✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2113 to 2124 of 5159
McGraw-Hill's 2026 Data Breach: Lessons in Third-Party Platform Security
In April 2026, McGraw-Hill, a leading education company, experienced a data breach due to a misconfiguration in its Salesforce environment. The cybercriminal group ShinyHunters exploited this vulnerability to access internal data. McGraw-Hill confirmed that the breach did not affect its Salesforce accounts, customer databases, or internal systems, and that the exposed data was limited and non-sensitive. However, ShinyHunters claimed to possess 45 million Salesforce records containing personally identifiable information (PII), contradicting the company's statement. The group threatened to leak the stolen data by April 14 unless a ransom was paid. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/mcgraw-hill-confirms-data-breach-following-extortion-threat/?utm_source=openai)) This incident underscores the critical importance of securing third-party platforms and configurations. Misconfigurations in widely used services like Salesforce can serve as entry points for threat actors, leading to significant data breaches and extortion attempts. Organizations must prioritize regular audits and robust security measures to protect sensitive information.
3 months ago
Kill Chain
Fake Ledger Live App on Apple App Store Leads to $9.5M Crypto Theft
In April 2026, a counterfeit version of the Ledger Live app was discovered on Apple's Mac App Store, leading to the theft of approximately $9.5 million in cryptocurrency from over 50 users. The malicious app, submitted under the developer name 'Leva Heal Limited,' deceived users into entering their seed phrases, granting attackers full access to their wallets. The stolen funds were laundered through more than 150 deposit addresses on KuCoin, linked to a centralized mixing service called 'AudiA6.' Apple has since removed the fraudulent app from the App Store. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fake-ledger-live-app-on-apples-app-store-stole-95m-in-crypto/?utm_source=openai)) This incident underscores the persistent threat of sophisticated phishing attacks targeting cryptocurrency users. It highlights the critical need for vigilance when downloading financial applications, even from official app stores, and the importance of never sharing seed phrases or recovery keys.
3 months ago
Kill Chain
Kraken Faces Insider Threat and Extortion Attempt in 2026
In April 2026, Kraken, a leading cryptocurrency exchange, disclosed two incidents where support staff improperly accessed internal systems, exposing limited client support data. Approximately 2,000 accounts, representing 0.02% of Kraken's user base, were affected. Following these incidents, a criminal group attempted to extort Kraken by threatening to release videos showcasing the internal systems with client data. Kraken confirmed that no core systems were breached, client funds remained secure, and the company refused to comply with the extortion demands. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/crypto-exchange-kraken-extorted-by-hackers-after-insider-breach/?utm_source=openai)) This incident underscores the persistent threat of insider access within organizations, particularly in the cryptocurrency sector. It highlights the importance of robust internal controls, employee monitoring, and rapid response mechanisms to mitigate insider threats and protect sensitive client information.
3 months ago
Kill Chain
Microsoft Bolsters RDP Security to Thwart Phishing Threats
In April 2026, Microsoft released security updates for Windows 10 and Windows 11 to enhance protections against phishing attacks exploiting Remote Desktop Protocol (RDP) files. These updates introduce new security warnings and disable risky shared resources by default when opening RDP files, aiming to prevent unauthorized access and data theft facilitated through malicious RDP configurations. ([learn.microsoft.com](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/understanding-security-warnings?utm_source=openai)) This initiative addresses the increasing abuse of RDP files in phishing campaigns, where attackers use them to gain control over victims' systems and access sensitive information. By implementing these protections, Microsoft aims to mitigate the risks associated with such attacks and enhance overall system security. ([learn.microsoft.com](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/understanding-security-warnings?utm_source=openai))
3 months ago
Kill Chain
Critical Command Injection Vulnerabilities Discovered in PHP Composer's Perforce Driver
In April 2026, two critical command injection vulnerabilities were identified in PHP's Composer package manager, specifically within its Perforce VCS driver. These flaws, designated as CVE-2026-40176 and CVE-2026-40261, allowed attackers to execute arbitrary commands on systems running vulnerable versions of Composer. The vulnerabilities stemmed from improper input validation and insufficient escaping of user-supplied parameters, enabling command execution in the context of the user running Composer. Immediate patches were released in versions 2.9.6 and 2.2.27 to address these issues. This incident underscores the persistent risks associated with software supply chains, particularly in widely-used development tools. It highlights the necessity for developers to remain vigilant, promptly apply security updates, and scrutinize third-party dependencies to mitigate potential threats.
3 months ago
Kill Chain
UNSW's 'Capture the Narrative' Wargame Reveals AI's Power in Social Media Manipulation
In 2025, the University of New South Wales (UNSW) conducted 'Capture the Narrative,' a pioneering wargame where students developed AI-driven bots to influence a simulated election on a fictional social media platform. Over four weeks, participants generated over 7 million posts, with more than 60% of content produced by these bots. The exercise demonstrated how AI can be leveraged to manipulate public opinion, resulting in a 1.78% swing that altered the election outcome. This experiment underscores the growing threat of AI-powered influence operations in real-world scenarios. ([unsw.edu.au](https://www.unsw.edu.au/newsroom/news/2026/01/social-media-wargame-reveals-how-ai-bots-can-swing-election?utm_source=openai)) The relevance of this incident is heightened by the increasing use of AI in disinformation campaigns. For instance, Microsoft reported that China has begun employing generative AI to create realistic images supporting divisive U.S. political content, marking a significant evolution in influence operations. ([axios.com](https://www.axios.com/2023/09/08/china-ai-disinformation-microsoft?utm_source=openai))
3 months ago
Kill Chain
Volt Typhoon 2023: Unveiling the Chinese Cyber Threat to U.S. Infrastructure
In May 2023, Microsoft and U.S. intelligence agencies identified a Chinese state-sponsored cyber group, Volt Typhoon, infiltrating critical infrastructure sectors in the United States, including communications, manufacturing, utilities, and transportation. Active since mid-2021, Volt Typhoon employed 'living-off-the-land' techniques, utilizing legitimate system tools to evade detection, and targeted systems in Guam, a strategic U.S. military hub. The group's activities aimed to gather intelligence and potentially disrupt critical communications between the U.S. and Asia during future crises. ([techspot.com](https://www.techspot.com/news/98826-microsoft-global-intelligence-agencies-warn-chinese-hackers-infecting.html?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors to national security. The use of stealthy techniques by Volt Typhoon highlights the need for enhanced detection and response capabilities within critical infrastructure sectors to mitigate potential disruptions and safeguard sensitive information.
3 months ago
Kill Chain
Adobe Acrobat Reader Zero-Day Exploit CVE-2026-34621: What You Need to Know
In April 2026, Adobe addressed a critical zero-day vulnerability (CVE-2026-34621) in Acrobat Reader, which had been actively exploited since at least December 2025. This flaw allowed attackers to execute arbitrary code on both Windows and macOS systems when users opened maliciously crafted PDF files. The vulnerability stemmed from a prototype pollution issue, enabling unauthorized code execution within the context of the current user. ([techcrunch.com](https://techcrunch.com/2026/04/14/adobe-fixes-pdf-zero-day-security-bug-that-hackers-have-exploited-for-months/?utm_source=openai)) The exploitation of this vulnerability highlights the persistent targeting of widely used software by threat actors. Organizations are urged to prioritize timely patching and to educate users on the risks associated with opening files from untrusted sources to mitigate similar threats.
3 months ago
Kill Chain
Anthropic's Claude Mythos AI: A Game-Changer in Cybersecurity
In April 2026, Anthropic unveiled its advanced AI model, Claude Mythos, capable of autonomously identifying and exploiting thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability led Anthropic to restrict public access to Mythos, collaborating instead with select organizations under Project Glasswing to address these vulnerabilities responsibly. The model's proficiency in discovering long-standing flaws, including a 27-year-old bug in OpenBSD, underscores the transformative impact of AI in cybersecurity. The emergence of AI models like Claude Mythos signifies a paradigm shift in vulnerability management, compressing the timeline from discovery to exploitation. This development necessitates immediate adaptation by security teams to enhance their defensive strategies and operational models to keep pace with rapidly evolving AI-driven threats.
3 months ago
Kill Chain
CISA Highlights Active Exploitation of Vulnerabilities in Fortinet, Microsoft, and Adobe Products
On April 13, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. These vulnerabilities affect Fortinet FortiClient EMS, Adobe Acrobat Reader, Microsoft Windows Common Log File System Driver, Microsoft Exchange Server, Host Process for Windows Tasks, and Microsoft Visual Basic for Applications. Notably, CVE-2026-21643, an SQL injection vulnerability in Fortinet FortiClient EMS, has been actively exploited since March 24, 2026. Additionally, Microsoft reports that threat actor Storm-1175 has been leveraging CVE-2023-21529 in Exchange Server to deliver Medusa ransomware. ([thehackernews.com](https://thehackernews.com/2026/04/cisa-adds-6-known-exploited-flaws-in.html?utm_source=openai)) The inclusion of these vulnerabilities underscores the persistent threat posed by both newly discovered and older security flaws. Organizations are urged to prioritize patching these vulnerabilities to mitigate potential risks, as unpatched systems remain prime targets for cyber adversaries. ([bytevanguard.com](https://bytevanguard.com/2026/04/14/cisa-kev-update-from-a-2012-bug-to-2026-flaws/?utm_source=openai))
3 months ago
Kill Chain
ShowDoc 2025 Remote Code Execution Vulnerability
In April 2025, a critical vulnerability (CVE-2025-0520) was identified in ShowDoc, a widely used documentation management tool. This flaw, present in versions prior to 2.8.7, allowed attackers to upload and execute arbitrary PHP files due to improper validation of file extensions, leading to remote code execution. Despite the release of a patch in October 2020, many instances remained unpatched, resulting in active exploitation by threat actors. ([thehackernews.com](https://thehackernews.com/2026/04/showdoc-rce-flaw-cve-2025-0520-actively.html?utm_source=openai)) The exploitation of this vulnerability underscores the persistent risk posed by unpatched software. Organizations are urged to promptly apply security updates to mitigate such threats and protect sensitive data from unauthorized access.
3 months ago
Kill Chain
Massive Data Breach: 108 Malicious Chrome Extensions Compromise 20,000 Users
In April 2026, cybersecurity researchers uncovered a coordinated campaign involving 108 malicious Google Chrome extensions that compromised approximately 20,000 users. These extensions, published under five fake identities, masqueraded as legitimate tools such as games, translation utilities, and YouTube enhancers. Once installed, they exfiltrated sensitive data, including Google account credentials and Telegram session tokens, to a centralized command-and-control server. Some extensions injected ads and arbitrary JavaScript code into web pages, while others stripped security headers from sites like YouTube and TikTok to facilitate further exploitation. ([gizchina.com](https://www.gizchina.com/malicious-apps/108-fake-chrome-extensions-were-stealing-your-google-and-telegram-data-remove-them-now/?utm_source=openai)) This incident underscores the persistent threat posed by malicious browser extensions and highlights the need for vigilant scrutiny of third-party add-ons. The attackers' ability to infiltrate the official Chrome Web Store and maintain their presence for an extended period raises concerns about the effectiveness of current security measures in detecting and preventing such threats. ([cybernews.com](https://cybernews.com/security/chrome-extensions-flagged-for-stealing-user-data/?utm_source=openai))
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
