✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1801 to 1812 of 5141
Global Crackdown on Cryptocurrency Fraud Leads to 276 Arrests
In April 2026, a coordinated international operation led by Dubai Police, in collaboration with U.S. and Chinese authorities, resulted in the arrest of at least 276 individuals and the dismantling of nine cryptocurrency investment fraud centers. These centers orchestrated 'pig-butchering' schemes, where scammers built trust with victims through fabricated relationships, ultimately luring them into fake cryptocurrency investment platforms that drained their funds. The operation targeted crime networks running these schemes, leading to significant arrests and the disruption of fraudulent activities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/police-dismantles-9-crypto-investment-scam-centers-arrests-276-suspects/?utm_source=openai)) This incident underscores the escalating threat of sophisticated financial fraud schemes exploiting the cryptocurrency market. The substantial losses incurred highlight the urgent need for enhanced regulatory measures and public awareness to combat such deceptive practices effectively.
3 months ago
Kill Chain
FBI Reports 60% Increase in Cyber-Enabled Cargo Thefts in 2025
In 2025, the FBI reported a 60% increase in cyber-enabled cargo thefts across the U.S. and Canada, totaling nearly $725 million in losses. Threat actors infiltrated freight brokers and carriers through phishing emails and fake web links, gaining unauthorized access to systems. They then posted fraudulent listings on online load boards, impersonated legitimate companies, and diverted high-value shipments for resale. The Diesel Vortex group, active since September 2025, targeted freight and logistics operators in the U.S. and Europe, compromising numerous platforms and stealing credentials. This surge underscores the evolving tactics of cybercriminals who exploit digital vulnerabilities to execute physical thefts. The transportation and logistics sectors must enhance cybersecurity measures to protect against such sophisticated attacks.
3 months ago
Kill Chain
Bluekit: The AI-Powered Phishing Kit Revolutionizing Cyber Attacks
In April 2026, a new phishing kit named Bluekit emerged, offering over 40 templates targeting popular services such as Outlook, Gmail, iCloud, GitHub, and Ledger. Notably, Bluekit integrates an AI Assistant panel supporting models like Llama, GPT-4.1, Claude, Gemini, and DeepSeek, aiding cybercriminals in drafting phishing emails. This all-in-one platform streamlines phishing operations by combining domain registration, phishing page setup, and campaign management into a single interface. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-bluekit-phishing-service-includes-an-ai-assistant-40-templates/?utm_source=openai)) The introduction of AI-driven tools like Bluekit signifies a concerning trend in cybercrime, where artificial intelligence is leveraged to enhance the scale and sophistication of phishing attacks. This development underscores the urgent need for organizations to bolster their cybersecurity measures and stay vigilant against increasingly automated and intelligent threats. ([varonis.com](https://www.varonis.com/blog/bluekit?hsLang=en&utm_source=openai))
3 months ago
Kill Chain
PyTorch Lightning Supply Chain Attack: What You Need to Know
In April 2026, threat actors compromised the PyTorch Lightning package by publishing malicious versions 2.6.2 and 2.6.3 on the Python Package Index (PyPI). These versions contained obfuscated JavaScript payloads that executed upon import, leading to the theft of credentials, authentication tokens, and cloud secrets. The attack also attempted to poison GitHub repositories by creating public repositories with names like 'EveryBoiWeBuildIsaWormBoi'. The malicious versions were quickly identified and removed from PyPI, and developers were advised to downgrade to version 2.6.1 and rotate any potentially exposed credentials. ([semgrep.dev](https://semgrep.dev/blog/2026/malicious-dependency-in-pytorch-lightning-used-for-ai-training?utm_source=openai)) This incident underscores the growing trend of supply chain attacks targeting widely-used open-source packages. The rapid detection and response highlight the importance of vigilant monitoring and prompt action in mitigating such threats. Organizations are reminded to regularly audit their dependencies and implement robust security practices to protect against similar attacks.
3 months ago
Kill Chain
Huge Networks' Infrastructure Exploited in Massive DDoS Attacks on Brazilian ISPs
In April 2026, Huge Networks, a Brazilian firm specializing in DDoS mitigation, was implicated in orchestrating massive DDoS attacks against Brazilian ISPs. An exposed archive revealed that a threat actor had root access to Huge Networks' infrastructure, utilizing it to build a botnet by exploiting vulnerabilities in TP-Link Archer AX21 routers, specifically CVE-2023-1389. The botnet conducted DNS amplification attacks, significantly impacting targeted ISPs. Huge Networks' CEO attributed the malicious activity to a security breach, suggesting a competitor's involvement to tarnish the company's reputation. This incident underscores the persistent threat posed by botnets leveraging IoT vulnerabilities, even years after patches are released. It highlights the critical need for organizations to secure their infrastructure and monitor for unauthorized access to prevent exploitation in large-scale cyberattacks.
3 months ago
Kill Chain
AI Uncovers Critical Vulnerabilities in OpenEMR EHR Platform
In April 2026, an AI-driven analysis by cybersecurity firm Aisle uncovered 38 previously unknown vulnerabilities in OpenEMR, an open-source electronic health record platform utilized by over 100,000 healthcare providers globally. These vulnerabilities, ranging from medium to critical severity, included issues like missing authorization checks, cross-site scripting (XSS), SQL injection, path traversal, and session-related flaws. Exploitation of these vulnerabilities could have led to full database compromises, large-scale exfiltration of protected health information (PHI), and remote code execution on servers. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/ai-finds-38-security-flaws-openemr?utm_source=openai)) The rapid identification and remediation of these flaws underscore the transformative impact of AI in vulnerability research, significantly reducing the time required for such analyses. However, this also highlights the growing challenge for security teams to triage and address the increasing volume of discovered vulnerabilities, emphasizing the need for robust and proactive cybersecurity measures in the healthcare sector.
3 months ago
Kill Chain
Critical RCE Vulnerability CVE-2026-3854 in GitHub Enterprise Server
In March 2026, a critical remote code execution (RCE) vulnerability, CVE-2026-3854, was identified in GitHub Enterprise Server. This flaw allowed attackers with push access to a repository to execute arbitrary code on the server by exploiting improperly sanitized push option values during git push operations. The vulnerability was reported by cloud security firm Wiz through GitHub's bug bounty program and was promptly addressed by GitHub, with patches released for affected versions. The discovery of CVE-2026-3854 underscores the evolving landscape of cybersecurity threats, particularly the role of AI in identifying vulnerabilities within closed-source binaries. This incident highlights the necessity for organizations to adopt proactive security measures and stay vigilant against emerging attack vectors facilitated by advanced technologies.
3 months ago
Kill Chain
Claude Mythos AI Exposes Critical Vulnerabilities in Japan's Financial Systems
In April 2026, Anthropic's advanced AI model, Claude Mythos, demonstrated the capability to autonomously identify and exploit previously unknown vulnerabilities across major operating systems and web browsers. This revelation prompted Japan's financial authorities, including the Financial Services Agency and the Bank of Japan, to establish a task force aimed at mitigating potential cybersecurity threats to the nation's financial infrastructure. The task force's formation underscores the urgency of addressing AI-driven cyber risks in a sector heavily reliant on interconnected and legacy systems. The emergence of AI models like Claude Mythos signifies a paradigm shift in cybersecurity, where the speed and sophistication of potential attacks could outpace traditional defense mechanisms. Financial institutions worldwide are now compelled to reassess and fortify their security postures to counteract the evolving threat landscape posed by advanced AI capabilities.
3 months ago
Kill Chain
EtherRAT Campaign: A New Era of Malware Distribution via GitHub and Ethereum
In March 2026, a sophisticated cyber campaign was identified targeting enterprise administrators, DevOps engineers, and security analysts. The attackers employed SEO poisoning to manipulate search engine results, leading victims to GitHub repositories that impersonated legitimate administrative tools. These repositories hosted malicious MSI installers, which, upon execution, deployed EtherRAT—a Node.js-based backdoor. Notably, EtherRAT utilized Ethereum smart contracts to dynamically resolve command-and-control (C2) addresses, enhancing the malware's resilience and evasion capabilities. This incident underscores a strategic shift in cyberattack methodologies, combining social engineering with decentralized technologies to evade detection and maintain persistence. The use of blockchain for C2 infrastructure highlights the evolving tactics of threat actors, necessitating adaptive defense strategies to counter such innovative threats.
3 months ago
Kill Chain
Critical Security Update for ABB PCM600: Addressing CVE-2018-1002208
In November 2025, ABB disclosed a critical vulnerability (CVE-2018-1002208) in its Protection and Control IED Manager PCM600 software, versions 1.5 through 2.13. This flaw, stemming from the SharpZipLib component, allows attackers to execute arbitrary code by sending specially crafted messages to the system node. The vulnerability, known as 'Zip-Slip,' involves improper limitation of a pathname to a restricted directory, leading to path traversal issues. ABB has addressed this issue in PCM600 version 2.14 and recommends users update promptly. ([cyber.gc.ca](https://www.cyber.gc.ca/en/alerts-advisories/control-systems-abb-security-advisory-av25-719?utm_source=openai)) The disclosure underscores the persistent risks associated with third-party libraries in industrial control systems. Organizations must remain vigilant, ensuring timely updates and implementing robust security measures to protect critical infrastructure from evolving cyber threats.
3 months ago
Kill Chain
Critical Authentication Bypass Vulnerability in ABB Ability OPTIMAX (CVE-2025-14510)
In January 2026, ABB disclosed a critical vulnerability (CVE-2025-14510) in its Ability OPTIMAX software, widely used in industrial optimization. The flaw, stemming from an incorrect implementation of the authentication algorithm, affects versions 6.1, 6.2, 6.3.0 before 6.3.1-251120, and 6.4.0 before 6.4.1-251120. Exploitation could allow remote attackers to bypass authentication, potentially compromising confidentiality, integrity, and availability of industrial control systems. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2025-14510/?utm_source=openai)) This incident underscores the escalating risks in industrial control systems due to authentication vulnerabilities. With increasing integration of such systems into broader networks, the potential for unauthorized access and operational disruption grows, highlighting the need for robust security measures and timely patch management.
3 months ago
Kill Chain
Critical Vulnerability in ABB's IEC 61850 Communication Stack (CVE-2025-3756)
In April 2026, ABB disclosed a vulnerability (CVE-2025-3756) in the IEC 61850 communication stack used in its System 800xA and Symphony Plus products. An attacker with access to the IEC 61850 network could exploit this flaw by sending specially crafted packets, causing the PM 877, CI850, and CI868 modules to enter a fault state, or rendering the S+ Operations 61850 connectivity unavailable, leading to a denial-of-service condition. The overall functionality of the S+ Operations node remains unaffected; only the IEC 61850 communication function is impacted. Affected versions include AC800M (System 800xA) from 6.0.0x through 6.2.0006.0, Symphony Plus SD Series versions A_0 through B_0.005, Symphony Plus MR versions 3.10 through 3.52, and S+ Operations versions 2.1 through 3.3. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-3756?utm_source=openai)) This vulnerability underscores the critical importance of securing industrial control systems, especially those utilizing the IEC 61850 protocol. As cyber threats targeting operational technology environments continue to evolve, organizations must prioritize timely patching, network segmentation, and robust access controls to mitigate potential risks.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
