary code execution on … | |
| CVE-2026-75957 | 9.8 | The Ultimate Multisite – WordPress Multisite SaaS & WaaS Platform plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.15.0 via the `checkout_form` parameter of the `login_c… | |
| CVE-2025-6919 | 9.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Cats Information Technology Software Development Technologies Aykome License Tracking System allows SQL Injection. Th… | |
| CVE-2026-78211 | 9.8 | 4MOSAn GCB Doctor developed by 4MOSAn Security Technology has a OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby e… | |
| CVE-2026-78799 | 9.8 | Directory Traversal vulnerability in Quanxun Huiju Network Technology (Beijing) Co., Ltd IK-Q3000 Enterprise-grade Wi-Fi 6 wireless router Enterprise Edition: <= iKuai8_3.7.23_Enterprise Build 202606021825 - Free Edition… | |
| CVE-2025-11253 | 9.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Aksis Technology Inc. Netty ERP allows SQL Injection. This issue affects Netty ERP: before V.1.1000.… | |
| CVE-2026-80235 | 9.8 | EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the s… | |
| CVE-2025-6520 | 9.8 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Abis Technology BAPSIS allows Blind SQL Injection. This issue affects BAPSIS: before 202510271606.… | |
| GHSA-3hfp-gqgh-xc5g | 9.7 | ### Impact A supply chain attack on the `axios` npm package (versions 1.14.1 and 0.30.4) introduced a malicious transitive dependency (`plain-crypto-js@4.2.1`) that deploys a cross-platform remote access trojan (RAT) on… | |
| CVE-2026-45758 | 9.6 | ### Impact On May 11, 2026 at approximately 6:00 PM Pacific, an attacker published a malicious version of `guardrails-ai` (0.10.1) to PyPI. **Affected:** any user who installed `guardrails-ai==0.10.1` from PyPI on May … |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Technology), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| WalkingTree Technologies | qilin | 2026-10-19 |
| PingCAP / TiDB Cloud | fulcrumsec | 2026-10-19 |
| Amagi Media Labs | N0n | 2026-10-18 |
| Telecom Egypt | N0n | 2026-10-18 |
| exo.inc | settra | 2026-10-18 |
| oakgrovetech | dragonforce | 2026-10-17 |
| polisee Inc | Vexy Ransomware | 2026-10-17 |
| AirQ | thegentlemen | 2026-10-17 |
| Taekwang Network | everest | 2026-10-17 |
| MicroSearch Corporation | play | 2026-10-16 |
| Data-Core Systems | Vexy Ransomware | 2026-10-16 |
| Solar Communications International | pear | 2026-10-16 |
| Netcore Unbxd | thegentlemen | 2026-10-16 |
| Cradlewise Inc. | THE SEVEN DEADLY SINS | 2026-10-16 |
| Canva | THE SEVEN DEADLY SINS | 2026-10-16 |
Most active crews · since 2026-06
- thegentlemen64
- qilin48
- krybit18
- settra17
- everest16
- direwolf14
- nova14
- incransom13
- shinyhunters12
- dragonforce11
- AuditTeam10
- Deadlock10
- N0n10
- clop10
- play10
watch this sector
Get a daily email when something new touches technology — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.