✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1933 to 1944 of 5141
Bitwarden CLI npm Package Compromised in Supply Chain Attack
In April 2026, attackers compromised Bitwarden's CLI by uploading a malicious version (2026.4.0) to npm, available between 5:57 PM and 7:30 PM ET on April 22. The malicious package contained credential-stealing malware that harvested developer secrets, including npm tokens, GitHub authentication tokens, SSH keys, and cloud credentials. The malware exfiltrated this data by creating public GitHub repositories under the victim's account. Bitwarden confirmed the incident, stating that the breach was limited to the npm distribution channel for the CLI and did not affect end-user vault data or production systems. The company revoked compromised access, deprecated the malicious release, and initiated remediation steps immediately. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/bitwarden-cli-npm-package-compromised-to-steal-developer-credentials/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting developer tools and CI/CD pipelines. Organizations must enhance their security measures to protect against such vulnerabilities, as similar attacks have been linked to the threat actor known as TeamPCP, who previously targeted developer packages in other supply chain attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/bitwarden-cli-npm-package-compromised-to-steal-developer-credentials/?utm_source=openai))
3 months ago
Kill Chain
The Rise of AI-Driven Cyber Attacks in 2026
In 2026, organizations worldwide faced a significant surge in AI-driven cyberattacks, with adversaries leveraging advanced AI tools to automate and scale their operations. These attacks included hyper-personalized phishing campaigns, AI-enhanced malware, and rapid exploitation of vulnerabilities, leading to substantial financial losses and operational disruptions. The integration of AI into cyberattack methodologies has drastically reduced the time between vulnerability discovery and exploitation, challenging traditional cybersecurity defenses. This escalation underscores the urgent need for organizations to adopt AI-powered defensive measures, enhance threat intelligence capabilities, and implement robust security frameworks to mitigate the evolving risks posed by AI-enhanced cyber threats.
3 months ago
Kill Chain
Project Glasswing: AI's Role in Cybersecurity Vulnerability Detection
In April 2026, Anthropic unveiled Project Glasswing, a collaborative initiative with major technology companies such as Amazon, Apple, Microsoft, and Cisco, aimed at enhancing cybersecurity defenses through advanced AI. Central to this project is Claude Mythos Preview, an unreleased AI model that autonomously identified thousands of previously undetected vulnerabilities across critical software systems, including a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg. To mitigate potential misuse, Anthropic has restricted access to this powerful model to select partners and committed significant resources to support open-source security organizations. This initiative underscores the growing importance of AI in cybersecurity, highlighting both its potential to fortify defenses and the risks associated with its misuse. As AI capabilities advance, the industry faces the dual challenge of leveraging these tools for protection while preventing their exploitation by malicious actors.
3 months ago
Kill Chain
GopherWhisper APT Exploits Go-Based Backdoors to Target Mongolian Government
In January 2025, ESET researchers identified a previously undocumented China-aligned advanced persistent threat (APT) group named GopherWhisper targeting Mongolian governmental institutions. The group employs a suite of tools primarily written in Go, including injectors and loaders, to deploy various backdoors such as LaxGopher, RatGopher, and BoxOfFriends. GopherWhisper leverages legitimate services like Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control (C&C) communications and data exfiltration. The group's activities have been ongoing since at least November 2023, compromising at least 12 systems within a Mongolian government entity. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/04/23/3279634/0/en/ESET-Research-discovers-new-China-aligned-group-GopherWhisper-It-abuses-messaging-services-Discord-Slack-and-Outlook-to-spy.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who exploit widely used communication platforms to evade detection. The use of Go-based malware highlights a trend towards more versatile and cross-platform attack tools, posing significant challenges for traditional security measures. Organizations must adapt their defenses to address these sophisticated techniques.
3 months ago
Kill Chain
Bitwarden CLI Compromised in Checkmarx Supply Chain Attack
In April 2026, Bitwarden's Command Line Interface (CLI) version 2026.4.0 was compromised through a supply chain attack linked to the Checkmarx campaign. Attackers exploited a GitHub Action within Bitwarden's CI/CD pipeline to inject malicious code into the npm package, specifically targeting the 'bw1.js' file. This code executed during installation, leading to the theft of sensitive information such as GitHub and npm tokens, SSH keys, environment variables, shell history, and cloud credentials. The malicious package was available between 5:57 PM and 7:30 PM ET on April 22, 2026, before being identified and removed. Bitwarden confirmed that no end-user vault data or production systems were compromised. ([community.bitwarden.com](https://community.bitwarden.com/t/bitwarden-statement-on-checkmarx-supply-chain-incident/96127?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting CI/CD pipelines, emphasizing the need for robust security measures in software development processes. Organizations are urged to review and fortify their CI/CD workflows to prevent similar breaches.
3 months ago
Kill Chain
UNC6692's Deceptive Use of Microsoft Teams to Deploy SNOW Malware
In April 2026, the threat group UNC6692 executed a sophisticated social engineering campaign targeting corporate employees via Microsoft Teams. By impersonating IT helpdesk staff, they convinced victims to accept chat invitations, leading to the deployment of a custom malware suite known as SNOW. This malware facilitated unauthorized access, data exfiltration, and potential ransomware deployment, significantly compromising organizational security. This incident underscores a growing trend of attackers exploiting trusted communication platforms like Microsoft Teams to bypass traditional security measures. The use of social engineering combined with custom malware highlights the need for enhanced vigilance and robust security protocols to protect against such evolving threats.
3 months ago
Kill Chain
Northern Minerals Suffers Data Breach in 2024 BianLian Ransomware Attack
In late March 2024, Australian rare earths mining company Northern Minerals experienced a cyberattack attributed to the BianLian ransomware group. The attackers exfiltrated corporate, operational, financial, and personal data, including information on current and former employees and shareholders. The stolen data was subsequently published on the dark web. Despite the breach, Northern Minerals reported no material impact on its operations or broader systems. The company promptly engaged legal, technical, and cybersecurity specialists, notified relevant authorities, and implemented measures to strengthen its systems. This incident underscores the evolving tactics of ransomware groups like BianLian, which have shifted from encrypting systems to focusing on data theft and extortion. Organizations, especially those in critical infrastructure sectors, must remain vigilant and enhance their cybersecurity defenses to mitigate such threats.
3 months ago
Kill Chain
The Gentlemen Ransomware Group's Rapid Rise in 2026
In mid-2025, a ransomware group known as 'The Gentlemen' emerged, rapidly escalating its operations to claim over 320 victims by early 2026. Operating under a Ransomware-as-a-Service (RaaS) model, the group employs sophisticated tactics, including the use of SystemBC proxy malware for covert tunneling and payload delivery. Their attacks span multiple industries and geographies, with a notable focus on corporate environments. The Gentlemen's rapid expansion and advanced techniques underscore the evolving threat landscape posed by modern ransomware groups. Organizations must remain vigilant, as the group's continued activity highlights the persistent risk of ransomware attacks targeting enterprises worldwide.
3 months ago
Kill Chain
Chinese APT GopherWhisper Exploits Cloud Services in Mongolian Cyber Espionage
In April 2026, ESET researchers uncovered a Chinese advanced persistent threat (APT) group named GopherWhisper targeting Mongolian government institutions. Active since at least November 2023, GopherWhisper deployed multiple custom backdoors—LaxGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor—each utilizing different cloud services like Slack, Discord, Microsoft Outlook, and file.io for command-and-control communications and data exfiltration. This campaign compromised at least 12 systems within a Mongolian governmental institution, with indications of broader impact across the region. This incident underscores a growing trend of APT groups leveraging legitimate cloud services to evade detection and maintain persistent access. Organizations must enhance their monitoring of cloud-based communications and implement robust security measures to detect and mitigate such sophisticated threats.
3 months ago
Kill Chain
Anthropic's Claude Code Memory Vulnerability: A Wake-Up Call for AI Security
In March 2026, Cisco researchers identified a critical vulnerability in Anthropic's Claude Code AI coding assistant, where compromised memory files allowed attackers to persistently infect projects and sessions. This flaw enabled the insertion of hard-coded secrets into production code, selection of insecure packages, and propagation of these changes to other development team members. Anthropic has since addressed the issue, but the incident underscores the inherent risks associated with AI memory files and context data. The exploitation of AI memory files highlights a growing trend where attackers target the persistent state of AI systems to manipulate outputs and maintain unauthorized access. This incident serves as a cautionary tale for organizations integrating AI tools, emphasizing the need for robust security measures to protect against such vulnerabilities.
3 months ago
Kill Chain
Zealot AI: A Glimpse into Autonomous Cloud Attacks
In April 2026, Palo Alto Networks' Unit 42 unveiled 'Zealot,' an AI-driven, multi-agent system capable of autonomously executing end-to-end cloud attacks. In a controlled environment, Zealot rapidly identified and exploited vulnerabilities within a misconfigured Google Cloud Platform, achieving data exfiltration in mere minutes. This proof-of-concept underscores the potential for AI to accelerate cyberattacks beyond human response capabilities. The demonstration highlights the urgent need for organizations to enhance their security postures. As AI technologies evolve, they not only offer defensive advantages but also equip adversaries with tools to conduct swift and sophisticated attacks, emphasizing the importance of proactive and automated defense mechanisms.
3 months ago
Kill Chain
Microsoft's AI-Powered Defense Strategies in 2026
In April 2026, Microsoft highlighted the transformative impact of AI on cybersecurity, emphasizing that AI models can autonomously discover vulnerabilities, chain multiple lower-severity issues into exploits, and produce proof-of-concept code, thereby compressing the window between vulnerability discovery and exploitation. To counteract these AI-driven threats, Microsoft is integrating advanced AI models into its Security Development Lifecycle (SDL) to identify vulnerabilities and develop mitigations more swiftly. Additionally, the company is partnering with industry leaders to test models like Claude Mythos Preview, aiming to enhance vulnerability detection and coordinate defensive responses. This proactive approach underscores the necessity for organizations to stay current on security updates and adopt AI-powered solutions to bolster their defenses. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/22/ai-powered-defense-for-an-ai-accelerated-threat-landscape/?utm_source=openai)) The relevance of this initiative is underscored by the rapid evolution of the threat landscape, where threat actors are increasingly leveraging AI to enhance the speed, scale, and sophistication of cyberattacks. Microsoft's commitment to integrating AI into its security operations reflects a broader industry trend towards adopting AI-driven defenses to stay ahead of emerging threats. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/02/threat-actor-abuse-of-ai-accelerates-from-tool-to-cyberattack-surface/?utm_source=openai))
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
