✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2065 to 2076 of 5158
Understanding CVE-2026-26144: The Zero-Click XSS Vulnerability in Microsoft Excel
In March 2026, Microsoft disclosed CVE-2026-26144, a critical cross-site scripting (XSS) vulnerability in Excel. This flaw allows attackers to embed malicious scripts within Excel files, which, when processed by the Copilot Agent, can autonomously exfiltrate data to external servers without user interaction. The vulnerability affects Microsoft 365 Apps for Enterprise versions 16.0.1 and below, posing significant risks to organizations relying on Excel for sensitive data management. ([system.plus](https://system.plus/2026/03/12/zero-click-microsoft-copilot-bug-cve-2026-26144/?utm_source=openai)) The incident underscores the evolving threat landscape where AI integrations can amplify traditional vulnerabilities, leading to zero-click exploits. Organizations must reassess their security postures, especially concerning AI-enabled applications, to mitigate such risks effectively.
3 months ago
Kill Chain
Microsoft 2025 APT Domain Compromise: A Case Study
In June 2025, a public sector organization experienced a sophisticated domain compromise initiated through a vulnerability in an Internet Information Services (IIS) server. The attackers exploited this flaw to deploy a web shell, escalating privileges to gain domain-administration rights. They conducted extensive reconnaissance, harvested credentials using tools like Mimikatz, and manipulated Group Policy Objects (GPOs) to disable security controls. The attackers also deployed web shells on Exchange Servers, granting them access to manipulate mailbox contents. The breach posed significant risks to the organization's operational integrity and data security. This incident underscores the critical importance of proactive defense mechanisms in mitigating identity-based attacks. The implementation of predictive shielding in Microsoft Defender, which anticipates and disrupts potential attack paths, has proven effective in preventing such compromises. Organizations are increasingly adopting these advanced security measures to enhance their resilience against evolving cyber threats.
3 months ago
Kill Chain
Microsoft Defender Zero-Day Vulnerabilities Exposed in 2026
In April 2026, three critical zero-day vulnerabilities—BlueHammer, RedSun, and UnDefend—were disclosed in Microsoft Defender by a researcher known as Chaotic Eclipse. These flaws allowed attackers to escalate privileges and disrupt system defenses. BlueHammer, a local privilege escalation vulnerability, was patched on April 14, 2026, as CVE-2026-33825. However, RedSun and UnDefend remain unpatched, leaving systems vulnerable to exploitation. ([learn.microsoft.com](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-zero-day-vulnerabilities?utm_source=openai)) The public disclosure of these vulnerabilities underscores the challenges in vulnerability management and the importance of timely patching. Organizations must remain vigilant, as unpatched systems are prime targets for attackers seeking to exploit these flaws for unauthorized access and control.
3 months ago
Kill Chain
Critical RCE Vulnerability in Apache ActiveMQ: CVE-2026-34197
In April 2026, a critical remote code execution (RCE) vulnerability, designated CVE-2026-34197, was identified in Apache ActiveMQ Classic. This flaw resides in the Jolokia JMX-HTTP bridge exposed at /api/jolokia/ on the web console. Due to an overly permissive default Jolokia access policy, authenticated attackers can invoke sensitive operations, such as BrokerService.addNetworkConnector(String), with crafted discovery URIs. This exploitation allows the loading of a remote Spring XML application context, leading to arbitrary code execution on the broker's JVM through methods like Runtime.exec(). The vulnerability affects Apache ActiveMQ Broker versions before 5.19.4 and from 6.0.0 before 6.2.3. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-34197/?utm_source=openai)) The discovery of this vulnerability underscores the importance of rigorous input validation and access control in software components. Organizations utilizing affected versions of Apache ActiveMQ are urged to upgrade to version 5.19.5 or 6.2.3 to mitigate this risk. ([rapid7.com](https://www.rapid7.com/db/vulnerabilities/apache-activemq-cve-2026-34197/?utm_source=openai))
3 months ago
Kill Chain
Lumma Stealer and Sectop RAT: A 2026 Cybersecurity Threat Analysis
In April 2026, a sophisticated malware campaign was identified, involving the Lumma Stealer and Sectop RAT (ArechClient2). The attack began with users downloading a password-protected 7-zip archive, disguised as cracked software, which contained an inflated Windows executable designed to evade detection. Upon execution, Lumma Stealer was installed, exfiltrating sensitive data such as credentials and financial information. Subsequently, Sectop RAT was deployed, granting attackers remote control over the infected systems. This multi-stage infection chain highlights the evolving tactics of cybercriminals in leveraging multiple malware strains to maximize impact. The incident underscores the persistent threat posed by malware-as-a-service platforms like Lumma Stealer, which have been active since 2022. Despite previous disruptions to its infrastructure, Lumma Stealer continues to evolve, employing advanced obfuscation techniques and deceptive delivery methods, such as fake CAPTCHA pages, to infiltrate systems. The integration of Sectop RAT further amplifies the risk, enabling attackers to maintain prolonged access and control over compromised devices.
3 months ago
Kill Chain
Critical Authorization Flaw in AVEVA Pipeline Simulation: CVE-2026-5387
In April 2026, a critical vulnerability (CVE-2026-5387) was identified in AVEVA Pipeline Simulation software, affecting versions up to 2025 SP1 build 7.1.9497.6351. This flaw allows unauthenticated attackers to perform operations reserved for high-privilege roles, such as modifying simulation parameters and training records, leading to potential privilege escalation. ([cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2026-5387?utm_source=openai)) The incident underscores the importance of robust authorization mechanisms in industrial control systems. Organizations are urged to upgrade to AVEVA Pipeline Simulation 2025 SP1 P01 (build 7.1.9580.8513) or higher and implement network access restrictions to mitigate this risk. ([aveva.com](https://www.aveva.com/en/support-and-success/cyber-security-updates/?utm_source=openai))
3 months ago
Kill Chain
Anthropic's Claude Mythos AI: A Game-Changer in Cybersecurity
In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying and exploiting software vulnerabilities across major operating systems and web browsers. The model discovered thousands of zero-day vulnerabilities, including a 27-year-old flaw in OpenBSD and a 16-year-old bug in FFmpeg. Due to its potent capabilities, Anthropic restricted access to select organizations under Project Glasswing to prevent potential misuse. This initiative involves collaboration with major tech companies to responsibly address and patch these vulnerabilities. The emergence of such powerful AI tools underscores the need for enhanced cybersecurity measures and collaborative efforts to safeguard critical infrastructure. The rapid advancement of AI in cybersecurity presents both opportunities and challenges, necessitating a reevaluation of existing security protocols and the development of new strategies to mitigate potential risks.
3 months ago
Kill Chain
Operation PowerOFF 2026: A Major Blow to DDoS-for-Hire Services
In April 2026, a coordinated international law enforcement effort known as Operation PowerOFF led to the seizure of 53 domains associated with DDoS-for-hire services and the arrest of four individuals allegedly involved in these operations. Authorities from 21 countries, including the United States, United Kingdom, and Germany, dismantled infrastructure supporting these services, which had been utilized by over 75,000 cybercriminals to launch distributed denial-of-service (DDoS) attacks. The operation also resulted in the identification of more than 3 million user accounts linked to these illegal activities. ([cyberscoop.com](https://cyberscoop.com/ddos-for-hire-takedowns-operation-poweroff/?utm_source=openai)) This crackdown underscores the persistent threat posed by DDoS-for-hire services, which enable individuals with minimal technical expertise to disrupt online services across various sectors. The operation highlights the necessity for organizations to bolster their cybersecurity defenses against such attacks and the importance of international collaboration in combating cybercrime.
3 months ago
Kill Chain
US Nationals Sentenced for Facilitating North Korean Tech Worker Scheme
In April 2026, two U.S. nationals, Kejia Wang and Zhenxing Wang, were sentenced to nine years and 92 months in prison, respectively, for facilitating a scheme that enabled North Korean IT workers to pose as American employees. This operation, running from 2021 to 2024, involved the use of stolen identities from over 80 U.S. citizens to secure remote positions at more than 100 U.S. companies, including Fortune 500 firms. The scheme generated over $5 million for the North Korean regime and resulted in U.S. companies incurring damages exceeding $3 million. The perpetrators managed 'laptop farms' within the U.S., allowing North Korean operatives to remotely access company systems, leading to the theft of sensitive data, including export-controlled military technology. This incident underscores the evolving tactics of state-sponsored cyber operations and highlights the critical need for robust identity verification and cybersecurity measures in remote hiring processes. Organizations must remain vigilant against sophisticated insider threats that exploit remote work infrastructures to infiltrate corporate networks and exfiltrate sensitive information.
3 months ago
Kill Chain
U.S. Nationals Sentenced for Facilitating North Korean IT Worker Infiltration
Between 2021 and October 2024, U.S. nationals Kejia Wang and Zhenxing Wang facilitated a scheme enabling North Korean IT workers to secure remote positions at over 100 U.S. companies, including Fortune 500 firms. By creating fake websites, shell companies, and hosting company-issued laptops in U.S. residences, they masked the workers' true identities, generating over $5 million for the North Korean government and causing approximately $3 million in damages to the affected companies. ([nationaltoday.com](https://nationaltoday.com/us/ma/boston/news/2026/04/16/two-americans-sentenced-for-helping-north-korea-obtain-remote-it-jobs/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors exploiting remote work infrastructures to infiltrate organizations, emphasizing the need for robust identity verification and cybersecurity measures to protect against such sophisticated schemes.
3 months ago
Kill Chain
McGraw Hill's 2026 Data Breach: A Wake-Up Call for Third-Party Security
In April 2026, McGraw Hill, a leading educational publisher, experienced a data breach orchestrated by the cybercriminal group ShinyHunters. The attackers exploited a misconfiguration in McGraw Hill's Salesforce environment, gaining unauthorized access to a webpage hosted on the platform. This breach led to the exfiltration of personally identifiable information (PII) from approximately 13.5 million user accounts, including names, physical addresses, phone numbers, and email addresses. McGraw Hill confirmed the incident, emphasizing that their internal systems, customer databases, and educational platforms remained secure. The company attributed the breach to a broader issue affecting multiple organizations utilizing Salesforce, highlighting the risks associated with third-party service integrations. ([techradar.com](https://www.techradar.com/pro/security/this-activity-appears-to-be-part-of-a-broader-issue-education-company-mcgraw-hill-becomes-latest-to-see-its-salesforce-data-hacked?utm_source=openai)) This incident underscores the escalating threat posed by cybercriminal groups like ShinyHunters, who have shifted focus from traditional ransomware attacks to data extortion schemes. By exploiting vulnerabilities in widely-used platforms such as Salesforce, these actors can access vast amounts of sensitive data, posing significant risks to organizations and their customers. The McGraw Hill breach serves as a critical reminder for companies to rigorously assess and secure their third-party integrations to prevent similar incidents.
3 months ago
Kill Chain
Cisco Webex SSO Vulnerability Exposes Users to Impersonation Attacks
In April 2026, Cisco disclosed a critical vulnerability (CVE-2026-20184) in the single sign-on (SSO) integration of its Webex Services platform. This flaw allowed unauthenticated, remote attackers to impersonate any user by exploiting improper certificate validation. Successful exploitation could grant unauthorized access to legitimate Cisco Webex services. Cisco addressed the vulnerability in the Webex service; however, customers using SSO integration were required to upload a new SAML certificate for their identity provider to the Control Hub to prevent service interruptions. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL?utm_source=openai)) This incident underscores the critical importance of robust certificate validation processes in SSO integrations. As organizations increasingly adopt cloud-based collaboration tools, ensuring the security of authentication mechanisms becomes paramount to prevent unauthorized access and potential data breaches.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
