✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3205 to 3216 of 5227
Google's 2026 Disruption of IPIDEA Proxy Network
In January 2026, Google’s Threat Intelligence Group (GTIG) disrupted IPIDEA, a China-based residential proxy network that covertly enrolled millions of consumer devices into its infrastructure. By embedding malicious software development kits (SDKs) into various applications, IPIDEA transformed devices into proxy nodes without user consent, facilitating cybercriminal activities such as password spraying and unauthorized access to cloud environments. Google’s intervention, which included legal actions to seize control domains and collaboration with partners like Cloudflare and Lumen’s Black Lotus Labs, resulted in a significant reduction of IPIDEA’s operational capacity, removing millions of devices from the network. ([blog.google](https://blog.google/innovation-and-ai/infrastructure-and-cloud/google-cloud/gtig-ipidea-disrupted/?utm_source=openai)) This incident underscores the escalating misuse of residential proxy networks by cybercriminals and state-sponsored actors. The proliferation of such networks highlights the urgent need for enhanced vigilance among developers and consumers regarding the integration and use of third-party SDKs, as well as the importance of industry-wide collaboration to dismantle malicious infrastructures.
6 months ago
Kill Chain
Microsoft Announces Deprecation of NTLM Authentication Protocol
In June 2024, Microsoft announced the deprecation of the NTLM authentication protocol, ceasing its active development and urging organizations to transition to more secure alternatives like Kerberos. This decision was driven by NTLM's inherent security vulnerabilities, including susceptibility to relay attacks and lack of support for modern cryptographic methods. The deprecation process began in early 2025, with phased reductions in support throughout the year, aiming for complete removal by the end of 2027. Organizations relying on NTLM are advised to assess their authentication mechanisms and plan migrations to more secure protocols to mitigate potential security risks. ([threatdown.com](https://www.threatdown.com/blog/microsoft-calls-time-on-ntlm-so-should-you/?utm_source=openai)) The deprecation of NTLM underscores a broader industry shift towards enhancing authentication security. As cyber threats evolve, legacy protocols like NTLM become prime targets due to their known weaknesses. This move aligns with Microsoft's Secure Future Initiative, emphasizing the importance of adopting robust authentication methods to safeguard against emerging threats. ([microsoft.com](https://www.microsoft.com/en-us/msrc/blog/2024/12/mitigating-ntlm-relay-attacks-by-default?utm_source=openai))
6 months ago
Kill Chain
Bybit's 2025 Security Breach: A Deep Dive into the $1.4 Billion Ethereum Theft
In February 2025, Dubai-based cryptocurrency exchange Bybit suffered a significant security breach, resulting in the theft of approximately 401,000 Ethereum (ETH), valued at over $1.4 billion. The attackers exploited vulnerabilities in Bybit's multi-signature cold wallet system, facilitated by compromised infrastructure at Safe{Wallet}, a third-party provider. This incident stands as the largest cryptocurrency exchange hack to date. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Bybit?utm_source=openai)) The breach was attributed to the North Korean state-sponsored Lazarus Group, known for their sophisticated cyber operations targeting financial institutions. The stolen funds were laundered through various channels, including privacy-focused platforms, complicating recovery efforts. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Lazarus_Group?utm_source=openai))
6 months ago
Kill Chain
Critical Ivanti EPMM Zero-Day Vulnerabilities Exploited in 2026
In January 2026, Ivanti disclosed two critical zero-day vulnerabilities (CVE-2026-1281 and CVE-2026-1340) in its Endpoint Manager Mobile (EPMM) platform, both with a CVSS score of 9.8. These code injection flaws allow unauthenticated remote code execution, enabling attackers to gain full control over affected systems. Exploitation in the wild has been confirmed, with a limited number of customers compromised prior to disclosure. The vulnerabilities affect EPMM versions up to 12.7.0.0, and Ivanti has released RPM patches to address them. Organizations are urged to apply these patches immediately and monitor for signs of compromise. ([ivanti.com](https://www.ivanti.com/blog/january-2026-epmm-security-update?utm_source=openai)) The inclusion of CVE-2026-1281 in CISA's Known Exploited Vulnerabilities catalog underscores the severity and active exploitation of these flaws. This incident highlights the ongoing threat posed by zero-day vulnerabilities in widely used enterprise solutions, emphasizing the need for proactive vulnerability management and rapid response strategies.
6 months ago
Kill Chain
Critical Unauthenticated RCE Vulnerability in SmarterMail (CVE-2026-24423) Discovered
In January 2026, a critical unauthenticated remote code execution (RCE) vulnerability, identified as CVE-2026-24423, was discovered in SmarterTools SmarterMail versions prior to build 9511. This flaw resided in the ConnectToHub API method, allowing attackers to direct the SmarterMail server to a malicious HTTP server that delivers harmful OS commands, which the vulnerable application would then execute. The vulnerability was independently identified by multiple researchers, including those from VulnCheck and CODE WHITE GmbH. SmarterTools addressed this issue by releasing build 9511 on January 15, 2026, which patches the vulnerability. Organizations using affected versions are strongly advised to update to the latest build to mitigate potential exploitation risks. ([vulncheck.com](https://www.vulncheck.com/blog/smartermail-connecttohub-rce-cve-2026-24423?utm_source=openai)) The discovery of CVE-2026-24423 underscores the persistent threat posed by unauthenticated RCE vulnerabilities in widely used software. Such vulnerabilities can lead to complete system compromise, data exfiltration, and service disruption. The incident highlights the critical importance of timely software updates and vigilant monitoring of security advisories to protect organizational infrastructure from emerging threats.
6 months ago
Kill Chain
Google Engineer Convicted of AI Trade Secrets Theft for China Startup
In January 2026, former Google engineer Linwei Ding was convicted on seven counts of economic espionage and seven counts of theft of trade secrets. Between May 2022 and April 2023, Ding illicitly transferred over 2,000 confidential documents related to Google's AI technology to his personal Google Cloud account. These documents detailed proprietary information about Google's supercomputing data center infrastructure, including custom Tensor Processing Unit chips, Graphics Processing Unit systems, and the Cluster Management System software. During this period, Ding secretly affiliated with two China-based technology companies, including founding Shanghai Zhisuan Technologies Co., while still employed at Google. He employed deceptive tactics to conceal his activities, such as copying data into the Apple Notes application and converting them to PDFs before uploading them to his personal account. The scheme was uncovered when Google discovered Ding's public presentation in China to potential investors about his startup. This case underscores the persistent threat of insider threats and economic espionage, particularly in the competitive field of artificial intelligence. Organizations must remain vigilant in protecting their intellectual property and sensitive information from both internal and external threats. The incident highlights the importance of robust security measures and monitoring systems to detect and prevent unauthorized access and data exfiltration.
6 months ago
Kill Chain
UAT-8099's Exploitation of IIS Servers in Asia Using BadIIS Malware
Between late 2025 and early 2026, the China-linked threat actor UAT-8099 launched a campaign targeting vulnerable Internet Information Services (IIS) servers across Asia, with a particular focus on Thailand and Vietnam. The attackers exploited security vulnerabilities to gain initial access, deploying web shells and leveraging tools like GotoHTTP for remote control. They installed customized variants of the BadIIS malware to manipulate search engine optimization (SEO) rankings, redirecting users to malicious sites and exfiltrating sensitive data. This operation underscores the evolving tactics of cybercriminals in exploiting web server vulnerabilities for financial gain and data theft. Organizations are urged to strengthen their server defenses and monitor for signs of such sophisticated intrusions. ([thehackernews.com](https://thehackernews.com/2026/01/china-linked-uat-8099-targets-iis.html?utm_source=openai))
6 months ago
Kill Chain
Malicious Chrome Extensions Compromise User Security by Hijacking Affiliate Links and Stealing ChatGPT Tokens
In January 2026, cybersecurity researchers uncovered a series of malicious Google Chrome extensions designed to hijack affiliate links and steal OpenAI ChatGPT authentication tokens. Notably, the 'Amazon Ads Blocker' extension, uploaded by '10Xprofit' on January 19, 2026, claimed to block Amazon ads but covertly injected the developer's affiliate tag into product links, replacing existing ones. This extension was part of a larger cluster targeting e-commerce platforms like AliExpress, Amazon, Best Buy, Shein, Shopify, and Walmart. Additionally, 16 other extensions masquerading as ChatGPT productivity tools were found to exfiltrate ChatGPT session tokens, granting attackers full access to users' conversation histories and associated data. This incident underscores the growing trend of malicious browser extensions exploiting the popularity of AI tools and e-commerce platforms. The deceptive nature of these extensions, often appearing legitimate and even bearing 'Featured' badges, highlights the need for heightened vigilance among users and stricter vetting processes by browser extension stores to prevent such security breaches.
6 months ago
Kill Chain
OpenClaw AI's Security Challenges in 2026: A Wake-Up Call for AI Deployment
In January 2026, the open-source AI assistant OpenClaw (formerly known as Clawdbot and Moltbot) faced significant security vulnerabilities due to its deep system access and widespread misconfigurations. Users inadvertently exposed control panels and API keys, leading to unauthorized access and potential data breaches. Additionally, the platform's susceptibility to prompt injection attacks allowed malicious actors to manipulate the AI into executing unintended commands, posing severe risks to user data and system integrity. ([axios.com](https://www.axios.com/2026/01/29/moltbot-cybersecurity-ai-agent-risks?utm_source=openai)) The incident underscores the critical need for robust security measures in AI deployments, especially as autonomous agents gain popularity. Organizations must prioritize secure configurations, implement strict access controls, and conduct regular security audits to mitigate risks associated with AI assistants like OpenClaw.
6 months ago
Kill Chain
Critical Unauthenticated RCE Vulnerability in n8n (CVE-2026-21858)
In early January 2026, a critical vulnerability, CVE-2026-21858, was discovered in n8n, an open-source workflow automation platform. This flaw, dubbed 'Ni8mare,' allows unauthenticated remote code execution due to improper input validation in form-based workflows. Exploiting this vulnerability enables attackers to gain full control over affected servers, leading to potential data theft, workflow manipulation, and system compromise. ([purple-ops.io](https://www.purple-ops.io/resources-hottest-cves/cve-2026-21858-ai-exploit/?utm_source=openai)) The widespread use of n8n, with over 100 million Docker pulls and numerous internet-exposed instances, amplifies the risk. As of January 11, 2026, approximately 59,500 vulnerable hosts remain exposed, highlighting the urgency for organizations to apply the available patches promptly. ([techradar.com](https://www.techradar.com/pro/security/thousands-of-n8n-instances-under-threat-from-top-security-issue?utm_source=openai))
6 months ago
Kill Chain
Chinese APTs Target ASEAN Entities with Advanced Malware
In early 2024, Chinese state-sponsored Advanced Persistent Threat (APT) groups, notably Stately Taurus (also known as Mustang Panda), launched sophisticated cyber-espionage campaigns targeting entities across ASEAN countries, including Myanmar, the Philippines, Japan, and Singapore. These operations coincided with the ASEAN-Australia Special Summit in March 2024, suggesting a strategic intent to gather intelligence during significant diplomatic events. The attackers employed advanced malware packages, such as PUBLOAD downloader, delivered through phishing emails containing malicious ZIP archives and screensaver executables. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/chinese-apts-target-asean-entities/?utm_source=openai)) This incident underscores the escalating cyber threats posed by state-sponsored actors in the Asia-Pacific region. The use of sophisticated malware and targeted phishing campaigns highlights the need for heightened cybersecurity measures, especially during high-profile events that may attract espionage activities.
6 months ago
Kill Chain
Salt Typhoon's 2024 Breach of U.S. Telecom Networks: A Wake-Up Call for Cybersecurity
In 2024, the Chinese state-sponsored hacking group known as Salt Typhoon orchestrated a sophisticated cyber espionage campaign targeting major U.S. telecommunications companies, including AT&T, Verizon, and T-Mobile. By exploiting vulnerabilities in network devices and systems, the group gained unauthorized access to sensitive data such as call logs, text messages, and, in some instances, audio recordings. Notably, they infiltrated systems used for lawful wiretapping, posing significant national security concerns. The attackers employed advanced techniques, including 'living off the land' tactics, utilizing legitimate administrative tools to evade detection and maintain persistent access. This incident underscores the escalating threat posed by state-sponsored cyber actors to critical infrastructure. The breach highlights the necessity for robust cybersecurity measures and continuous monitoring to detect and mitigate such sophisticated intrusions. Organizations must prioritize the security of their network devices and systems to prevent similar attacks in the future.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
