✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3181 to 3192 of 5227
MongoDB's 2025 MongoBleed Vulnerability: A Wake-Up Call for Database Security
In December 2025, a critical vulnerability known as MongoBleed (CVE-2025-14847) was discovered in MongoDB servers, allowing unauthenticated attackers to extract sensitive data from server memory. This flaw, stemming from improper handling of compressed network packets, exposed credentials, API keys, and personal information. Despite the release of patches, over 87,000 MongoDB instances remained vulnerable, leading to active exploitation and data breaches. ([cyberinsider.com](https://cyberinsider.com/over-87000-mongodb-instances-remain-exposed-to-mongobleed-attacks/?utm_source=openai)) The rapid exploitation of MongoBleed underscores the persistent risks associated with unpatched software and misconfigured databases. Organizations must prioritize timely updates and robust security configurations to mitigate such vulnerabilities.
6 months ago
Kill Chain
ShinyHunters Exploit SSO Vulnerabilities in 2026 Vishing Attacks
In January 2026, the cybercriminal group ShinyHunters orchestrated a series of sophisticated voice phishing (vishing) attacks targeting single sign-on (SSO) credentials across multiple organizations. By impersonating IT support personnel, they deceived employees into providing their SSO credentials and multi-factor authentication (MFA) codes on counterfeit login portals. This enabled unauthorized access to various connected SaaS applications, including Salesforce, Microsoft 365, and Slack, leading to significant data breaches. Notable companies such as Panera Bread, Crunchbase, and Betterment confirmed unauthorized access and data exfiltration resulting from these attacks. ([zerofox.com](https://www.zerofox.com/intelligence/flash-report-shinyhunters-sso-phishing-campaign/?utm_source=openai)) This incident underscores the evolving threat landscape where attackers combine social engineering with advanced phishing techniques to bypass MFA protections. The widespread adoption of SSO systems amplifies the potential impact of such breaches, as compromising a single account can grant access to multiple platforms. Organizations must enhance their security awareness training and implement robust monitoring to detect and mitigate such sophisticated attacks.
6 months ago
Kill Chain
Instagram's 2026 Private Profile Photo Leak: A Privacy Wake-Up Call
In October 2025, security researcher Jatin Banga discovered a vulnerability in Instagram's private account feature, where private profile photos and captions were embedded in publicly accessible server responses. This flaw allowed unauthenticated users to access content intended for approved followers. Banga reported the issue to Meta on October 12, 2025, and although Meta initially classified it as a CDN caching problem, the exploit ceased functioning around October 16, 2025. However, Meta later closed the case as 'not applicable,' stating the vulnerability could not be reproduced. This incident underscores the critical importance of rigorous authorization checks in web applications to prevent unauthorized data exposure. Organizations must ensure that private content remains inaccessible to unauthorized users, as such vulnerabilities can lead to significant privacy breaches and erode user trust.
6 months ago
Kill Chain
Cloud Storage Payment Scam 2026: A Global Phishing Threat
In late 2025 and early 2026, a widespread phishing campaign targeted users globally with fraudulent emails claiming their cloud storage subscriptions were at risk due to payment failures. These emails, often personalized with the recipient's name, warned of imminent data loss and urged immediate action. Victims who clicked on the provided links were redirected to phishing sites mimicking legitimate cloud service portals, where they were prompted to enter sensitive information or make payments. The attackers exploited users' fears of losing valuable data to steal personal and financial information. This incident underscores the increasing sophistication of phishing attacks, particularly those leveraging social engineering tactics to impersonate trusted services. The prevalence of such scams highlights the critical need for heightened vigilance and robust cybersecurity measures to protect against evolving threats.
6 months ago
Kill Chain
Poland's Energy Sector Cyberattack: A Wake-Up Call for Critical Infrastructure Security
On December 29, 2025, coordinated cyberattacks targeted over 30 wind and photovoltaic farms, a manufacturing company, and a large combined heat and power plant in Poland. The attacks, attributed to the Russian state-sponsored group Static Tundra (also known as Berserk Bear or Dragonfly), aimed to disrupt energy infrastructure by deploying wiper malware designed to destroy data and disable systems. While the attacks caused communication disruptions, they did not interrupt energy production or heat supply to consumers. ([cert.pl](https://cert.pl/en/posts/2026/01/incident-report-energy-sector-2025/?utm_source=openai)) This incident underscores the escalating threat of nation-state cyberattacks on critical infrastructure, highlighting the need for enhanced cybersecurity measures and international cooperation to protect essential services from sophisticated adversaries.
6 months ago
Kill Chain
Google Engineer Convicted of AI Trade Secrets Theft to China
In January 2026, former Google software engineer Linwei Ding was convicted on multiple counts of economic espionage and theft of trade secrets. Between May 2022 and April 2023, Ding illicitly transferred over 2,000 pages of confidential AI-related documents from Google's network to his personal cloud account. These documents detailed Google's proprietary AI supercomputing infrastructure, including custom Tensor Processing Unit (TPU) and Graphics Processing Unit (GPU) technologies, orchestration software for large-scale AI workloads, and SmartNIC networking technology. Concurrently, Ding secretly affiliated with two China-based technology companies, assuming roles such as Chief Technology Officer and CEO, and aimed to replicate Google's AI supercomputing capabilities in China. ([justice.gov](https://www.justice.gov/opa/pr/former-google-engineer-found-guilty-economic-espionage-and-theft-confidential-ai-technology?utm_source=openai)) This incident underscores the persistent threat of insider espionage within the tech industry, particularly concerning advanced AI technologies. It highlights the critical need for robust internal security measures and vigilant monitoring to protect intellectual property from unauthorized access and exfiltration.
6 months ago
Kill Chain
RedKitten 2026: Iranian State-Sponsored Malware Targets Human Rights NGOs
In January 2026, a cyber espionage campaign named RedKitten targeted non-governmental organizations and individuals documenting human rights abuses in Iran. The attackers employed AI-generated malware, delivered through malicious Excel files disguised as casualty records from recent protests. Upon enabling macros, the malware, dubbed SloppyMIO, was deployed, utilizing GitHub and Google Drive for configuration and Telegram for command-and-control. This operation is attributed to Iranian state-sponsored actors aiming to infiltrate and disrupt human rights documentation efforts. ([harfanglab.io](https://harfanglab.io/insidethelab/redkitten-ai-accelerated-campaign-targeting-iranian-protests/?utm_source=openai)) This incident underscores the escalating use of artificial intelligence in cyber attacks, enabling rapid development and deployment of sophisticated malware. The targeting of human rights organizations highlights the increasing risks faced by civil society groups, emphasizing the need for enhanced cybersecurity measures and vigilance against state-sponsored cyber threats.
6 months ago
Kill Chain
ShinyHunters 2026 Vishing Attacks Breach SaaS Platforms
In January 2026, the financially motivated hacking group ShinyHunters orchestrated a series of sophisticated voice phishing (vishing) attacks targeting employees of various organizations. By impersonating IT staff, they directed victims to fraudulent credential harvesting sites, capturing Single Sign-On (SSO) credentials and Multi-Factor Authentication (MFA) codes. This access enabled them to infiltrate cloud-based Software-as-a-Service (SaaS) platforms, exfiltrating sensitive data and internal communications, which were subsequently used for extortion purposes. The campaign notably affected platforms such as Okta, Microsoft 365, and Google Workspace, compromising numerous organizations across multiple sectors. This incident underscores the evolving tactics of cybercriminals, highlighting the increasing sophistication of social engineering methods to bypass traditional security measures. The reliance on vishing and real-time phishing kits to exploit identity providers and SaaS platforms emphasizes the urgent need for organizations to adopt phishing-resistant MFA solutions and enhance employee training to recognize and respond to such threats.
6 months ago
Kill Chain
Aisle's AI Uncovers Decades-Old OpenSSL Vulnerabilities
In January 2026, Aisle's AI-assisted cybersecurity team uncovered 12 previously undetected vulnerabilities in the OpenSSL codebase, some dating back to 1998. These vulnerabilities, ranging from stack buffer overflows to encryption flaws, were promptly patched. The discovery underscores the limitations of human-only vulnerability detection and highlights the efficacy of AI-powered security tools in identifying longstanding security issues. This incident emphasizes the growing role of AI in cybersecurity, showcasing its potential to enhance threat detection and response capabilities. As AI-driven cyber threats become more sophisticated, integrating AI into security operations is increasingly vital for organizations aiming to protect their digital assets.
6 months ago
Kill Chain
Fortinet's 2026 Authentication Bypass Vulnerability: A Critical Security Alert
In January 2026, Fortinet disclosed a critical authentication bypass vulnerability (CVE-2026-24858) affecting multiple products, including FortiOS, FortiManager, FortiAnalyzer, FortiProxy, and FortiWeb. This flaw allowed attackers with a FortiCloud account and a registered device to gain unauthorized access to other devices registered to different accounts, provided FortiCloud SSO authentication was enabled. Exploitation of this vulnerability led to unauthorized firewall configuration changes, creation of rogue administrator accounts, and potential data exfiltration. Fortinet responded by disabling FortiCloud SSO on January 26, 2026, and subsequently released patches to address the issue. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, urging immediate remediation. This incident underscores the critical importance of timely patch management and vigilant monitoring of authentication mechanisms to prevent unauthorized access and potential data breaches.
6 months ago
Kill Chain
Energy Sector Faces Sophisticated AiTM Phishing and BEC Attack in 2026
In January 2026, a sophisticated adversary-in-the-middle (AiTM) phishing and business email compromise (BEC) campaign targeted multiple organizations within the energy sector. Attackers exploited SharePoint's file-sharing services to distribute phishing payloads, leading to the compromise of numerous user accounts. The campaign involved creating malicious inbox rules to maintain persistence and evade detection, subsequently launching large-scale phishing attacks both internally and externally. This operation underscores the evolving complexity of AiTM campaigns and highlights the necessity for organizations to implement comprehensive remediation strategies beyond standard identity compromise responses. The incident serves as a critical reminder of the importance of robust security measures, including the revocation of active session cookies and the removal of unauthorized inbox rules, to effectively mitigate such threats.
6 months ago
Kill Chain
Critical Vulnerability in iba Systems ibaPDA Exposes Industrial Systems to Unauthorized Access
In January 2026, a critical vulnerability (CVE-2025-14988) was identified in iba Systems' ibaPDA software, version 8.12.0. This flaw allowed unauthorized actions on the file system, potentially compromising the confidentiality, integrity, and availability of affected systems. The vulnerability was reported by Siemens and disclosed by CISA on January 27, 2026. ([iba-ag.com](https://www.iba-ag.com/en/security/iba-2025-04?utm_source=openai)) Given ibaPDA's widespread use in critical manufacturing sectors worldwide, this vulnerability posed significant risks to industrial operations. Organizations were urged to update to version 8.12.1 or later to mitigate potential exploitation. ([iba-ag.com](https://www.iba-ag.com/en/security/iba-2025-04?utm_source=openai))
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
