✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2761 to 2772 of 5183
2025 Mobile Malware Surge: Key Threats and Protective Measures
In 2025, Kaspersky's analysis revealed a significant surge in mobile malware attacks, with over 14 million incidents involving malicious, advertising, or unwanted software targeting mobile devices. Notably, adware constituted 62% of these detections, while the number of new Trojan banker installation packages for Android escalated to 255,090, marking a 271% increase from the previous year. This sharp rise underscores the growing profitability of such attacks for cybercriminals. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai)) The proliferation of preinstalled backdoors like Triada and Keenadu, embedded during device manufacturing, presents a formidable challenge, granting attackers extensive control over compromised devices. Additionally, the emergence of the Kimwolf IoT botnet, which exploits Android TV boxes for DDoS attacks and as reverse proxies, highlights the expanding threat landscape. These developments necessitate heightened vigilance and robust security measures to safeguard mobile users. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai))
5 months ago
Kill Chain
Malicious Laravel Packages Deploy PHP RAT
In March 2026, cybersecurity researchers identified malicious PHP packages on Packagist, masquerading as Laravel utilities, which deployed a cross-platform remote access trojan (RAT) functional on Windows, macOS, and Linux systems. The packages—nhattuanbl/lara-helper, nhattuanbl/simple-queue, and nhattuanbl/lara-swagger—were published by the user 'nhattuanbl' and contained obfuscated code that, once installed, connected to a command-and-control server, granting attackers full remote access to compromised hosts. This access allowed for execution of shell commands, file manipulation, and system reconnaissance, posing significant security risks to affected applications. ([thehackernews.com](https://thehackernews.com/2026/03/fake-laravel-packages-on-packagist.html?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting open-source ecosystems. Developers are urged to exercise caution when incorporating third-party packages, especially from less-known sources, and to implement rigorous security audits to detect and mitigate such vulnerabilities.
5 months ago
Kill Chain
Surge in Hacktivist DDoS Attacks Amid Middle East Tensions
Between February 28 and March 2, 2026, a surge of 149 hacktivist-driven distributed denial-of-service (DDoS) attacks targeted 110 organizations across 16 countries. This wave of cyber assaults was primarily in response to the U.S.-Israel coordinated military campaign against Iran, codenamed Epic Fury and Roaring Lion. The attacks predominantly focused on government entities, financial institutions, and telecommunications sectors, with the majority occurring in the Middle East, particularly in Kuwait, Israel, and Jordan. Notably, two hacktivist groups, Keymous+ and DieNet, were responsible for nearly 70% of the attack activity during this period. ([thehackernews.com](https://thehackernews.com/2026/03/149-hacktivist-ddos-attacks-hit-110.html?utm_source=openai)) This incident underscores the escalating trend of cyber retaliation in geopolitical conflicts, highlighting the need for organizations to bolster their cybersecurity defenses against ideologically motivated threat actors. The concentrated nature of these attacks emphasizes the importance of proactive threat intelligence and robust incident response strategies to mitigate potential disruptions to critical infrastructure and services.
5 months ago
Kill Chain
Understanding the Coruna iOS Exploit Kit: Implications and Protections
In early 2026, Google’s Threat Intelligence Group identified 'Coruna,' a sophisticated iOS exploit kit targeting devices running iOS versions 13.0 through 17.2.1. The kit comprises five full exploit chains utilizing 23 vulnerabilities, enabling attackers to execute remote code and escalate privileges. Initially observed in February 2025 within a surveillance vendor's operations, Coruna was subsequently employed by Russian espionage groups in mid-2025 and later by financially motivated Chinese cybercriminals by December 2025. The exploit kit facilitates the deployment of malware capable of exfiltrating sensitive data, including cryptocurrency wallets and personal information. ([thehackernews.com](https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html?utm_source=openai)) The emergence of Coruna underscores a concerning trend where advanced cyber tools, potentially developed by nation-states, proliferate into the hands of various threat actors. This incident highlights the critical need for organizations and individuals to maintain up-to-date software and implement robust security measures to mitigate the risks posed by such sophisticated exploits. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai))
5 months ago
Kill Chain
Iranian Cyber Retaliation in March 2026: A Wake-Up Call for Critical Infrastructure Security
In March 2026, following coordinated US-Israeli military strikes on Iran, Iranian state-sponsored cyber actors launched retaliatory cyber operations targeting critical infrastructure across the Middle East and the United States. These operations included Distributed Denial-of-Service (DDoS) attacks, phishing campaigns, and attempts to compromise surveillance systems. Notably, a malicious replica of the Israeli Home Front Command's RedAlert application was distributed to deliver surveillance malware, and internet-connected surveillance cameras in multiple countries were targeted to support operational planning and battle damage assessment. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/?utm_source=openai)) The escalation underscores the persistent cyber threat posed by Iranian actors, who have demonstrated the capability to exploit geopolitical tensions to conduct disruptive cyber activities. Organizations, especially those in critical infrastructure sectors, should remain vigilant and enhance their cybersecurity measures to mitigate potential risks associated with such state-sponsored cyber operations.
5 months ago
Kill Chain
Understanding the 2026 Google Workspace OAuth Attack
In March 2026, a sophisticated phishing campaign exploited OAuth redirection mechanisms to compromise Google Workspace accounts. Attackers crafted malicious OAuth applications that, when users attempted to authenticate, redirected them from trusted identity providers to attacker-controlled sites, leading to malware downloads. This method allowed adversaries to bypass traditional phishing defenses by leveraging legitimate authentication flows. The incident underscores the evolving tactics of threat actors who exploit standard protocol behaviors to gain unauthorized access, highlighting the need for organizations to implement stringent OAuth governance and cross-domain detection strategies.
5 months ago
Kill Chain
Qualcomm Android Zero-Day Exploited in 2026
In March 2026, Google disclosed a high-severity vulnerability, CVE-2026-21385, affecting Qualcomm's open-source display driver used in Android devices. This integer overflow flaw leads to memory corruption when processing user-supplied data without proper buffer size validation. The vulnerability was reported to Qualcomm on December 18, 2025, and patches were included in the March 2026 Android security update. Google noted indications of limited, targeted exploitation of this zero-day vulnerability in the wild. The March 2026 Android security bulletin addressed a total of 129 vulnerabilities, including this actively exploited flaw. The presence of an actively exploited zero-day vulnerability underscores the critical need for timely security updates. Organizations and individuals should prioritize applying the March 2026 security patch to mitigate potential risks associated with this and other vulnerabilities addressed in the update.
5 months ago
Kill Chain
Silver Dragon 2026: Unveiling APT41's Covert Cyberespionage Tactics
In mid-2024, the Chinese state-sponsored group Silver Dragon, associated with APT41, initiated cyberespionage campaigns targeting government organizations across Southeast Asia and Europe. The group gained initial access through exploiting public-facing servers and phishing emails containing malicious attachments. To maintain persistence, Silver Dragon hijacked legitimate Windows services, allowing their malware to blend seamlessly with normal system activities. They deployed custom tools like GearDoor, which utilized Google Drive for covert command-and-control communications, SSHcmd for remote access, and SliverScreen for capturing user activity screenshots. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who are increasingly leveraging trusted cloud services and legitimate system processes to evade detection. The use of such sophisticated methods highlights the need for organizations to enhance their cybersecurity measures and remain vigilant against advanced persistent threats. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai))
5 months ago
Kill Chain
Critical Command Injection Vulnerability in VMware Aria Operations
In February 2026, a critical command injection vulnerability (CVE-2026-22719) was identified in VMware Aria Operations, allowing unauthenticated attackers to execute arbitrary commands during support-assisted product migrations. This flaw, with a CVSS score of 8.1, could lead to remote code execution and full system compromise. Broadcom released patches and workarounds to address the issue. ([support.broadcom.com](https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/36947?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog on March 3, 2026, indicating active exploitation in the wild. Federal agencies are mandated to apply the fixes by March 24, 2026. ([thehackernews.com](https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html?utm_source=openai))
5 months ago
Kill Chain
INTERPOL's Operation Sentinel: A Landmark Cybercrime Crackdown in Africa
Between October 27 and November 27, 2025, INTERPOL coordinated Operation Sentinel, a significant cybercrime crackdown across 19 African countries. The operation led to the arrest of 574 suspects involved in business email compromise (BEC), digital extortion, and ransomware attacks. Authorities dismantled over 6,000 malicious links, decrypted six ransomware variants, and recovered approximately USD 3 million. The cases investigated were linked to estimated financial losses exceeding USD 21 million. Notable incidents included a thwarted USD 7.9 million BEC attempt targeting a petroleum company in Senegal and a ransomware attack in Ghana that encrypted 100 terabytes of data, with nearly 30 terabytes successfully recovered. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai)) This operation underscores the escalating threat of cybercrime in Africa, with online offenses now accounting for a significant proportion of all crimes in many regions. The success of Operation Sentinel highlights the effectiveness of international collaboration in combating cyber-related offenses and the critical need for continued vigilance and cooperation to protect critical infrastructure and sensitive data. ([interpol.int](https://www.interpol.int/es/Noticias-y-acontecimientos/Noticias/2025/574-arrests-and-USD-3-million-recovered-in-coordinated-cybercrime-operation-across-Africa?utm_source=openai))
5 months ago
Kill Chain
Critical Vulnerabilities in Everon's OCPP Backends Threaten EV Charging Security
In March 2026, multiple critical vulnerabilities were identified in Everon's OCPP Backends, affecting all versions of the platform. These vulnerabilities include missing authentication for critical functions, improper restriction of excessive authentication attempts, insufficient session expiration, and insufficiently protected credentials. Exploitation of these flaws could allow attackers to gain unauthorized administrative control over charging stations or disrupt services through denial-of-service attacks. ([incibe.es](https://www.incibe.es/incibe-cert/alerta-temprana/avisos-sci/multiples-vulnerabilidades-en-ocpp-backends-de-everon?utm_source=openai)) The discovery of these vulnerabilities underscores the growing cybersecurity risks within the electric vehicle (EV) charging infrastructure. As the adoption of EVs accelerates, ensuring the security of charging networks becomes paramount to prevent potential operational disruptions and safeguard user data.
5 months ago
Kill Chain
Critical Vulnerabilities in Hitachi Energy's Relion REB500: Immediate Action Required
In February 2026, Hitachi Energy disclosed two significant vulnerabilities in its Relion REB500 product, identified as CVE-2026-2459 and CVE-2026-2460. These flaws allow authenticated users with specific roles to access and modify unauthorized directories, potentially compromising system integrity. The vulnerabilities affect versions up to and including 8.3.3.0. Hitachi Energy has released version 8.3.3.1 to address these issues and recommends users update promptly. ([cve.qwiksec.com](https://cve.qwiksec.com/cve/CVE-2026-2460?utm_source=openai)) This incident underscores the critical importance of stringent access controls and timely software updates in industrial control systems, especially within the energy sector. Organizations must remain vigilant against privilege escalation vulnerabilities to safeguard operational technology environments.
5 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
