✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2149 to 2160 of 5166
Fiber Optic Cables: The New Frontier in Covert Eavesdropping
In April 2026, researchers from The Hong Kong Polytechnic University, The Chinese University of Hong Kong, and the Technological and Higher Education Institute of Hong Kong unveiled a novel side-channel attack that transforms standard fiber optic internet cables into covert listening devices. Presented at the Network and Distributed System Security (NDSS) Symposium 2026, the study demonstrated that by exploiting the physical properties of fiber optic cables, attackers can capture and reconstruct ambient sounds without the need for traditional microphones. This method leverages the cables' sensitivity to acoustic vibrations, enabling unauthorized eavesdropping on private conversations. ([cryptika.com](https://www.cryptika.com/fiber-optic-cables-turned-into-hidden-microphones-to-secretly-spy-on-your-conversations/?utm_source=openai)) The significance of this discovery lies in its potential to compromise the confidentiality of communications transmitted over fiber optic networks. As these cables are widely used in telecommunications infrastructure, the attack underscores the need for enhanced security measures to protect against such unconventional eavesdropping techniques. Organizations must reassess the physical security of their network components and consider implementing countermeasures to mitigate the risk of acoustic side-channel attacks.
3 months ago
Kill Chain
APT37's Facebook Social Engineering Tactics Unveiled
In April 2026, the North Korean state-sponsored hacking group APT37 (also known as ScarCruft) initiated a sophisticated social engineering campaign targeting individuals via Facebook. The attackers created fake profiles to befriend targets, eventually moving conversations to Facebook Messenger. They persuaded victims to install a tampered version of Wondershare PDFelement, claiming it was necessary to view encrypted military documents. This malicious software executed embedded shellcode upon launch, establishing a foothold for the attackers. The campaign utilized compromised infrastructure for command-and-control operations, leveraging a legitimate Japanese real estate website to issue malicious commands. Ultimately, the malware was disguised as a harmless JPG image, enabling extensive remote access capabilities while evading detection by security software. This incident underscores the evolving tactics of APT37, highlighting their ability to exploit social media platforms for initial access and their use of legitimate software and infrastructure to evade detection. The campaign's success emphasizes the need for heightened awareness and robust security measures against social engineering attacks, especially those leveraging trusted platforms and applications.
3 months ago
Kill Chain
Anthropic's Claude Mythos AI Uncovers Thousands of Zero-Day Vulnerabilities
In April 2026, Anthropic unveiled its advanced AI model, Claude Mythos Preview, which autonomously identified thousands of zero-day vulnerabilities across major operating systems and web browsers. Notably, the model discovered a 27-year-old bug in OpenBSD and a 16-year-old flaw in FFmpeg's H.264 codec. Due to the potential risks associated with these findings, Anthropic restricted access to the model, collaborating with over 50 organizations, including tech giants like Amazon, Google, and Microsoft, under Project Glasswing to address and patch these vulnerabilities. This incident underscores the dual-edged nature of AI in cybersecurity, highlighting its potential to both uncover and exploit critical software flaws. The rapid advancements in AI capabilities necessitate a reevaluation of security protocols and the development of robust safeguards to prevent misuse. Organizations must stay vigilant and adapt to the evolving threat landscape shaped by AI-driven tools.
3 months ago
Kill Chain
FBI and Indonesian Police Dismantle W3LL Phishing Network Behind $20M Fraud Attempts
In April 2026, the FBI Atlanta Field Office, in collaboration with the Indonesian National Police, dismantled a sophisticated global phishing operation centered around the W3LL phishing kit. This toolkit enabled cybercriminals to create counterfeit login pages, deceiving victims into divulging their credentials. Priced at approximately $500, the kit facilitated the theft of thousands of account credentials and was linked to over $20 million in attempted fraud. Authorities detained the alleged developer, identified as G.L., and seized key domains associated with the operation. The W3LL phishing kit was a comprehensive cybercrime platform that allowed criminals to impersonate legitimate login pages, capturing usernames, passwords, and session data. This capability enabled attackers to bypass multi-factor authentication and maintain unauthorized access to accounts. The operation also included an online marketplace, W3LLSTORE, which facilitated the sale of over 25,000 compromised accounts between 2019 and 2023. Even after W3LLSTORE's shutdown in 2023, the phishing activities continued through encrypted messaging platforms, targeting more than 17,000 victims worldwide between 2023 and 2024.
3 months ago
Kill Chain
JanelaRAT Malware: A Growing Threat to Latin American Banks in 2025
In 2025, Latin American financial institutions, particularly in Brazil and Mexico, faced a significant surge in cyber threats, notably from the JanelaRAT malware. This sophisticated malware, a modified variant of the BX RAT trojan, was designed to steal financial and cryptocurrency data by capturing window titles, tracking mouse inputs, logging keystrokes, taking screenshots, and collecting system metadata. The attackers employed DLL side-loading techniques to evade detection, leveraging legitimate executables to load the malicious payload. The campaign's focus on Latin American banks underscores the region's growing vulnerability to targeted cyber attacks. ([thehackernews.com](https://thehackernews.com/2023/08/new-financial-malware-janelarat-targets.html?utm_source=openai)) The rise of JanelaRAT coincided with a broader increase in cyber threats across Latin America. Reports indicated a 155% increase in social engineering scams and a 225% rise in malware attacks in 2025. ([biocatch.com](https://www.biocatch.com/press-release/latin-american-banks-see-155-increase-in-scam-attempts?hs_amp=true&utm_source=openai)) This trend highlights the evolving tactics of cybercriminals who are increasingly targeting financial institutions in the region, emphasizing the urgent need for enhanced cybersecurity measures and cross-institution collaboration to mitigate these threats.
3 months ago
Kill Chain
Lumma Stealer Disruption: A Landmark Victory Against Infostealer Malware
In May 2025, a coordinated effort by the U.S. Department of Justice and Microsoft led to the disruption of Lumma Stealer, a prolific infostealer malware operating under a malware-as-a-service model since late 2022. Lumma Stealer was responsible for exfiltrating sensitive data, including browser credentials and cryptocurrency wallets, from numerous organizations worldwide. The takedown involved seizing over 2,300 malicious domains and dismantling the malware's command-and-control infrastructure, significantly hindering its operations. ([malwarebytes.com](https://www.malwarebytes.com/blog/news/2025/05/lumma-information-stealer-infrastructure-disrupted?utm_source=openai)) This disruption underscores the growing threat posed by infostealer malware and highlights the importance of collaborative efforts between law enforcement and private sector entities in combating cybercrime. Organizations are urged to enhance their cybersecurity measures to protect against similar threats, as the infostealer landscape continues to evolve with new variants and distribution methods. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/?msockid=3d81ed128ed2696826fafba28f5168a7&utm_source=openai))
3 months ago
Kill Chain
SentinelOne's AI EDR Thwarts Zero-Day Supply Chain Attack Involving Anthropic's Claude AI
In March 2026, SentinelOne's AI-driven Endpoint Detection and Response (EDR) system autonomously identified and halted a zero-day supply chain attack involving a trojanized version of LiteLLM, a widely used proxy for LLM API calls. The compromised package, updated by Anthropic's Claude AI coding assistant without human intervention, attempted to execute malicious Python code across multiple customer environments. SentinelOne's Singularity Platform detected and blocked the payload before execution, preventing data theft, persistence, Kubernetes lateral movement, and encrypted exfiltration within hours of the attack's initiation. This incident underscores the escalating sophistication of supply chain attacks, particularly those exploiting AI-driven development tools. The rapid detection and mitigation by autonomous security systems highlight the necessity for organizations to adopt AI-native defenses capable of operating at machine speed to counteract evolving cyber threats.
3 months ago
Kill Chain
Identity-Based Attacks: The Predominant Cyber Threat in 2026
In 2026, identity-based attacks have emerged as the predominant cyber threat, with 67% of incidents involving compromised credentials, session tokens, or other forms of digital identity. Attackers increasingly exploit legitimate access methods, bypassing traditional security measures to infiltrate systems undetected. This shift underscores the critical need for organizations to enhance identity security protocols and adopt continuous monitoring strategies to detect and mitigate unauthorized access. The rise of identity-driven intrusions is further exacerbated by the integration of AI technologies, which enable adversaries to automate and scale their attacks more effectively. As a result, businesses must prioritize robust identity governance and implement advanced detection mechanisms to safeguard against these evolving threats.
3 months ago
Kill Chain
ArcaneDoor 2024: Unveiling the Cisco ASA Zero-Day Exploitation
In early 2024, a sophisticated cyber espionage campaign, dubbed 'ArcaneDoor,' targeted Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Attackers exploited zero-day vulnerabilities—CVE-2024-20353 and CVE-2024-20359—to implant malware, execute arbitrary code, and potentially exfiltrate data. The campaign primarily affected government entities, leveraging the compromised devices as persistent footholds within networks. ([techtarget.com](https://www.techtarget.com/searchsecurity/news/366582137/Cisco-zero-day-flaws-in-ASA-FTD-software-under-attack?utm_source=openai)) This incident underscores the critical need for organizations to promptly apply security patches and maintain up-to-date systems. The exploitation of edge devices highlights a growing trend where attackers focus on perimeter infrastructure to gain initial access, emphasizing the importance of comprehensive security strategies that encompass both endpoint and network defenses.
3 months ago
Kill Chain
APT41's 2026 Cloud Credential Theft: A Wake-Up Call for Cloud Security
In early 2026, the Chinese state-sponsored threat group APT41 launched a sophisticated campaign targeting Linux-based cloud environments across AWS, Google Cloud Platform, Microsoft Azure, and Alibaba Cloud. Utilizing an undetectable ELF backdoor, the group harvested cloud credentials and metadata, enabling unauthorized access and potential data exfiltration. The malware employed typosquatting techniques and covert command-and-control channels over SMTP port 25, effectively evading traditional detection mechanisms. This incident underscores the evolving tactics of APT41, highlighting their focus on cloud infrastructure and the challenges in detecting such advanced persistent threats. Organizations must enhance their cloud security measures, monitor for anomalous activities, and implement robust detection strategies to mitigate similar threats.
3 months ago
Kill Chain
FreePBX 2026: INJ3CTOR3's EncystPHP Web Shell Exploitation
In early 2026, over 900 Sangoma FreePBX instances were compromised through the exploitation of a post-authentication command injection vulnerability, CVE-2025-64328. This flaw allowed attackers, notably the INJ3CTOR3 group, to deploy the EncystPHP web shell, enabling remote command execution and persistent access. The majority of affected systems were located in the United States, with significant numbers also in Brazil, Canada, Germany, and France. The exploitation led to unauthorized outbound calls and potential lateral movement within networks. This incident underscores the critical importance of promptly applying security patches and restricting administrative access to trusted networks. The widespread nature of these attacks highlights the ongoing threat to VoIP infrastructures and the necessity for organizations to implement robust security measures to protect against such vulnerabilities.
3 months ago
Kill Chain
GitHub Actions Supply Chain Attack 2025: Lessons Learned
In March 2025, a significant supply chain attack targeted GitHub Actions, specifically compromising the widely-used 'tj-actions/changed-files' repository. Attackers injected malicious code into this action, causing it to expose sensitive secrets from Continuous Integration/Continuous Deployment (CI/CD) workflows by printing them into public logs. This breach, identified as CVE-2025-30066, affected thousands of repositories relying on the compromised action, leading to potential unauthorized access and data breaches. This incident underscores the escalating threats to software supply chains, particularly within CI/CD environments. It highlights the critical need for organizations to implement stringent security measures, such as pinning dependencies to specific versions, regularly auditing third-party components, and enhancing monitoring of CI/CD pipelines to detect and mitigate such vulnerabilities promptly.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
