✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3097 to 3108 of 5227
Critical Vulnerability in Hitachi Energy's FOX61x Products (CVE-2024-3596)
In January 2026, Hitachi Energy disclosed a critical vulnerability (CVE-2024-3596) in its FOX61x products, specifically affecting versions R18 and R17A and earlier. This flaw, inherent in the RADIUS protocol under RFC 2865, allows local attackers to modify valid responses through a chosen-prefix collision attack on the MD5 Response Authenticator signature. Exploitation could compromise the confidentiality, integrity, and availability of the affected systems. The vulnerability is particularly relevant when FOX61x devices are configured to use remote RADIUS authentication. ([it4automation.com](https://it4automation.com/security-alerts/hitachi-energy-fox61x-foxcst-and-foxman-un-products/?utm_source=openai)) This incident underscores the persistent risks associated with legacy authentication protocols and the importance of implementing robust security measures. Organizations utilizing FOX61x devices are urged to apply the recommended mitigations promptly to prevent potential exploitation.
6 months ago
Kill Chain
Critical Vulnerability in TP-Link VIGI Cameras: Authentication Bypass Exploit (CVE-2026-0629)
In January 2026, a critical vulnerability (CVE-2026-0629) was discovered in TP-Link's VIGI series surveillance cameras, affecting over 32 models. This flaw allowed attackers on the same local network to bypass authentication by exploiting the password recovery feature in the cameras' local web interface. By manipulating client-side state, attackers could reset the administrator password without verification, granting them full administrative access to the device. This access enabled potential compromise of device configurations, network security, and unauthorized viewing of live and recorded video feeds. ([tp-link.com](https://www.tp-link.com/us/support/faq/4899/?utm_source=openai)) The incident underscores the growing risks associated with IoT devices in corporate environments. As surveillance systems become increasingly integrated into business operations, vulnerabilities like this highlight the necessity for robust security measures, regular firmware updates, and network segmentation to prevent unauthorized access and potential data breaches.
6 months ago
Kill Chain
Mitsubishi Electric's 2026 PLC Vulnerability: A Wake-Up Call for Industrial Network Security
In February 2026, Mitsubishi Electric disclosed a critical vulnerability (CVE-2025-15080) in its MELSEC iQ-R Series programmable logic controllers (PLCs). This flaw allows unauthenticated attackers to read or modify device data and control programs, or to cause a denial-of-service condition by sending specially crafted packets. The affected models include R08PCPU, R16PCPU, R32PCPU, and R120PCPU with firmware versions up to 48. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-15080?utm_source=openai)) This incident underscores the persistent risks in industrial control systems, particularly those exposed to untrusted networks. Organizations must prioritize securing network access to critical infrastructure to prevent unauthorized exploitation of such vulnerabilities.
6 months ago
Kill Chain
Zendesk 2026 Spam Campaign: A Wake-Up Call for Securing Support Systems
In January 2026, a massive global spam campaign exploited unsecured Zendesk support systems, allowing attackers to flood users' inboxes with automated 'ticket received' emails. By abusing Zendesk instances that permitted unverified users to submit support tickets, attackers generated numerous fake tickets using large email lists. This resulted in victims receiving confirmation emails from legitimate Zendesk domains, enabling the messages to bypass spam filters and inundate users' inboxes. Affected organizations included major companies such as Discord, Tinder, Riot Games, Dropbox, CD Projekt, NordVPN, and various Tennessee state departments. Notably, the spam emails did not contain malware or phishing links but featured bizarre and seemingly pointless messages, such as fake law enforcement takedown requests and promotional offers. Zendesk acknowledged the issue and responded by implementing new safety measures, including enhanced monitoring and stricter activity limits to detect and halt spam efforts more effectively. The campaign began on January 18, 2026, but its current status remains unclear. ([techradar.com](https://www.techradar.com/pro/security/zendesk-tickets-hijacked-in-massive-spam-campaign?utm_source=openai)) This incident underscores the critical importance of securing customer support platforms against abuse. The exploitation of Zendesk's ticketing system highlights a broader trend where attackers leverage legitimate services to conduct spam campaigns, thereby evading traditional security measures. Organizations must proactively assess and fortify their support systems to prevent similar abuses, ensuring that such platforms do not become vectors for large-scale spam or other malicious activities.
6 months ago
Kill Chain
Betterment's 2026 Data Breach: A Social Engineering Wake-Up Call
In January 2026, Betterment, a prominent fintech firm, experienced a data breach resulting from a social engineering attack targeting third-party platforms used for marketing and operations. Unauthorized access was gained on January 9, allowing attackers to obtain personal information—including names, email addresses, postal addresses, phone numbers, and dates of birth—of approximately 1.4 million customers. The attackers exploited this access to send fraudulent cryptocurrency-related messages, falsely promising to triple users' crypto investments if they transferred funds to attacker-controlled wallets. Betterment detected the breach on the same day, revoked unauthorized access, and initiated a comprehensive investigation with cybersecurity experts. Importantly, no customer accounts, passwords, or login credentials were compromised during the incident. ([techcrunch.com](https://techcrunch.com/2026/01/12/fintech-firm-betterment-confirms-data-breach-after-hackers-send-fake-crypto-scam-notification-to-users/?utm_source=openai)) This incident underscores the escalating threat of social engineering attacks within the fintech sector, particularly those targeting third-party service integrations. The breach highlights the critical need for robust security measures, employee training, and vigilant monitoring of external platforms to prevent unauthorized access and protect sensitive customer information.
6 months ago
Kill Chain
Substack's 2025 Data Breach: A Wake-Up Call for Security Monitoring
In October 2025, Substack, a prominent newsletter platform, experienced a data breach where an unauthorized third party accessed user data, including email addresses, phone numbers, and internal metadata. The breach was not detected until February 3, 2026, leading to a four-month delay in notification. Importantly, sensitive information such as passwords, credit card numbers, and financial data remained secure. ([techcrunch.com](https://techcrunch.com/2026/02/05/substack-confirms-data-breach-affecting-email-addresses-and-phone-numbers/?utm_source=openai)) This incident underscores the critical need for robust security monitoring and rapid breach detection mechanisms. The prolonged detection period highlights potential vulnerabilities in Substack's security infrastructure, emphasizing the importance of timely incident response to protect user data and maintain trust.
6 months ago
Kill Chain
Conpet's 2026 Cyberattack: A Wake-Up Call for Critical Infrastructure Security
In early February 2026, Conpet, Romania's national oil pipeline operator, experienced a cyberattack that disrupted its corporate IT infrastructure and rendered its website inaccessible. The Qilin ransomware group claimed responsibility, alleging the theft of nearly 1TB of sensitive documents, including financial records and personal identification data. Despite these disruptions, Conpet's operational technologies, such as the SCADA and telecommunications systems, remained unaffected, ensuring uninterrupted crude oil and gasoline transportation services. This incident underscores the escalating threat posed by ransomware groups like Qilin, which have increasingly targeted critical infrastructure sectors worldwide. Organizations must bolster their cybersecurity defenses to mitigate the risks associated with such sophisticated attacks.
6 months ago
Kill Chain
La Sapienza University Ransomware Attack: A 2026 Case Study
In early February 2026, La Sapienza University in Rome, one of Europe's largest educational institutions, experienced a significant cyberattack attributed to the pro-Russian group Femwar02. The attackers deployed the BabLock (also known as Rorschach) ransomware, leading to the encryption of critical data and the disruption of numerous IT services. In response, the university proactively shut down its network systems to safeguard data integrity and initiated restoration efforts with the assistance of Italy's National Cybersecurity Agency. ([techcrunch.com](https://techcrunch.com/2026/02/05/one-of-europes-largest-universities-knocked-offline-for-days-after-cyberattack/?utm_source=openai)) This incident underscores the escalating threat of sophisticated ransomware attacks targeting educational institutions, highlighting the urgent need for enhanced cybersecurity measures and preparedness within the sector.
6 months ago
Kill Chain
Ransomware Gangs Exploit ISPsystem VMs for Stealthy Payload Delivery
In early 2026, cybersecurity researchers uncovered that multiple ransomware groups, including LockBit, Qilin, Conti, BlackCat/ALPHV, and Ursnif, were exploiting virtual machines (VMs) provisioned by ISPsystem's VMmanager to host and deliver malicious payloads. These attackers utilized default Windows VM templates with identical hostnames, allowing them to blend malicious infrastructure with legitimate systems, thereby complicating detection and takedown efforts. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ransomware-gang-uses-ispsystem-vms-for-stealthy-payload-delivery/?utm_source=openai)) This incident highlights a growing trend where cybercriminals leverage legitimate virtualization platforms to obfuscate their operations. The ease of deploying VMs with default configurations presents a significant security risk, emphasizing the need for organizations to scrutinize and secure their virtual infrastructure to prevent such abuses. ([sophos.com](https://www.sophos.com/en-us/blog/malicious-use-of-virtual-machine-infrastructure?utm_source=openai))
6 months ago
Kill Chain
Spain's Ministry of Science 2026 Data Breach: A Wake-Up Call for Government Cybersecurity
In early February 2026, Spain's Ministry of Science, Innovation, and Universities experienced a significant cybersecurity incident. A threat actor known as 'GordonFreeman' claimed to have exploited an Insecure Direct Object Reference (IDOR) vulnerability, combined with leaked credentials, to gain full administrative access to the ministry's systems. The attacker allegedly exfiltrated sensitive data, including personal records, email addresses, enrollment applications, and official documents. In response, the ministry partially shut down its IT systems, affecting various services for researchers, universities, and students, and suspended all ongoing administrative procedures to assess and mitigate the breach. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spains-ministry-of-science-shuts-down-systems-after-breach-claims/?utm_source=openai)) This incident underscores the critical importance of robust access controls and vulnerability management within governmental institutions. The exploitation of an IDOR vulnerability highlights the need for comprehensive security assessments and prompt remediation of identified weaknesses. Additionally, the breach serves as a reminder of the persistent threats posed by cyber actors targeting sensitive governmental data, emphasizing the necessity for continuous monitoring and incident response preparedness.
6 months ago
Kill Chain
React2Shell (CVE-2025-55182) Exploitation in 2025
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed, affecting React Server Components (RSC) versions 19.0 through 19.2.0. This flaw allowed unauthenticated remote code execution (RCE) via malicious HTTP POST requests, enabling attackers to execute arbitrary code on vulnerable servers. Within hours of disclosure, state-sponsored threat groups, including China's Earth Lamia and Jackpot Panda, as well as North Korean actors, began exploiting the vulnerability to deploy malware, establish persistent backdoors, and conduct cyber-espionage activities. The rapid exploitation underscored the severity of the vulnerability and the need for immediate remediation. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The widespread use of React in web applications, including major platforms like Facebook, Netflix, and Airbnb, amplifies the potential impact of this vulnerability. Organizations are urged to update to patched versions 19.0.1, 19.1.2, and 19.2.1 to mitigate the risk. ([techradar.com](https://www.techradar.com/pro/security/experts-warn-this-worst-case-scenario-react-vulnerability-could-soon-be-exploited-so-patch-now?utm_source=openai))
6 months ago
Kill Chain
Infy APT 2026: Iranian State-Sponsored Cyber Espionage Resurfaces
In early 2026, the Iranian state-sponsored Advanced Persistent Threat (APT) group known as Infy, or 'Prince of Persia,' resumed operations following a period of inactivity during Iran's internet blackout in January. The group deployed updated versions of their malware tools, Foudre and Tonnerre, to target entities across Iran, Iraq, Turkey, India, Canada, and Europe. Notably, Infy utilized a new command-and-control (C2) infrastructure, incorporating both HTTP and Telegram for communication, and exploited a 1-day vulnerability in WinRAR to deliver their payloads. This resurgence underscores Infy's continued commitment to cyber espionage activities aligned with Tehran's strategic interests. ([thehackernews.com](https://thehackernews.com/2026/02/infy-hackers-resume-operations-with-new.html?utm_source=openai)) The re-emergence of Infy highlights the persistent threat posed by state-sponsored cyber actors who continuously evolve their tactics to evade detection. Organizations, especially those in the targeted regions, must remain vigilant and enhance their cybersecurity measures to defend against such sophisticated threats.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
