✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2821 to 2832 of 5196
North Korean Hackers Exploit npm Packages in 2026 Supply Chain Attack
In March 2026, North Korean state-sponsored hackers launched a sophisticated supply chain attack by publishing 26 malicious npm packages disguised as developer tools. These packages utilized steganography to extract command-and-control (C2) URLs from seemingly benign Pastebin content, ultimately deploying a cross-platform remote access trojan (RAT) targeting developers. The C2 infrastructure was hosted on Vercel across 31 deployments, enabling the attackers to execute commands, exfiltrate sensitive data, and maintain persistent access to compromised systems. This incident underscores the evolving tactics of threat actors in exploiting trusted open-source ecosystems to infiltrate developer environments. The use of steganography and multi-stage payload delivery highlights the increasing complexity of supply chain attacks, emphasizing the need for enhanced vigilance and security measures within the software development community.
5 months ago
Kill Chain
APT28's Exploitation of MSHTML Zero-Day Vulnerability in February 2026
In early 2026, the Russian state-sponsored threat actor APT28 exploited a zero-day vulnerability, CVE-2026-21513, in the MSHTML Framework. This high-severity flaw allowed attackers to bypass security features by convincing users to open malicious HTML or shortcut files, leading to potential code execution. The exploitation occurred before Microsoft's February 2026 Patch Tuesday, which subsequently addressed the vulnerability. ([thehackernews.com](https://thehackernews.com/2026/03/apt28-tied-to-cve-2026-21513-mshtml-0.html?utm_source=openai)) The incident underscores the persistent threat posed by state-sponsored actors leveraging zero-day vulnerabilities. Organizations are reminded of the critical importance of timely patch management and user education to mitigate risks associated with such sophisticated attacks.
5 months ago
Kill Chain
Escalation of Iranian Cyber Attacks Post-2026 Military Strikes
In response to the joint U.S.-Israeli military strikes on February 28, 2026, Iranian-affiliated cyber actors have intensified their operations targeting U.S. critical infrastructure. Utilizing tactics such as brute force attacks, password spraying, and exploitation of unpatched vulnerabilities, these actors aim to disrupt services and exfiltrate sensitive data. Notably, sectors including energy, defense, and public health have reported increased intrusion attempts, with some incidents leading to operational disruptions and data breaches. This escalation underscores the persistent cyber threat posed by Iranian state-sponsored and aligned groups, even amidst kinetic military engagements. Organizations are urged to bolster their cybersecurity postures, as the likelihood of retaliatory cyber operations remains high, potentially leading to significant operational and reputational impacts.
5 months ago
Kill Chain
Odido 2026 Data Breach: A Case Study in Social Engineering Vulnerabilities
In February 2026, Dutch telecommunications provider Odido experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers employed sophisticated social engineering tactics, including phishing emails and impersonation of IT staff, to gain unauthorized access to Odido's customer relationship management system. This breach resulted in the exposure of sensitive personal information of approximately 6.2 million customers, encompassing names, addresses, phone numbers, email addresses, dates of birth, customer numbers, bank account numbers, and identification details. Notably, passwords, call records, and billing information remained uncompromised. The incident stands as one of the largest private data leaks in Dutch history, highlighting critical vulnerabilities in data security practices within the telecommunications sector. ([cybernews.com](https://cybernews.com/security/odido-hackers-phishing-attack/?utm_source=openai)) This breach underscores the escalating threat posed by social engineering attacks targeting customer service systems. The incident serves as a stark reminder for organizations to bolster their cybersecurity measures, particularly in safeguarding customer data against increasingly sophisticated attack vectors. ([cybernews.com](https://cybernews.com/security/odido-hackers-phishing-attack/?utm_source=openai))
5 months ago
Kill Chain
Understanding the Google Gemini 2025 Prompt Injection Vulnerability
In mid-2025, security researchers identified a significant vulnerability in Google's AI assistant, Gemini, integrated into Gmail and other Workspace applications. This flaw, known as 'prompt injection,' allowed attackers to embed hidden instructions within emails using HTML and CSS techniques, such as invisible text. When Gemini processed these emails to generate summaries, it executed the concealed commands, potentially leading to deceptive summaries that could mislead users into divulging sensitive information or performing unintended actions. The exploitation of this vulnerability posed substantial risks, including unauthorized access to user data and increased susceptibility to phishing attacks. ([techradar.com](https://www.techradar.com/pro/security/google-gemini-can-be-hijacked-to-display-fake-email-summaries-in-phishing-scams?utm_source=openai)) The discovery of this vulnerability underscores the evolving nature of cyber threats targeting AI-driven platforms. As AI assistants become more integrated into daily workflows, they present new attack vectors that traditional security measures may not fully address. This incident highlights the critical need for continuous monitoring and updating of AI systems to safeguard against emerging threats and to maintain user trust in these technologies.
5 months ago
Kill Chain
Understanding the 2026 RTF Malware Delivery Exploit
In early 2026, cybersecurity researchers identified a sophisticated malware delivery method exploiting Rich Text Format (RTF) files. Attackers embedded malicious ZIP files within RTF documents, which, when opened, executed embedded scripts to download and install malware on the victim's system. This technique bypassed traditional security measures by leveraging the inherent trust in RTF files and the complexity of detecting embedded compressed files. The campaign targeted various sectors, leading to data breaches and operational disruptions. This incident underscores the evolving tactics of cyber adversaries who continuously adapt to circumvent security defenses. The use of RTF files for malware delivery highlights the need for organizations to enhance their email filtering, user awareness training, and endpoint detection capabilities to mitigate such threats.
5 months ago
Kill Chain
Chrome's 2026 WebView Vulnerability: A Cautionary Tale of Malicious Extensions
In January 2026, a high-severity vulnerability (CVE-2026-0628) was discovered in Google Chrome's WebView component, allowing attackers to exploit insufficient policy enforcement. By convincing users to install malicious extensions, attackers could inject scripts or HTML into privileged pages, potentially leading to unauthorized data access and system compromise. Google promptly addressed this issue by releasing Chrome version 143.0.7499.192, mitigating the risk posed by this flaw. ([thehackerwire.com](https://www.thehackerwire.com/vulnerability/CVE-2026-0628/?utm_source=openai)) This incident underscores the critical importance of vigilant extension management and prompt software updates. The exploitation of browser vulnerabilities through malicious extensions highlights the evolving tactics of cyber adversaries, emphasizing the need for continuous monitoring and robust security practices to protect sensitive information.
5 months ago
Kill Chain
LLM-Assisted Deanonymization: A New Era of Online Privacy Challenges
In February 2026, researchers from ETH Zurich and Anthropic demonstrated that large language models (LLMs) can effectively deanonymize pseudonymous online users by analyzing unstructured text data. Their method involved extracting identity-relevant features from anonymous posts, searching for candidate matches via semantic embeddings, and reasoning over top candidates to verify matches. This approach achieved up to 68% recall at 90% precision, significantly outperforming traditional methods. The study highlights the diminishing effectiveness of online pseudonymity and raises concerns about privacy and data protection in the digital age. ([arxiv.org](https://arxiv.org/abs/2602.16800?utm_source=openai)) This research underscores the urgent need for enhanced privacy measures and regulatory frameworks to protect individuals' online identities. As LLMs become more sophisticated, the potential for misuse in deanonymizing users poses significant risks, necessitating proactive strategies to safeguard personal information.
5 months ago
Kill Chain
AI-Enhanced Reconnaissance: Adapting to the New Cyber Threat Landscape
In 2026, cyber adversaries have increasingly leveraged AI-enhanced reconnaissance techniques to conduct 'silent probing' campaigns. These operations involve prolonged, subtle monitoring of organizational defenses to map detection thresholds, response times, and operational routines. By analyzing defender behaviors over time, attackers can tailor subsequent attacks to evade detection and maximize impact. This shift from targeting technical vulnerabilities to exploiting behavioral patterns has led to more sophisticated and successful breaches, underscoring the need for adaptive and unpredictable defense strategies. The rise of AI-driven reconnaissance signifies a paradigm shift in cyber threats, emphasizing the importance of behavioral analysis in security postures. Organizations must now contend with adversaries who can learn and adapt to their defensive measures, making traditional, static security protocols insufficient. This evolution necessitates a reevaluation of incident response strategies to incorporate dynamic and behavior-based defense mechanisms.
5 months ago
Kill Chain
ClawJacked: Critical Vulnerability in OpenClaw AI Agent Exposes Systems to Hijacking
In February 2026, a critical vulnerability known as 'ClawJacked' was discovered in OpenClaw, a widely-used open-source AI agent. This flaw allowed malicious websites to exploit OpenClaw's WebSocket interface, enabling unauthorized access to locally running instances. Attackers could silently brute-force the gateway password, register as trusted devices, and gain full control over the AI agent, leading to potential data exfiltration and system compromise. OpenClaw promptly addressed the issue by releasing a patch in version 2026.2.25. ([thehackernews.com](https://thehackernews.com/2026/02/clawjacked-flaw-lets-malicious-sites.html?utm_source=openai)) The ClawJacked incident underscores the growing security challenges associated with autonomous AI agents. As these agents become more integrated into critical workflows, vulnerabilities like this highlight the urgent need for robust security measures, including regular updates, thorough vetting of third-party integrations, and heightened awareness of potential attack vectors. ([prnewswire.com](https://www.prnewswire.com/news-releases/oasis-security-research-team-discovers-critical-vulnerability-in-openclaw-302698939.html?utm_source=openai))
5 months ago
Kill Chain
AI-Assisted Cyberattack Compromises 600+ FortiGate Firewalls Globally
Between January 11 and February 18, 2026, a Russian-speaking threat actor utilized commercial generative AI tools to compromise over 600 Fortinet FortiGate firewalls across 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking two-factor authentication, without leveraging any specific software vulnerabilities. Once access was gained, AI-generated scripts were employed to extract and decrypt sensitive data, including SSL-VPN credentials, administrative passwords, and network configurations. This information facilitated further network infiltration and reconnaissance activities. ([cybernews.com](https://cybernews.com/security/threat-actor-ai-tools-claude-fortinet-fortigate/?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools enable even low-skilled attackers to execute large-scale, sophisticated cyberattacks. Organizations must reassess their security postures, emphasizing the importance of robust authentication mechanisms and the need to secure management interfaces against unauthorized access.
5 months ago
Kill Chain
South Korea Tax Agency's Data Exposure Results in $4.8M Crypto Theft
In February 2026, South Korea's National Tax Service (NTS) inadvertently exposed the mnemonic recovery phrase of a seized cryptocurrency wallet in an official press release. This oversight allowed unauthorized individuals to access and transfer approximately 4 million Pre-Retogeum (PRTG) tokens, valued at $4.8 million, from the wallet. The incident underscores significant lapses in the secure handling of digital assets by governmental bodies. This event highlights the critical need for stringent operational security measures when managing and disclosing information related to digital assets. The exposure of sensitive data, such as wallet recovery phrases, can lead to substantial financial losses and erode public trust in institutional competence.
5 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
