✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2929 to 2940 of 5196
Spain Arrests Anonymous Fénix Hacktivists for DDoS Attacks
In February 2026, Spanish authorities arrested four members of the hacktivist group 'Anonymous Fénix' for orchestrating distributed denial-of-service (DDoS) attacks against government ministries, political parties, and public institutions. The group initiated its activities in April 2023, intensifying efforts after the October 2024 DANA storm in Valencia, which resulted in significant casualties and damage. They utilized social media platforms like X and Telegram to disseminate anti-government messages and recruit participants for their cyber campaigns. The arrests, conducted in May 2025 and February 2026 across various Spanish cities, led to the judicial seizure of the group's online accounts and the closure of their communication channels. ([web.guardiacivil.es](https://web.guardiacivil.es/en/destacados/noticias/Detenidos-los-cuatro-principales-integrantes-del-grupo-hacktivista-Anonymous-Fenix-por-ciberataques-contra-organismos-publicos/?utm_source=openai)) This incident underscores the persistent threat posed by hacktivist groups leveraging socio-political events to justify cyberattacks. The use of DDoS tactics to disrupt critical government services highlights the need for robust cybersecurity measures and proactive monitoring of online platforms for recruitment and coordination activities.
5 months ago
Kill Chain
MuddyWater's Operation Olalampo: A New Era of Cyber Threats in MENA
In early 2026, the Iranian state-sponsored APT group MuddyWater launched 'Operation Olalampo,' targeting organizations across the Middle East and North Africa (MENA) region. The campaign utilized sophisticated spear-phishing emails with malicious Microsoft Office documents to deploy new malware families, including GhostFetch, HTTP_VIP, CHAR, and GhostBackDoor. These tools enabled the attackers to perform system reconnaissance, execute remote commands, and exfiltrate sensitive data, compromising entities in sectors such as telecommunications, government, and energy. This incident underscores a significant evolution in MuddyWater's tactics, notably their adoption of Rust-based malware and AI-assisted development processes. The group's enhanced capabilities and persistent targeting of critical infrastructure highlight the escalating cyber threat landscape in the MENA region, emphasizing the need for robust cybersecurity measures and vigilance against advanced persistent threats.
5 months ago
Kill Chain
PromptSpy AI Malware: Unveiling the Future of Android Cyber Threats
In February 2026, cybersecurity researchers identified 'PromptSpy,' the first known Android malware leveraging generative AI at runtime. This sophisticated malware utilizes Google's Gemini model to adapt its persistence mechanisms across various devices, enhancing its ability to evade detection. PromptSpy's discovery marks a significant evolution in mobile threats, demonstrating the integration of AI to dynamically modify malicious behavior during execution. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/promptspy-is-the-first-android-malware-to-use-generative-ai-at-runtime/?utm_source=openai)) The emergence of AI-driven malware like PromptSpy underscores a critical shift in cyber threats, where adversaries harness advanced technologies to create more resilient and adaptive attack vectors. This development necessitates a reevaluation of current security measures to effectively counteract AI-enhanced malicious activities.
5 months ago
Kill Chain
SANDWORM_MODE: A New Era of Supply Chain Attacks Targeting Developers
In February 2026, a sophisticated supply chain attack, dubbed SANDWORM_MODE, targeted the npm ecosystem by distributing at least 19 malicious packages. These packages were designed to harvest sensitive information, including system data, access tokens, environment secrets, and API keys from developer environments. The malware propagated by exploiting compromised npm and GitHub accounts, enabling widespread credential theft and unauthorized access to development infrastructures. Notably, the attack introduced a module that infiltrated AI coding assistants, extracting API keys from nine large language model providers and injecting malicious servers into tool configurations. This incident underscores the escalating complexity and reach of supply chain attacks, particularly those leveraging trusted open-source repositories. The integration of AI toolchain manipulation highlights a concerning evolution in attacker tactics, emphasizing the need for enhanced vigilance and security measures within development environments.
5 months ago
Kill Chain
Unveiling the Wormable XMRig Campaign: A Deep Dive into BYOVD Exploits and Time-Based Logic Bombs
In February 2026, cybersecurity researchers uncovered a sophisticated cryptojacking campaign that utilized pirated software bundles to deploy a customized XMRig miner on compromised systems. The malware exhibited worm-like capabilities, spreading via external storage devices, and employed a 'Bring Your Own Vulnerable Driver' (BYOVD) technique to escalate privileges. Additionally, it incorporated a time-based logic bomb set to deactivate the malware after December 23, 2025, indicating a planned operational timeframe. This campaign underscores the evolving tactics of cybercriminals, combining social engineering, legitimate software exploitation, and advanced persistence mechanisms to maximize cryptocurrency mining output. The use of BYOVD exploits and logic bombs highlights the need for robust security measures to detect and mitigate such multifaceted threats.
5 months ago
Kill Chain
APT28's Operation MacroMaze: A New Wave of Cyber Espionage
Between September 2025 and January 2026, the Russian state-sponsored threat actor APT28 conducted Operation MacroMaze, targeting entities in Western and Central Europe. The campaign utilized spear-phishing emails containing malicious Word documents with embedded macros. These macros exploited legitimate services like webhook[.]site for command-and-control and data exfiltration, employing techniques such as headless browser execution and keyboard simulation to evade detection. ([thehackernews.com](https://thehackernews.com/2026/02/apt28-targeted-european-entities-using.html?utm_source=openai)) This incident underscores the evolving tactics of APT28, highlighting their ability to adapt and leverage basic tools in sophisticated ways. The use of legitimate services for malicious purposes poses significant challenges for detection and mitigation, emphasizing the need for robust cybersecurity measures and continuous monitoring.
5 months ago
Kill Chain
Unveiling the Malicious JPEG Infostealer Campaign of February 2026
In February 2026, a sophisticated malware campaign was identified, leveraging steganographic techniques to embed malicious code within JPEG image files. Unsuspecting users were tricked into downloading these seemingly benign images, which, upon execution, initiated a multi-stage infection process. The primary payload was an infostealer designed to extract sensitive data, including browser credentials and system information, while maintaining communication with a command-and-control server. This method allowed attackers to exfiltrate data stealthily, minimizing detection by traditional security measures. This incident underscores the evolving tactics of cybercriminals, who are increasingly employing advanced obfuscation methods like steganography to bypass security defenses. The use of common file formats, such as JPEGs, as carriers for malware highlights the need for enhanced vigilance and the adoption of comprehensive security solutions capable of detecting such covert threats.
5 months ago
Kill Chain
Critical Vulnerabilities in Major Password Managers Expose Millions
In February 2026, researchers from ETH Zurich and Università della Svizzera italiana identified 25 critical vulnerabilities across three major password managers: Bitwarden, LastPass, and Dashlane. These flaws, affecting over 60 million users, were categorized into key escrow mechanisms, item-level vault encryption, sharing features, and backward compatibility issues. Exploiting these vulnerabilities could allow attackers to bypass zero-knowledge encryption claims, leading to unauthorized access and modification of users' stored passwords and vault data. ([cybersecuritynews.com](https://cybersecuritynews.com/password-managers-vulnerability/?utm_source=openai)) The study underscores the ongoing challenges in balancing security and user convenience in password management solutions. While the affected companies have begun implementing fixes, the incident highlights the necessity for continuous evaluation and enhancement of security protocols to protect sensitive user information.
5 months ago
Kill Chain
Arkanix Stealer: A Brief Yet Impactful AI-Assisted Malware Campaign
In late 2025, the Arkanix Stealer emerged as an AI-assisted information-stealing malware, promoted on dark web forums and distributed through Discord channels. The malware targeted Windows systems, employing advanced evasion techniques to bypass security controls. It harvested sensitive data, including browser credentials, cryptocurrency wallets, VPN accounts, and system metadata, which was then exfiltrated to attacker-controlled infrastructure. The operation was short-lived, with the author dismantling the control panel and Discord server within two months, suggesting a quick financial gain motive. This incident underscores the growing trend of cybercriminals leveraging AI to rapidly develop and deploy sophisticated malware, reducing development time and costs. The swift emergence and disappearance of such threats pose significant challenges for detection and mitigation, highlighting the need for continuous vigilance and adaptive security measures.
5 months ago
Kill Chain
AI-Powered Cyberattack Compromises 600 Fortinet Firewalls in 2026
Between January 11 and February 18, 2026, a Russian-speaking threat actor utilized generative AI services to compromise over 600 FortiGate firewalls across 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking multi-factor authentication, without leveraging any known vulnerabilities. Once access was gained, AI-assisted tools were employed to automate reconnaissance, extract configurations, and facilitate lateral movement within the networks. This campaign underscores the evolving threat landscape where AI technologies are being harnessed to amplify the capabilities of less sophisticated attackers, enabling them to execute large-scale intrusions with increased efficiency. Organizations must prioritize fundamental security measures, including securing management interfaces, enforcing strong authentication protocols, and maintaining vigilant monitoring to mitigate such AI-augmented threats.
5 months ago
Kill Chain
CISA Highlights Critical Roundcube Vulnerabilities Amid Active Exploitation
In February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities affecting Roundcube webmail software to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. The first, CVE-2025-49113, is a deserialization flaw allowing remote code execution by authenticated users due to improper validation of the '_from' parameter in 'upload.php'. The second, CVE-2025-68461, is a cross-site scripting vulnerability via the 'animate' tag in SVG documents. Both vulnerabilities have been exploited by threat actors, including nation-state groups like APT28 and Winter Vivern, to steal login credentials and spy on sensitive communications. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent targeting of webmail platforms by sophisticated adversaries. Organizations using Roundcube are urged to apply the latest security patches promptly to mitigate potential risks. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai))
5 months ago
Kill Chain
Predator Spyware's Stealthy Bypass of iOS Recording Indicators
In February 2026, security researchers uncovered that Intellexa's Predator spyware can suppress iOS's camera and microphone recording indicators, allowing covert surveillance without user awareness. By injecting code into SpringBoard, the spyware intercepts sensor activity updates, preventing the green and orange dots from appearing when the camera or microphone is active. This technique requires prior full device compromise, including kernel-level access, and does not exploit new iOS vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/predator-spyware-hooks-ios-springboard-to-hide-mic-camera-activity/?utm_source=openai)) This discovery highlights the evolving sophistication of commercial spyware and underscores the importance of maintaining up-to-date device security measures. Users should be aware that visual indicators alone may not reliably signal unauthorized access to device sensors, emphasizing the need for comprehensive security practices.
5 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
