✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2341 to 2352 of 5175
Chrome 2026 Dawn Use-After-Free Vulnerability
In April 2026, Google identified and patched a high-severity zero-day vulnerability, CVE-2026-5281, in its Chrome browser. This use-after-free flaw in Dawn, Chrome's implementation of the WebGPU standard, allowed remote attackers to execute arbitrary code via crafted HTML pages. The vulnerability was actively exploited in the wild, prompting Google to release an emergency update to versions 146.0.7680.177/178 for Windows and macOS, and 146.0.7680.177 for Linux. ([thehackernews.com](https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html?utm_source=openai)) This incident underscores the increasing frequency of zero-day vulnerabilities targeting widely used software. It highlights the critical need for organizations to maintain up-to-date systems and implement robust security measures to mitigate the risks associated with such exploits.
4 months ago
Kill Chain
Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass
In late February 2026, Microsoft identified a sophisticated malware campaign leveraging WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. Upon execution, these scripts initiate a multi-stage infection chain, utilizing renamed Windows utilities to download additional payloads from trusted cloud services like AWS, Tencent Cloud, and Backblaze B2. The malware employs User Account Control (UAC) bypass techniques to escalate privileges, establish persistence, and deploy tools such as AnyDesk for remote access, enabling attackers to exfiltrate data or deploy further malware. This campaign underscores the evolving tactics of threat actors who exploit legitimate tools and platforms to evade detection and maintain control over compromised systems. Organizations must remain vigilant against such social engineering attacks and implement robust security measures to mitigate these threats.
4 months ago
Kill Chain
CERT-UA Impersonation Campaign: UAC-0255's AGEWHEEZE Malware Attack
In late March 2026, the threat actor group UAC-0255 launched a phishing campaign impersonating the Computer Emergency Response Team of Ukraine (CERT-UA). The attackers sent emails on March 26 and 27, 2026, posing as CERT-UA to distribute a password-protected ZIP archive hosted on Files.fm, urging recipients to install the 'specialized software.' The ZIP file ('CERT_UA_protection_tool.zip') is designed to download malware packaged as security software from the agency. The targets of the campaign included state organizations, medical centers, security companies, educational institutions, financial institutions, and software development companies. Some of the emails were sent from the email address 'incidents@cert-ua[.]tech.'
4 months ago
Kill Chain
Magecart E-Skimmer Infections Reach Record Highs in 2025
In 2025, Magecart e-skimming attacks surged, compromising over 23 million online transactions across more than 10,500 unique infections. These attacks involved injecting malicious JavaScript into e-commerce checkout pages to steal payment data. The proliferation of full-stack e-skimmer kits and Malware-as-a-Service offerings enabled less technically skilled threat actors to execute large-scale compromises, significantly impacting the security of online merchants and consumers. ([recordedfuture.com](https://www.recordedfuture.com/resources/guides/annual-payment-fraud-intelligence-report-2025?utm_source=openai)) The industrialization of the fraud ecosystem, characterized by standardized attack tools and services, has lowered the barrier to entry for cybercriminals. This trend underscores the urgent need for financial institutions and e-commerce platforms to adopt proactive, intelligence-driven defenses to mitigate the escalating threat of payment fraud. ([recordedfuture.com](https://www.recordedfuture.com/resources/guides/annual-payment-fraud-intelligence-report-2025?utm_source=openai))
4 months ago
Kill Chain
Excessive Permissions in Google Vertex AI: A 2026 Security Wake-Up Call
In March 2026, Palo Alto Networks' Unit 42 identified a critical security vulnerability in Google Cloud's Vertex AI platform. The issue stemmed from the platform's default service accounts, known as Per-Project, Per-Product Service Agents (P4SA), which were granted excessive permissions by default. This misconfiguration allowed attackers to exploit AI agents deployed on Vertex AI, enabling unauthorized access to sensitive data and internal cloud infrastructure. By extracting the service account credentials, malicious actors could escalate privileges, access proprietary container images, and potentially compromise Google's internal storage buckets. ([darkreading.com](https://www.darkreading.com/cyber-risk/googles-vertex-ai-over-privilege-problem?utm_source=openai)) This incident underscores the growing security challenges associated with AI deployments in cloud environments. As organizations increasingly integrate AI agents into their workflows, ensuring proper configuration and adherence to the principle of least privilege becomes paramount to prevent similar vulnerabilities and safeguard sensitive information.
4 months ago
Kill Chain
UNC1069's 2026 Supply Chain Attack on Axios: A Wake-Up Call for Open-Source Security
In late March 2026, the widely-used JavaScript library Axios was compromised through a sophisticated supply chain attack. Attackers gained access to the npm account of a lead maintainer and published two malicious versions: axios@1.14.1 and axios@0.30.4. These versions included a trojanized dependency, 'plain-crypto-js@4.2.1', which executed a cross-platform Remote Access Trojan (RAT) upon installation, targeting Windows, macOS, and Linux systems. The malicious packages were live for approximately three hours before being removed, but the potential impact was significant due to Axios's extensive use in the developer community. ([securitylabs.datadoghq.com](https://securitylabs.datadoghq.com/articles/axios-npm-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks, particularly those targeting open-source ecosystems. The attribution to North Korean threat actor UNC1069 highlights the increasing involvement of state-sponsored groups in such attacks, emphasizing the need for enhanced security measures in software development pipelines. ([cyberkendra.com](https://www.cyberkendra.com/2026/04/north-korean-hackers-behind-axios-npm.html?utm_source=openai))
4 months ago
Kill Chain
TeamPCP's 2026 Cloud Breaches: A Wake-Up Call for Supply Chain Security
In March 2026, the threat actor group TeamPCP executed a series of sophisticated supply chain attacks, compromising widely used open-source tools such as Trivy, KICS, LiteLLM, and Telnyx. By injecting malicious code into these trusted software packages, TeamPCP deployed infostealer malware to harvest sensitive credentials, including API keys, SSH keys, and cloud service tokens. Utilizing the stolen credentials, the group swiftly breached cloud environments across AWS, Azure, and various SaaS platforms, conducting extensive reconnaissance and data exfiltration activities. This campaign underscores the critical need for organizations to promptly rotate and revoke compromised credentials to mitigate the risk of unauthorized access and data breaches. The rapid escalation and breadth of TeamPCP's attacks highlight a concerning trend in cyber threats, emphasizing the importance of securing software supply chains and implementing robust monitoring mechanisms to detect and respond to credential misuse promptly.
4 months ago
Kill Chain
AI/ML Security Incidents in 2026: A Wake-Up Call for Enterprises
In 2026, the cybersecurity landscape witnessed a significant surge in incidents involving artificial intelligence (AI) and machine learning (ML) systems. Notably, a report by Zscaler highlighted that 90% of enterprise AI systems could be breached within 90 minutes under adversarial testing conditions, with some systems compromised in under one second. Additionally, 68% of organizations experienced AI-linked data leaks, yet only 23% had formal AI security policies in place. These incidents underscore the critical vulnerabilities in AI and ML deployments, emphasizing the need for robust security measures and governance frameworks. The rapid adoption of AI technologies, coupled with insufficient security protocols, has led to an increase in sophisticated cyberattacks. Threat actors are leveraging AI to enhance the scale, speed, and precision of their attacks, while organizations struggle to keep pace with evolving threats. This trend highlights the urgent need for comprehensive AI security strategies to mitigate emerging risks.
4 months ago
Kill Chain
Critical XSS and GhostScript RCE Vulnerabilities in Enterprise Document Processing Platform
In 2026, a critical security assessment of an enterprise document processing platform revealed two severe vulnerabilities: an unauthenticated cross-site scripting (XSS) flaw and a GhostScript parameter injection leading to remote code execution (RCE). The XSS vulnerability allowed attackers to execute malicious scripts, bypassing HttpOnly cookie protections by exploiting an internal service endpoint that reflected session cookies in its response. This enabled full administrative access. Additionally, the GhostScript flaw permitted arbitrary command execution on the server by injecting parameters that disabled security features, leading to potential system compromise. ([praetorian.com](https://www.praetorian.com/blog/httponly-cookie-bypass-xss-ghostscript-rce/?utm_source=openai)) This incident underscores the persistent risks associated with XSS and RCE vulnerabilities, especially in applications handling sensitive data. It highlights the necessity for comprehensive security measures, including proper input validation, strict access controls, and regular security assessments to identify and mitigate such critical flaws.
4 months ago
Kill Chain
Venom Stealer: The New Frontier in Automated ClickFix Attacks
In April 2026, a new malware-as-a-service (MaaS) platform named Venom Stealer emerged, automating the creation of persistent information-stealing attacks through ClickFix social engineering techniques. Developed by an individual known as 'VenomStealer,' this platform enables attackers to establish a continuous exfiltration pipeline, harvesting credentials, session cookies, and cryptocurrency wallets from victims. Unlike traditional infostealers, Venom Stealer remains active post-infection, continuously monitoring and exfiltrating new data, thereby undermining standard incident response measures. The commoditization of such advanced attack methods signifies a concerning evolution in cyber threats, making sophisticated social engineering tactics more accessible to a broader range of cybercriminals. Organizations must enhance their security awareness training and implement robust monitoring of outbound traffic to detect and prevent data exfiltration activities associated with these attacks.
4 months ago
Kill Chain
Surge in Cyberattacks Targets Latin American Governments in 2026
In early 2026, Latin American governments faced a significant surge in cyberattacks targeting critical infrastructure and sensitive data. Notably, Colombia's health ministry reported over 23 million cyberattacks and probes in March, while Mexico's government agencies suffered breaches compromising millions of identities and tax records. Puerto Rico's Department of Transportation also experienced disruptions due to cyber incidents. These attacks were primarily driven by financially motivated cybercriminals, with a notable increase in nation-state espionage and politically motivated hacktivism. The region's rapid digitalization, coupled with legacy systems and a shortage of cybersecurity professionals, has exacerbated vulnerabilities, making government networks prime targets for cyber adversaries. ([darkreading.com](https://www.darkreading.com/cyber-risk/latin-american-confidence-cyber-defenses-skills?utm_source=openai)) This escalation underscores the urgent need for Latin American governments to bolster their cybersecurity defenses. The convergence of AI acceleration, geopolitical fragmentation, and cyber-enabled fraud is reshaping the global risk landscape, necessitating enhanced threat intelligence, public-private cooperation, and investment in cybersecurity infrastructure to mitigate the growing threats. ([weforum.org](https://www.weforum.org/stories/2026/01/geopolitics-ai-fraud-global-cyber-cybersecurity-2026/?utm_source=openai))
4 months ago
Kill Chain
Critical Vulnerability in Delta Electronics COMMGR2: CVE-2026-3630
In March 2026, Delta Electronics disclosed a critical stack-based buffer overflow vulnerability (CVE-2026-3630) in their COMMGR2 software, widely used in industrial automation. This flaw allows unauthenticated remote attackers to execute arbitrary code, potentially leading to full system compromise. The vulnerability affects COMMGR2 versions up to and including 2.11.0. Delta Electronics has released a security advisory (Delta-PCSA-2026-00005) detailing the issue and providing mitigation steps. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-3630?utm_source=openai)) The disclosure underscores the persistent risks in industrial control systems and the importance of timely patching. Organizations in manufacturing, energy, and logistics sectors should prioritize updating affected systems to prevent potential exploitation. ([praetorian.com](https://www.praetorian.com/blog/cve-2026-3630/?utm_source=openai))
4 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
