✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1945 to 1956 of 5141
FBI's Forensic Extraction of Deleted Signal Messages from iPhone Notification Database
In April 2026, the FBI successfully extracted deleted Signal messages from a defendant's iPhone by accessing the device's push notification database. This extraction was possible because the iPhone stored copies of incoming Signal messages in its internal memory, even after the app was deleted. The case involved individuals accused of vandalizing property at the ICE Prairieland Detention Facility in Texas, marking the first time authorities charged individuals for alleged 'Antifa' activities following its designation as a terrorist organization. This incident underscores the potential for forensic tools to retrieve sensitive data from secure messaging apps through unexpected avenues, highlighting the importance of understanding how device settings and notification storage can impact data security. Users are advised to review and adjust their notification settings to prevent unintended data retention.
3 months ago
Kill Chain
Microsoft Releases Emergency Patch for Critical ASP.NET Core Vulnerability CVE-2026-40372
In April 2026, Microsoft identified a critical vulnerability (CVE-2026-40372) in ASP.NET Core's Data Protection API, which could allow unauthenticated attackers to escalate privileges to SYSTEM level by forging authentication cookies. This flaw, present in versions 10.0.0 through 10.0.6, stemmed from improper verification of cryptographic signatures, enabling attackers to bypass authentication mechanisms and gain unauthorized access to sensitive data. Microsoft promptly released an out-of-band update (version 10.0.7) to address this issue and advised users to update their systems immediately. This incident underscores the importance of timely patch management and vigilance in monitoring for security updates. The rapid response by Microsoft highlights the evolving nature of software vulnerabilities and the necessity for organizations to stay informed about potential threats to maintain robust security postures.
3 months ago
Kill Chain
Harvester's Linux GoGra Backdoor Exploits Microsoft Graph API
In April 2026, the state-sponsored Harvester group deployed a Linux variant of its GoGra backdoor, utilizing the Microsoft Graph API and Outlook mailboxes for covert command-and-control communications. This sophisticated malware exploits legitimate Microsoft infrastructure to evade detection, targeting telecommunications, government, and IT organizations in South Asia. The Linux GoGra backdoor shares significant code similarities with its Windows counterpart, indicating a concerted effort by Harvester to expand its cross-platform capabilities. The emergence of this Linux variant underscores a growing trend among threat actors to develop multi-platform malware that leverages trusted cloud services for stealthy operations. Organizations must enhance their monitoring of cloud API interactions and implement robust security measures to detect and mitigate such advanced threats.
3 months ago
Kill Chain
Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Attacks
In April 2026, Microsoft disclosed a spoofing vulnerability (CVE-2026-32201) in SharePoint Server, affecting versions 2016, 2019, and Subscription Edition. This flaw allows unauthenticated attackers to perform network-based spoofing attacks due to improper input validation. Despite the release of patches on April 14, over 1,300 internet-exposed SharePoint servers remain unpatched, leaving organizations vulnerable to unauthorized access and data manipulation. The continued exploitation of CVE-2026-32201 underscores the critical need for timely patch management. Organizations must prioritize updating their SharePoint servers to mitigate potential breaches and maintain data integrity.
3 months ago
Kill Chain
Critical npm Supply Chain Attack Exposes Developer Credentials
In April 2026, a sophisticated supply chain attack targeted the Node Package Manager (npm) ecosystem, compromising multiple packages from Namastex Labs, a company specializing in AI-based solutions. The attackers injected malicious code into these packages, enabling the theft of developer credentials, API keys, SSH keys, and other sensitive data. The malware exhibited worm-like behavior by identifying npm publishing tokens on compromised systems and propagating itself by injecting malicious code into other packages that the stolen tokens could access, leading to a rapid spread across the npm ecosystem. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems. The attackers' ability to compromise trusted packages and leverage them to distribute malware highlights the critical need for enhanced security measures in software development pipelines. Organizations must prioritize the implementation of robust security practices, including regular audits of dependencies, strict access controls, and continuous monitoring, to mitigate the risks associated with such attacks.
3 months ago
Kill Chain
Inside Caller-as-a-Service Fraud: The Scam Economy Has a Hiring Process
In April 2026, cybersecurity researchers uncovered a sophisticated 'Caller-as-a-Service' (CaaS) fraud operation, where cybercriminals have structured their activities to mirror legitimate call centers. These operations involve specialized roles such as malware developers, phishing kit builders, infrastructure operators, and scam callers, all working in concert to execute large-scale social engineering attacks. This professionalization has led to a significant increase in the efficiency and impact of fraudulent phone calls, resulting in substantial financial losses and emotional distress for victims. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-caller-as-a-service-fraud-the-scam-economy-has-a-hiring-process/?utm_source=openai)) The emergence of CaaS highlights a critical evolution in cybercrime, emphasizing the need for enhanced security measures and public awareness. As these fraudulent operations become more organized and effective, individuals and organizations must adopt proactive strategies to detect and prevent such sophisticated social engineering attacks.
3 months ago
Kill Chain
Mirai Botnet Exploits D-Link Router Vulnerability CVE-2025-29635
In March 2026, Akamai's Security Intelligence and Response Team (SIRT) identified active exploitation of CVE-2025-29635, a command injection vulnerability in D-Link DIR-823X routers, by a new Mirai-based malware campaign. Attackers are sending POST requests to the vulnerable endpoint, executing remote commands to download and install a Mirai variant named "tuxnokill," which enables the compromised devices to perform distributed denial-of-service (DDoS) attacks. This marks the first observed in-the-wild exploitation of this vulnerability since its disclosure in March 2025. ([akamai.com](https://www.akamai.com/blog/security-research/cve-2025-29635-mirai-campaign-targets-d-link-devices?utm_source=openai)) The exploitation of end-of-life (EoL) devices underscores the critical need for organizations to replace outdated hardware and apply security patches promptly. The resurgence of Mirai variants targeting unpatched IoT devices highlights the ongoing threat posed by botnets leveraging known vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-mirai-campaign-exploits-rce-flaw-in-eol-d-link-routers/?utm_source=openai))
3 months ago
Kill Chain
Apple Addresses CVE-2026-28950: Notification Data Retention Vulnerability in iOS and iPadOS
In April 2026, Apple released out-of-band security updates for iOS and iPadOS to address a vulnerability (CVE-2026-28950) where notifications marked for deletion were unexpectedly retained on devices. This flaw, present in versions prior to iOS 18.7.8 and iOS 26.4.2, could potentially allow unauthorized access to sensitive information through retained notifications. The issue was resolved by improving data redaction processes. This incident underscores the critical importance of timely software updates and robust data management practices. It also highlights the potential risks associated with residual data storage, emphasizing the need for organizations to implement comprehensive data protection strategies to safeguard sensitive information.
3 months ago
Kill Chain
Kyber Ransomware's 2026 Attacks: A New Era of Post-Quantum Encryption Threats
In March 2026, the Kyber ransomware group launched attacks targeting Windows systems and VMware ESXi endpoints. The Windows variant, written in Rust, implemented Kyber1024 post-quantum encryption for key protection, while the ESXi variant utilized ChaCha8 for file encryption and RSA-4096 for key wrapping. Both variants shared the same campaign ID and Tor-based ransom infrastructure, indicating coordinated efforts to maximize impact by encrypting all servers simultaneously. The attacks led to significant operational disruptions, particularly affecting a multi-billion-dollar American defense contractor and IT services provider. The adoption of post-quantum cryptographic techniques by ransomware operators marks a significant evolution in cyber threats, highlighting the need for organizations to stay ahead of emerging encryption methods used by adversaries. This incident underscores the importance of robust cybersecurity measures and continuous monitoring to detect and mitigate such sophisticated attacks.
3 months ago
Kill Chain
CanisterWorm: A Self-Propagating Supply Chain Attack on the npm Ecosystem
In April 2026, a sophisticated supply chain attack targeted the npm ecosystem, compromising multiple packages to deploy a self-propagating worm known as CanisterWorm. The attack began with the exploitation of a GitHub Actions misconfiguration in the Trivy vulnerability scanner, allowing the threat group TeamPCP to steal a Personal Access Token (PAT). This token was used to publish malicious versions of Trivy, which, when installed, harvested sensitive credentials including npm authentication tokens. The worm then utilized these stolen tokens to automatically publish infected versions of other packages accessible with the compromised credentials, facilitating rapid and widespread propagation across the npm ecosystem. ([anuragnandi.com](https://www.anuragnandi.com/blog/npm-supply-chain-attack-canisterworm-2026?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the need for enhanced security measures in package management and CI/CD pipelines. The use of decentralized command-and-control infrastructure, as seen with CanisterWorm's utilization of an Internet Computer Protocol (ICP) canister, presents new challenges in threat mitigation and emphasizes the importance of adopting zero-trust principles and robust monitoring practices to safeguard against such evolving threats. ([anuragnandi.com](https://www.anuragnandi.com/blog/npm-supply-chain-attack-canisterworm-2026?utm_source=openai))
3 months ago
Kill Chain
Checkmarx Supply Chain Breach: Malicious KICS Docker Images and VS Code Extensions Detected
In April 2026, Checkmarx's supply chain was compromised when attackers uploaded malicious images to the official 'checkmarx/kics' Docker Hub repository. These images, including versions v2.1.20 and a fraudulent v2.1.21, contained modified KICS binaries with unauthorized data collection and exfiltration capabilities. Additionally, certain Visual Studio Code extensions were altered to execute remote code without user consent. Organizations using these compromised tools to scan infrastructure-as-code files risked exposing sensitive credentials and configurations. ([thehackernews.com](https://thehackernews.com/2026/04/malicious-kics-docker-images-and-vs.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools. It highlights the necessity for organizations to implement stringent security measures, such as verifying the integrity of third-party software and continuously monitoring for unauthorized modifications, to safeguard against similar vulnerabilities.
3 months ago
Kill Chain
Navigating AI-Driven Vulnerability Management in 2026
In 2026, the integration of artificial intelligence (AI) into cybersecurity has significantly transformed vulnerability management. AI systems now autonomously identify and exploit software vulnerabilities at unprecedented speeds, outpacing traditional security measures. This rapid evolution has led to a surge in AI-generated vulnerabilities, with AI-driven tools uncovering flaws that have remained undetected for decades. Consequently, organizations face an escalating challenge in prioritizing and remediating these vulnerabilities before they are exploited by malicious actors. The current landscape underscores the urgency for enterprises to adopt AI-enhanced security frameworks. As AI becomes a standard component of both offensive and defensive cybersecurity strategies, businesses must implement continuous threat exposure management and proactive defense mechanisms to mitigate the risks associated with AI-driven attacks.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
