✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2737 to 2748 of 5183
Bing AI Promotes Malicious OpenClaw Installers Distributing Info-Stealing Malware
In February 2026, threat actors exploited the popularity of OpenClaw, an open-source AI agent, by creating malicious GitHub repositories posing as legitimate OpenClaw installers. These repositories were promoted through Microsoft's Bing AI-enhanced search results, leading users to download and execute malware-laden installers. Upon execution, these installers deployed various malicious payloads, including the Vidar information stealer and GhostSocks proxy malware, compromising sensitive user data and converting infected machines into proxy nodes for further malicious activities. This incident underscores the evolving tactics of cybercriminals who leverage trusted platforms and emerging technologies to distribute malware. The use of AI-enhanced search results to promote malicious content highlights the need for enhanced vigilance and security measures in AI-driven platforms and search engines.
5 months ago
Kill Chain
UAT-9244's New Malware Threatens South American Telecoms
Since 2024, the China-linked advanced persistent threat actor UAT-9244 has been targeting telecommunication service providers in South America, compromising Windows, Linux, and network-edge devices. The group employs three previously undocumented malware families: TernDoor, a Windows backdoor; PeerTime, a Linux backdoor utilizing the BitTorrent protocol; and BruteEntry, a brute-force scanner that establishes proxy infrastructure. These tools enable UAT-9244 to maintain persistent access, execute remote commands, and expand their network infiltration. This incident underscores the evolving sophistication of state-sponsored cyber threats targeting critical infrastructure. The use of novel malware and advanced techniques highlights the need for enhanced cybersecurity measures and vigilance within the telecommunications sector.
5 months ago
Kill Chain
APT28's BadPaw and MeowMeow Malware: A New Threat to Ukraine
In early March 2026, cybersecurity researchers identified a sophisticated cyber espionage campaign targeting Ukrainian entities. The attack, attributed with moderate confidence to the Russian state-sponsored group APT28, commenced with phishing emails sent from ukr[.]net addresses. These emails contained links to ZIP archives, leading to the deployment of two previously undocumented malware families: BadPaw, a .NET-based loader, and MeowMeow, a backdoor capable of remote command execution and file system manipulation. The malware employed advanced evasion techniques, including sandbox detection and obfuscation, to maintain persistence and avoid detection. ([thehackernews.com](https://thehackernews.com/2026/03/apt28-linked-campaign-deploys-badpaw.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors and highlights the persistent cyber threats facing Ukraine. The use of novel malware strains and sophisticated delivery methods reflects a broader trend of increasing complexity in cyber attacks, necessitating enhanced vigilance and adaptive defense strategies among targeted organizations.
5 months ago
Kill Chain
Dust Specter 2026: Iranian APT's AI-Assisted Cyberattack on Iraqi Officials
In January 2026, the Iranian-linked Advanced Persistent Threat (APT) group known as Dust Specter launched a sophisticated cyberattack targeting Iraqi government officials. By impersonating Iraq's Ministry of Foreign Affairs, the attackers distributed previously undocumented malware—SPLITDROP, TWINTASK, TWINTALK, and GHOSTFORM—through two distinct infection chains. These campaigns utilized advanced techniques such as DLL sideloading, in-memory PowerShell execution, and the exploitation of compromised Iraqi government infrastructure to stage malicious payloads. The operation's complexity and the use of generative AI tools in malware development underscore the evolving capabilities of state-sponsored cyber actors. ([thehackernews.com](https://thehackernews.com/2026/03/dust-specter-targets-iraqi-officials.html?utm_source=openai)) This incident highlights a concerning trend in cyber warfare: the integration of artificial intelligence in malware development, enabling more adaptive and evasive threats. Organizations must enhance their cybersecurity measures to detect and mitigate such sophisticated attacks, emphasizing the need for continuous monitoring and advanced threat intelligence.
5 months ago
Kill Chain
Cisco SD-WAN Manager Vulnerabilities Exploited in 2026
In March 2026, Cisco disclosed active exploitation of two vulnerabilities in its Catalyst SD-WAN Manager: CVE-2026-20122 and CVE-2026-20128. CVE-2026-20122 allows authenticated remote attackers with read-only API access to overwrite arbitrary files on the local file system, potentially escalating privileges. CVE-2026-20128 enables authenticated local attackers to access credential files, granting Data Collection Agent (DCA) user privileges. These vulnerabilities affect multiple versions of the software, with patches released in late February 2026. Organizations are urged to update to fixed releases promptly to mitigate risks. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-sdwan-authbp-qwCX8D4v.html?utm_source=openai)) The active exploitation of these vulnerabilities underscores the critical need for timely software updates and robust access controls. As attackers increasingly target network infrastructure components, organizations must prioritize patch management and monitor for unusual activities to prevent unauthorized access and potential data breaches.
5 months ago
Kill Chain
OpenClaw AI Security Breach 2026: A Wake-Up Call for AI Security
In early 2026, OpenClaw, an open-source AI assistant, experienced multiple security breaches due to misconfigurations and vulnerabilities. Attackers exploited exposed instances to gain unauthorized access, leading to data exfiltration and system compromises. Notably, over 40,000 instances were found exposed on the public internet, with many lacking proper authentication, allowing cybercriminals to deploy infostealer malware and hijack AI agents. ([blog.barrack.ai](https://blog.barrack.ai/openclaw-security-vulnerabilities-2026/?utm_source=openai)) These incidents underscore the critical need for robust security measures in AI deployments. The rapid adoption of AI agents like OpenClaw, coupled with inadequate security configurations, has created significant attack surfaces. Organizations must prioritize securing AI systems to prevent unauthorized access and data breaches, especially as AI integration becomes more prevalent in personal and professional environments.
5 months ago
Kill Chain
Critical VMware Aria Operations Vulnerability Exploited by UNC5174
In February 2026, a critical command injection vulnerability (CVE-2026-22719) was identified in VMware Aria Operations, allowing unauthenticated attackers to execute arbitrary commands remotely. This flaw, with a CVSS score of 8.1, was actively exploited by the Chinese state-sponsored group UNC5174 since October 2024, enabling them to gain root-level access to virtual machines, potentially compromising entire cloud environments. The exploitation of this vulnerability underscores the persistent threat posed by state-sponsored actors targeting critical infrastructure. Organizations are urged to apply the latest patches promptly and enhance monitoring of their virtualized environments to mitigate such risks.
5 months ago
Kill Chain
Surge in Automated Opportunistic Scanning Campaigns in 2026
In late January 2026, a coordinated automated scanning campaign targeted web servers globally, probing for exposed sensitive files such as compressed backups and database dumps. This activity, characterized by rapid, systematic requests, was detected by multiple honeypots worldwide, indicating a widespread and synchronized effort to exploit misconfigured or vulnerable web services. The surge in scanning activity underscores the persistent threat posed by opportunistic attackers leveraging automation to identify and exploit weaknesses in internet-facing systems. Organizations must prioritize secure configurations, continuous monitoring, and proactive defense strategies to mitigate the risks associated with such automated attacks.
5 months ago
Kill Chain
Critical Vulnerability in Tauri Framework's Shell Plugin Leads to Remote Code Execution
In April 2025, a critical vulnerability (CVE-2025-31477) was identified in the Tauri framework's shell plugin, which is used for building cross-platform desktop applications. This flaw allowed unregulated access to system shell operations, enabling attackers to execute arbitrary code on affected systems. The vulnerability stemmed from improper validation of allowed protocols in the plugin's 'open' endpoint, permitting potentially dangerous protocols like 'file://', 'smb://', and 'nfs://'. Exploitation required either direct exposure of the endpoint to application users or code execution within the frontend of a Tauri application. The issue was addressed in version 2.2.1 of the plugin. ([github.com](https://github.com/tauri-apps/plugins-workspace/security/advisories/GHSA-c9pr-q8gx-3mgp?utm_source=openai)) This incident underscores the importance of rigorous input validation and protocol handling in application development. As frameworks like Tauri gain popularity for their efficiency in building cross-platform applications, ensuring the security of their components becomes paramount. Developers are urged to promptly update to patched versions and adhere to best practices in secure coding to mitigate such vulnerabilities.
5 months ago
Kill Chain
BadeSaba Calendar App Hack: A New Front in Cyber Warfare
In late February 2026, during coordinated military strikes by the United States and Israel on Iranian targets, the BadeSaba Calendar app—a widely used prayer-timing application with over 5 million downloads—was compromised. Users received push notifications in Persian urging military personnel and civilians to defect, lay down arms, or join opposition forces. Messages included phrases such as "Help has arrived" and "It's time for reckoning." This cyber operation coincided with physical airstrikes and resulted in a near-total internet blackout in Iran, disrupting government communications, state media, and public services. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Cyberwarfare_during_the_2026_Iran_war?utm_source=openai)) This incident underscores the evolving landscape of cyber warfare, where digital platforms are exploited to disseminate psychological operations alongside kinetic military actions. The strategic use of a trusted religious app to deliver propaganda highlights the need for robust cybersecurity measures, especially for applications with significant user bases in geopolitically sensitive regions.
5 months ago
Kill Chain
Unveiling the 2025 Salesloft Drift Supply Chain Attack: Implications and Lessons
In August 2025, a significant supply chain attack targeted the Salesloft Drift AI chatbot integration, compromising OAuth tokens and affecting over 700 organizations, including Cloudflare, Palo Alto Networks, and Zscaler. Attackers exploited these tokens to gain unauthorized access to Salesforce instances, exfiltrating sensitive data such as AWS access keys and passwords. The breach originated from a compromised Salesloft GitHub account, accessed between March and June 2025, allowing attackers to manipulate repositories and establish malicious workflows. This incident underscores the critical vulnerabilities present in third-party integrations and the necessity for stringent security measures in interconnected systems. The attack highlights the growing trend of cybercriminals leveraging trusted platforms to infiltrate organizations, emphasizing the need for enhanced monitoring and control over third-party services.
5 months ago
Kill Chain
LeakBase 2026: Global Law Enforcement Takedown of Major Cybercrime Forum
In early March 2026, an international coalition of law enforcement agencies from 14 countries, including the United States, executed a coordinated operation to dismantle LeakBase, one of the world's largest cybercrime forums. LeakBase, active since 2021, had over 142,000 registered members and hosted extensive archives of stolen data, including hundreds of millions of account credentials, credit card numbers, and sensitive personal information. The operation involved seizing the forum's domains, arresting multiple individuals, and collecting substantial evidence, effectively disrupting a major hub for cybercriminal activities. ([justice.gov](https://www.justice.gov/opa/pr/united-states-leads-dismantlement-one-worlds-largest-hacker-forums?utm_source=openai)) This takedown underscores the escalating global efforts to combat cybercrime and the increasing collaboration among international law enforcement agencies. The operation serves as a stark reminder of the persistent threat posed by online platforms that facilitate the trade of stolen data and hacking tools, highlighting the need for continuous vigilance and proactive measures in cybersecurity. ([justice.gov](https://www.justice.gov/opa/pr/united-states-leads-dismantlement-one-worlds-largest-hacker-forums?utm_source=openai))
5 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
