✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3169 to 3180 of 5227
Open VSX Registry Compromised: GlassWorm Malware Infiltrates Developer Extensions
In late January 2026, a significant supply chain attack targeted the Open VSX Registry, an open-source marketplace for Visual Studio Code extensions. Threat actors compromised a legitimate developer's account, identified as 'oorzc', to publish malicious versions of four widely-used extensions. These tampered extensions, collectively downloaded over 22,000 times prior to detection, contained the GlassWorm malware loader. Upon installation, GlassWorm executed stealthily, harvesting sensitive data such as browser credentials, cryptocurrency wallet information, and developer authentication tokens. The malware exhibited advanced evasion techniques, including locale checks to avoid Russian systems and utilizing the Solana blockchain for command-and-control communications. The Open VSX security team promptly removed the malicious extensions and initiated measures to prevent future incidents. This incident underscores the escalating threat of supply chain attacks within developer ecosystems. The exploitation of trusted platforms to disseminate malware highlights the critical need for enhanced security protocols in software distribution channels. Organizations are urged to implement rigorous validation processes for third-party extensions and to monitor for unauthorized access to developer accounts to mitigate similar risks.
6 months ago
Kill Chain
eScan Antivirus Update Server Compromised in 2026 Supply Chain Attack
In January 2026, MicroWorld Technologies' eScan antivirus update infrastructure was compromised, allowing attackers to distribute a malicious update for approximately two hours on January 20. The malicious update replaced the legitimate 'Reload.exe' binary with a forged version that established persistence, disabled updates, bypassed AMSI, and deployed multi-stage PowerShell payloads. This incident affected enterprise and consumer endpoints globally, particularly in regions such as India, Bangladesh, Sri Lanka, and the Philippines. The breach rendered the antivirus software ineffective and tampered with system configurations to prevent automatic remediation. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/01/29/escan-antivirus-update-supply-chain-compromised/?utm_source=openai)) This incident underscores the critical importance of securing software supply chains, especially for security products that have elevated privileges on endpoints. The ability of attackers to exploit trusted update mechanisms highlights the need for organizations to implement robust monitoring and verification processes for software updates to prevent similar supply chain attacks.
6 months ago
Kill Chain
GlassWorm macOS Supply Chain Attack: A Wake-Up Call for Developer Security
In January 2026, the GlassWorm malware campaign targeted macOS developers by infiltrating the Open VSX marketplace with malicious Visual Studio Code extensions. These extensions, downloaded over 50,000 times before removal, masqueraded as legitimate tools like 'Prettier Pro' and other productivity enhancers. Once installed, the malware delayed execution to evade detection, then decrypted and executed an AES-256-CBC encrypted JavaScript payload. It established persistence via LaunchAgents, harvested sensitive data—including GitHub and npm credentials, SSH keys, and macOS Keychain entries—and attempted to replace hardware wallet applications such as Ledger Live and Trezor Suite with trojanized versions. Command-and-control communication was maintained through the Solana blockchain, complicating traditional detection and mitigation efforts. This incident underscores the evolving sophistication of supply chain attacks targeting developer ecosystems, emphasizing the need for rigorous extension vetting processes and heightened awareness of the security risks associated with third-party development tools.
6 months ago
Kill Chain
APT28's Exploitation of Microsoft Office CVE-2026-21509 in 2026
In late January 2026, the Russian state-sponsored group APT28 exploited CVE-2026-21509, a zero-day vulnerability in Microsoft Office, to target Ukrainian and European Union organizations. The attackers distributed malicious DOC files themed around EU COREPER consultations and impersonated the Ukrainian Hydrometeorological Center, aiming to compromise over 60 government-related addresses. Upon opening these documents, a WebDAV-based download chain was initiated, leading to the installation of malware via COM hijacking, a malicious DLL (EhStoreShell.dll), shellcode concealed in an image file (SplashScreen.png), and a scheduled task (OneDriveHealth). This sequence culminated in the deployment of the COVENANT framework for command-and-control operations. The rapid weaponization of CVE-2026-21509 underscores the agility of nation-state actors in leveraging newly disclosed vulnerabilities. Organizations are urged to apply Microsoft's emergency out-of-band security updates released on January 26, 2026, to mitigate this actively exploited threat. ([rescana.com](https://www.rescana.com/post/microsoft-office-cve-2026-21509-zero-day-emergency-patch-released-to-counter-active-exploitation?utm_source=openai))
6 months ago
Kill Chain
Notepad++ Supply Chain Attack: A 2025 Case Study
Between June and December 2025, the update mechanism of Notepad++, a widely used text editor, was compromised by state-sponsored attackers. These adversaries infiltrated the shared hosting server of notepad-plus-plus.org, allowing them to intercept and redirect update traffic to malicious servers. This redirection led to the distribution of trojanized installers to select users, primarily targeting telecommunications and financial services organizations in East Asia. The attackers maintained access to internal services until December 2, 2025, enabling continued redirection of update traffic even after losing direct server access. ([arstechnica.com](https://arstechnica.com/security/2026/02/notepad-updater-was-compromised-for-6-months-in-supply-chain-attack/?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where trusted software infrastructure is exploited to distribute malware. Organizations must enhance their security measures, particularly in verifying the integrity of software updates, to mitigate such risks. ([cybernews.com](https://cybernews.com/security/state-sponsored-hackers-behind-notepad-plus-plus-hack/?utm_source=openai))
6 months ago
Kill Chain
Microsoft Office Zero-Day Vulnerability CVE-2026-21509 Exploited
In January 2026, Microsoft disclosed a high-severity zero-day vulnerability in Microsoft Office, identified as CVE-2026-21509, with a CVSS score of 7.8. This security feature bypass flaw allows unauthorized attackers to circumvent OLE mitigations, potentially leading to the execution of malicious code. The vulnerability affects multiple versions of Microsoft Office, including Office 2016, 2019, LTSC 2021, LTSC 2024, and Microsoft 365 Apps for Enterprise. Microsoft released out-of-band security patches to address this issue, urging users to update their software promptly to mitigate potential risks. ([thehackernews.com](https://thehackernews.com/2026/02/weekly-recap-proxy-botnet-office-zero.html?utm_source=openai)) The exploitation of CVE-2026-21509 underscores the persistent threat posed by zero-day vulnerabilities in widely used software. Organizations are reminded of the critical importance of maintaining up-to-date systems and implementing robust security measures to defend against such exploits. This incident highlights the need for continuous vigilance and prompt response to emerging security threats.
6 months ago
Kill Chain
OpenClaw's ClawHub Compromised: A 2026 Supply Chain Attack
In early 2026, security researchers uncovered a significant supply chain attack within the ClawHub marketplace, a platform for OpenClaw AI assistant extensions. Over 340 malicious 'skills' were identified, many masquerading as cryptocurrency tools, which, upon installation, executed obfuscated commands leading to the deployment of the Atomic macOS Stealer (AMOS) malware. This malware targeted sensitive user data, including browser information and cryptocurrency wallets, affecting both Windows and macOS users. The incident underscores the vulnerabilities in open-source ecosystems and the critical need for rigorous vetting of third-party extensions. The proliferation of such attacks highlights the evolving tactics of cybercriminals, emphasizing the importance of user vigilance and the implementation of robust security measures to protect against sophisticated social engineering and malware distribution strategies.
6 months ago
Kill Chain
Critical OpenClaw Vulnerability Exposes Systems to Remote Code Execution
In early February 2026, a critical vulnerability (CVE-2026-25253) was identified in OpenClaw, an open-source AI personal assistant. This flaw allowed attackers to execute remote code on a victim's system by exploiting the application's handling of the 'gatewayUrl' parameter. By crafting a malicious link, attackers could trick users into initiating a WebSocket connection that transmitted authentication tokens without validation, leading to full system compromise. The issue was addressed in version 2026.1.29, released on January 30, 2026. ([thehackernews.com](https://thehackernews.com/2026/02/openclaw-bug-enables-one-click-remote.html?utm_source=openai)) This incident underscores the importance of rigorous input validation and user confirmation mechanisms in software development. The ease of exploitation and the potential for widespread impact highlight the need for organizations to promptly apply security patches and educate users about the risks associated with clicking untrusted links.
6 months ago
Kill Chain
Jaguar Land Rover's 2025 Ransomware Ordeal: A Wake-Up Call for the Automotive Industry
In early September 2025, Jaguar Land Rover (JLR) experienced a significant ransomware attack attributed to the cybercriminal group Scattered Lapsus$ Hunters. This attack led to a complete halt in vehicle production across JLR's global facilities, including those in the UK, Slovakia, China, India, and Brazil. Employees were instructed to stay home, and the company faced substantial operational disruptions. The attackers, a coalition of groups including Scattered Spider, LAPSUS$, and ShinyHunters, employed sophisticated social engineering tactics to infiltrate JLR's systems, resulting in the encryption of critical data and systems. The incident underscored the vulnerabilities in the automotive industry's cybersecurity defenses and highlighted the evolving threat landscape posed by organized cybercriminal alliances. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/jaguar-land-rover-shuts-down-production-due-to-ransomware-attack-scattered-lapsus-usd-hunters-takes-responsibility?utm_source=openai)) This attack is emblematic of a broader trend where cybercriminal groups are forming alliances to enhance their capabilities and impact. The collaboration between Scattered Spider, LAPSUS$, and ShinyHunters into the Scattered Lapsus$ Hunters collective signifies a shift towards more organized and aggressive cyber extortion strategies. Organizations across industries must recognize the increasing sophistication of these threats and bolster their cybersecurity measures accordingly. ([techradar.com](https://www.techradar.com/pro/security/three-of-the-biggest-cybercrime-gangs-around-appear-to-be-teaming-up-which-could-be-bad-news-for-all-of-us?utm_source=openai))
6 months ago
Kill Chain
ShinyHunters' Exploitation of Salesforce: A 2025 Data Breach Analysis
In mid-2025, the cybercriminal group ShinyHunters orchestrated a series of sophisticated attacks targeting Salesforce instances across multiple organizations. Utilizing voice phishing (vishing) techniques, attackers impersonated IT support staff to deceive employees into authorizing malicious connected applications within their Salesforce environments. This strategy granted the attackers unauthorized access to vast amounts of sensitive customer data, including personally identifiable information (PII) and corporate records. Notable victims included Google, Workday, and Qantas, with data breaches exposing millions of records. The stolen data was subsequently used for extortion, with threats to publicly release the information unless ransom demands were met. ([forbes.com](https://www.forbes.com/councils/forbestechcouncil/2025/12/03/shinyhunters-salesloft-drift-and-the-case-for-dynamic-saas-security/?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, highlighting the increasing reliance on social engineering methods to exploit human vulnerabilities within organizations. The collaboration between ShinyHunters and other threat actors, such as Scattered Spider, indicates a trend towards more coordinated and aggressive cyberattacks. Organizations are urged to enhance their security awareness programs, implement robust multi-factor authentication protocols, and scrutinize third-party integrations to mitigate the risk of similar breaches. ([cyberpress.org](https://cyberpress.org/shinyhunters-salesforce-hack/?utm_source=openai))
6 months ago
Kill Chain
Quest KACE Desktop Authority 2025: Addressing Insecure Named Pipe Permissions
In January 2026, a security vulnerability (CVE-2025-67813) was identified in Quest KACE Desktop Authority versions up to 11.3.1. The issue involved insecure permissions on named pipes used for inter-process communication, potentially allowing unauthorized local users to access these pipes, leading to unintended interactions or privilege escalation within the application context. Quest addressed this vulnerability by releasing version 11.3.2 on November 3, 2025, which rectified the insecure permissions. Organizations using affected versions are urged to upgrade to the latest release to mitigate this risk. ([support.quest.com](https://support.quest.com/kace-desktop-authority/kb/4381743/quest-kace-desktop-authority-insecure-named-pipe-permissions-cve-2025-67813?utm_source=openai)) This incident underscores the critical importance of securing inter-process communication channels and implementing proper access controls to prevent unauthorized access and potential privilege escalation.
6 months ago
Kill Chain
AI Coding Assistants Found Exfiltrating Code to China in 2026
In January 2026, security researchers uncovered that two AI coding assistant extensions, 'ChatGPT - 中文版' and 'ChatMoss (CodeMoss)', available on the Visual Studio Code Marketplace, were surreptitiously exfiltrating developers' source code to servers in China. These extensions, collectively installed by approximately 1.5 million users, functioned as advertised but secretly transmitted entire file contents and user data without consent. The campaign, dubbed 'MaliciousCorgi', exploited the trust developers place in marketplace extensions, leading to significant exposure of proprietary code and sensitive information. This incident underscores the escalating risks associated with supply chain attacks targeting developer tools. The widespread adoption of AI-powered extensions, combined with insufficient vetting processes in extension marketplaces, has created a fertile ground for malicious actors. Organizations must prioritize stringent security assessments of third-party tools to safeguard intellectual property and maintain operational integrity.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
