✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1873 to 1884 of 5141
CISA Adds Four New Vulnerabilities to Known Exploited Vulnerabilities Catalog
On April 24, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. The vulnerabilities include CVE-2024-7399 (Samsung MagicINFO 9 Server Path Traversal), CVE-2024-57726 (SimpleHelp Missing Authorization), CVE-2024-57728 (SimpleHelp Path Traversal), and CVE-2025-29635 (D-Link DIR-823X Command Injection). These vulnerabilities are commonly targeted by malicious actors and pose significant risks to federal enterprises. The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched software. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation and protect their networks from active threats.
3 months ago
Kill Chain
CISA Adds 4 Exploited Flaws to KEV Catalog, Sets May 2026 Deadline
In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities affecting SimpleHelp, Samsung MagicINFO 9 Server, and D-Link DIR-823X series routers to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. These vulnerabilities include CVE-2024-57726, a missing authorization flaw in SimpleHelp allowing privilege escalation; CVE-2024-57728, a path traversal issue in SimpleHelp enabling arbitrary file uploads; CVE-2024-7399, a path traversal vulnerability in Samsung MagicINFO 9 Server permitting arbitrary file writes; and CVE-2025-29635, a command injection flaw in D-Link DIR-823X routers allowing remote command execution. Federal agencies are mandated to address these vulnerabilities by May 8, 2026. The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by unpatched software in critical infrastructure. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation, especially as some of these vulnerabilities have been linked to ransomware campaigns and botnet deployments in the past.
3 months ago
Kill Chain
Unveiling 'fast16': The Pre-Stuxnet Malware Targeting Engineering Software
In April 2026, SentinelOne researchers uncovered 'fast16,' a previously undocumented Lua-based malware framework dating back to 2005. This sophisticated tool targeted high-precision engineering and physics simulation software, subtly altering calculations to introduce systematic errors. Unlike typical malware of its era, fast16 was engineered for strategic sabotage, potentially undermining scientific research and engineering projects without immediate detection. The discovery of fast16 highlights the advanced capabilities of state-sponsored cyber operations predating known incidents like Stuxnet. It underscores the long-standing use of cyber tools for covert sabotage, emphasizing the need for vigilance in protecting critical infrastructure and sensitive research from such sophisticated threats.
3 months ago
Kill Chain
CISA Adds CVE-2026-39987: Marimo RCE Vulnerability
In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-39987 to its Known Exploited Vulnerabilities (KEV) Catalog, highlighting active exploitation of a critical remote code execution vulnerability in Marimo, a reactive Python notebook application. This flaw, present in versions prior to 0.23.0, allows unauthenticated attackers to gain full pseudo-terminal shell access via the /terminal/ws WebSocket endpoint, enabling arbitrary command execution on the host system. The vulnerability arises from the endpoint's failure to enforce authentication, unlike other WebSocket endpoints in the application. Marimo has addressed this issue in version 0.23.0 by implementing proper authentication checks. Organizations using affected versions are urged to update immediately to mitigate potential risks. ([securityvulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-39987?utm_source=openai)) The inclusion of CVE-2026-39987 in CISA's KEV Catalog underscores the ongoing threat posed by unpatched vulnerabilities in widely used development tools. This incident highlights the critical need for organizations to maintain up-to-date software and implement robust security measures to protect against unauthorized access and potential data breaches.
3 months ago
Kill Chain
Critical Vulnerability in Xiongmai XM530 IP Cameras: CVE-2025-65856
In December 2025, a critical authentication bypass vulnerability, identified as CVE-2025-65856, was discovered in Xiongmai XM530 IP cameras running Firmware V5.00.R02.000807D8.10010.346624.S.ONVIF 21.06. This flaw allows unauthenticated remote attackers to access sensitive device information and live video streams by exploiting the ONVIF implementation, which fails to enforce authentication on 31 critical endpoints. The vulnerability poses significant privacy and security risks to organizations and individuals relying on these surveillance devices. The public release of proof-of-concept exploit code in April 2026 has heightened the urgency for remediation. Despite the severity of the issue, the manufacturer has yet to provide a patch, leaving thousands of devices worldwide vulnerable to potential exploitation.
3 months ago
Kill Chain
Defending Against China-Nexus Covert Networks of Compromised Devices
In April 2026, a joint advisory from the National Cyber Security Centre (NCSC) and 15 international partners highlighted a significant shift in tactics by China-nexus cyber actors. These actors have transitioned from using individually procured infrastructure to operating large-scale 'covert networks'—botnets composed of compromised routers and other edge devices. These networks are utilized across all phases of the cyber kill chain, including reconnaissance, malware delivery, command and control, and data exfiltration, posing a substantial threat to organizations worldwide. The advisory underscores the dynamic and low-cost nature of these covert networks, which can be rapidly reshaped, rendering traditional static IP block lists ineffective. Organizations are urged to adopt adaptive, intelligence-driven measures to mitigate the risks associated with these evolving threats.
3 months ago
Kill Chain
SpiceJet Online Booking System Vulnerabilities Expose Passenger Data
In April 2026, two critical vulnerabilities were identified in SpiceJet's Online Booking System: CVE-2026-6375 and CVE-2026-6376. These flaws allowed unauthenticated users to access passenger name records (PNRs) and full booking details using only a PNR and last name, due to missing authorization checks and authentication mechanisms. This exposed sensitive personal and travel information to potential exploitation. ([securityvulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-6376?utm_source=openai)) The incident underscores the importance of robust access controls in online systems, especially in the transportation sector. Organizations must prioritize securing sensitive customer data to prevent unauthorized access and potential misuse.
3 months ago
Kill Chain
CISA Adds CVE-2026-33825 to Known Exploited Vulnerabilities Catalog
In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33825 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting active exploitation of a privilege escalation flaw in Microsoft Defender. This vulnerability, known as 'BlueHammer,' allows attackers with limited local access to escalate privileges to SYSTEM level due to insufficient access control granularity. The flaw was publicly disclosed by a researcher named 'Chaotic Eclipse' after dissatisfaction with Microsoft's vulnerability disclosure process, leading to the release of exploit details online. ([techradar.com](https://www.techradar.com/pro/security/cisa-puts-us-government-agencies-on-two-week-deadline-to-patch-microsoft-defender-bluehammer-zero-day-exploit?utm_source=openai)) The inclusion of CVE-2026-33825 in the KEV catalog underscores the critical nature of this vulnerability and the urgency for organizations to apply patches. CISA has mandated that Federal Civilian Executive Branch agencies remediate this vulnerability by May 6, 2026, to mitigate the risk of active exploitation. ([techradar.com](https://www.techradar.com/pro/security/cisa-puts-us-government-agencies-on-two-week-deadline-to-patch-microsoft-defender-bluehammer-zero-day-exploit?utm_source=openai))
3 months ago
Kill Chain
U.S. Government Targets Southeast Asian Cyber Scam Networks Exploiting Forced Labor
In April 2026, the U.S. government executed a coordinated crackdown on Southeast Asian cyber scam operations targeting American citizens. This initiative led to the indictment of two Chinese nationals managing a scam compound in Myanmar, sanctions against 29 individuals—including a Cambodian senator—and the seizure of over 500 fraudulent investment websites. These operations exploited forced labor to conduct social engineering attacks, deceiving victims into transferring funds to fake cryptocurrency investment platforms. The financial impact on American victims was substantial, with losses amounting to billions of dollars. This incident underscores the escalating threat posed by transnational cybercrime networks employing sophisticated social engineering tactics. The involvement of high-ranking officials and the use of forced labor highlight the complexity and scale of these operations. It also reflects the increasing collaboration between international law enforcement agencies to combat such threats, emphasizing the need for continuous vigilance and adaptive cybersecurity measures.
3 months ago
Kill Chain
UNC6692's 'Snow' Malware: A New Threat via Microsoft Teams
In April 2026, the threat group UNC6692 executed a sophisticated social engineering attack targeting enterprise networks. The attackers initiated the campaign by overwhelming victims' email inboxes with spam, creating a sense of urgency. Subsequently, they impersonated IT helpdesk staff via Microsoft Teams, convincing users to install a purported spam-blocking patch. This led to the deployment of a custom malware suite named 'Snow,' comprising components like SnowBelt (a malicious browser extension), SnowGlaze (a tunneling tool), and SnowBasin (a backdoor). These tools facilitated deep network penetration, credential theft, and domain takeover, enabling the exfiltration of sensitive data. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/threat-actor-uses-microsoft-teams-to-deploy-new-snow-malware/?utm_source=openai)) This incident underscores the evolving tactics of cyber adversaries who exploit trusted communication platforms and social engineering to bypass traditional security measures. The use of Microsoft Teams as an attack vector highlights the need for heightened vigilance and robust security protocols in enterprise environments to counteract such sophisticated threats.
3 months ago
Kill Chain
Itron Reports Cybersecurity Breach in Internal Systems
In April 2026, Itron, Inc., a leading utility technology company, disclosed a cybersecurity incident where an unauthorized third party accessed certain internal systems. Upon detection on April 13, 2026, Itron activated its cybersecurity response plan, engaged external advisors, and notified law enforcement. The company successfully contained the unauthorized activity, with no observed follow-up incidents. Importantly, customer-hosted systems remained unaffected, and business operations continued without material disruption. Itron anticipates that a significant portion of the incident-related costs will be reimbursed by insurance. ([sec.gov](https://www.sec.gov/Archives/edgar/data/780571/000119312526175249/d125229d8k.htm?utm_source=openai)) This incident underscores the persistent threat of cyberattacks targeting critical infrastructure sectors. As utility companies increasingly digitize operations, they become more attractive targets for cyber adversaries. The swift response and containment by Itron highlight the importance of robust cybersecurity measures and incident response plans in mitigating potential impacts on essential services.
3 months ago
Kill Chain
BlackFile's Vishing Attacks: A Wake-Up Call for Retail and Hospitality Sectors
In early 2026, the BlackFile extortion group initiated a series of data theft and extortion attacks targeting retail and hospitality organizations. Employing voice phishing (vishing) tactics, they impersonated IT support staff to deceive employees into divulging credentials and one-time passcodes. With these credentials, BlackFile registered their own devices to bypass multi-factor authentication, escalated access to executive accounts, and exfiltrated sensitive data from platforms like Salesforce and SharePoint. The stolen data was then used to pressure victims into paying seven-figure ransoms, with threats of public disclosure on their dark web leak site. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, highlighting the increasing prevalence of vishing attacks that exploit human vulnerabilities rather than technical system flaws. The success of such social engineering methods emphasizes the need for organizations to enhance employee training and implement robust verification protocols to mitigate similar threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai))
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
