✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3253 to 3264 of 5244
North Korea’s Labyrinth Chollima Splits: New Specialized Threat Groups Emerge in 2024
In early 2024, researchers from CrowdStrike revealed that the long-active North Korean threat group known as Labyrinth Chollima has formally split into three specialized entities: Labyrinth Chollima (espionage), Golden Chollima, and Pressure Chollima (both focused on cryptocurrency theft). This change followed observed divergences in tactics, malware usage, and sector targeting, with Labyrinth Chollima shifting focus to manufacturing, logistics, aerospace, and defense, often leveraging social engineering and sharing infrastructure with its counterparts. Notably, Pressure Chollima was behind the record-breaking $1.46 billion cryptocurrency heist in 2023, illustrating the scale and sophistication of the new operational structure. This realignment signals increasing specialization and growth within North Korea's cyber apparatus, enabling more targeted attacks and efficient monetization strategies. Organizations in critical industries and the crypto sector face heightened risks as these groups adapt rapidly and circumvent international sanctions by fueling cyber operations with illicit gains.
6 months ago
Kill Chain
Kingdom Market Darknet Takedown: How Law Enforcement Disrupted a Global Cybercrime Hub (2021–2023)
Between March 2021 and December 2023, the Kingdom Market darknet platform operated as a large-scale cybercrime marketplace facilitating the sale of narcotics, cybercrime tools, stolen personal information, and fraudulent documents. Slovakian national Alan Bill, also known as "Vend0r" or "KingdomOfficial," admitted in January 2026 to administering the illicit platform, handling site infrastructure, and orchestrating anonymous cryptocurrency payments. The marketplace boasted over 42,000 illegal listings and tens of thousands of customer accounts. Its takedown culminated in coordinated law enforcement actions, domain seizures, and Bill's arrest in the U.S., where evidence linked him directly to site operations. This case highlights the persistent challenge of global, darknet-enabled cybercrime, the evolution of anonymous payment technologies, and the international scope of enforcement efforts. Cybercrime marketplaces remain a top concern for regulators and enterprises alike, with attackers rapidly adapting business models and operational security to evade detection.
6 months ago
Kill Chain
WhatsApp Rolls Out Lockdown Security for High-Risk Users After Spyware Attacks
In early 2026, WhatsApp introduced a new 'Strict Account Settings' feature to defend high-risk users such as journalists and public figures against highly targeted spyware attacks. This rollout followed a series of incidents in recent years where advanced zero-click exploits—many attributed to government-linked actors—were used to deploy spyware like NSO Group’s Pegasus and Paragon Graphite onto users’ devices via messaging platforms. Exploits leveraged zero-day vulnerabilities in WhatsApp’s iOS and macOS clients, enabling attackers to compromise devices without user interaction, raising severe risks to privacy and personal safety for individuals facing nation-state targeting. This event is particularly relevant as threat actors increasingly adopt sophisticated, zero-click methods to compromise high-value targets. Security and privacy expectations for messaging apps are under heightened scrutiny, with regulators and civil society urging greater protections and rapid incident response to curtail such threats.
6 months ago
Kill Chain
Enterprise AI at Risk: Hackers Hijack Exposed LLM Endpoints in Bizarre Bazaar Operation
In early June 2024, security researchers revealed an active campaign—dubbed the Bizarre Bazaar operation—where threat actors systematically scanned for and exploited publicly exposed Large Language Model (LLM) service endpoints. Attackers hijacked these AI/ML endpoints by bypassing inadequate API controls and leveraging unsecured cloud configurations, enabling unauthorized access to advanced AI resources. Compromised infrastructure became part of an underground market offering illicit AI compute power, leading to business risks ranging from intellectual property leakage to tool misuse and service disruption for impacted organizations. This incident spotlights the growing exploitation of AI infrastructure, with attackers rapidly adopting novel tactics as organizations rush to deploy LLMs. Weak segmentation, lack of egress controls, and poor visibility have left many organizations vulnerable to sophisticated abuse, elevating urgency for robust enterprise AI security and compliance measures.
6 months ago
Kill Chain
SolarWinds Web Help Desk Flaws: Critical RCE and Authentication Bypass in 2024
In June 2024, SolarWinds disclosed and patched multiple critical vulnerabilities in its Web Help Desk software, including an authentication bypass (CVE-2024-28995) and a remote command execution (RCE) flaw. These security issues, if left unpatched, allow attackers to compromise systems with minimal or no authentication, granting them access to execute arbitrary commands and potentially control affected servers. SolarWinds urged its customers to update immediately and disclosed that no in-the-wild exploitation had been confirmed at the time of announcement, but the severity of the flaws warranted immediate action across enterprise environments. This incident is particularly relevant due to a surge in software supply chain and IT management platform attacks, where adversaries exploit widely used admin tools to gain privileged access. Critical RCE and authentication vulnerabilities present potent risks to organizations, intensifying regulatory scrutiny and heightening the importance of timely patch management and proactive security measures.
6 months ago
Kill Chain
New Sandbox Escape Flaws in n8n Expose Instances to Remote Code Execution
In January 2026, security researchers uncovered two critical sandbox escape vulnerabilities in the popular n8n workflow automation platform, identified as CVE-2026-1470 and CVE-2026-0863. The flaws allowed authenticated users to exploit weaknesses in JavaScript and Python sandboxing mechanisms, enabling remote code execution on affected self-hosted instances. Attackers with valid user credentials could abuse these vulnerabilities to gain control of underlying systems, access sensitive data, and potentially compromise integrated services. Despite requiring authentication, the ease of privilege escalation and potential for lateral movement made these vulnerabilities highly impactful. This incident is highly significant given the large number of exposed n8n instances and the growing reliance on workflow automation by organizations worldwide. The vulnerabilities underline persistent challenges in securely sandboxing dynamic scripting languages, a common risk in platforms that allow code-based automation or AI integrations. The slow patching pace also highlights the pressing need for improved vulnerability management across self-hosted cloud infrastructure.
6 months ago
Kill Chain
Empire Market Dark Web Takedown: Owner Pleads Guilty in $430M Cybercrime Plot
In January 2026, U.S. authorities announced that Raheim Hamilton (“Sydney”/“ZeroAngel”), a co-founder of the notorious Empire Market, pleaded guilty to federal drug conspiracy charges. From 2018 to 2020, Empire Market operated as a large-scale dark web marketplace accessible via TOR, facilitating over $430 million in illegal transactions, primarily enabling drug sales but also distributing stolen credentials, hacking tools, and counterfeit currency. Hamilton and partner Thomas Pavey laundered illicit proceeds through cryptocurrency and designed the site to evade law enforcement, directly overseeing vendor disputes and operational security. This prosecution underscores the ongoing threat and operational sophistication of dark web cybercrime marketplaces, even after earlier takedowns. As digital criminal platforms persistently adapt, law enforcement and organizations must address the evolving risks involving anonymized markets, cryptocurrency transactions, and the proliferation of illicit digital goods and services.
6 months ago
Kill Chain
FBI Takedown of RAMP: Ransomware's Last Open Forum Seized in 2026
In January 2026, the FBI seized control of the notorious Russian-speaking RAMP cybercrime forum, widely used by ransomware gangs to promote operations, recruit affiliates, and trade access to compromised networks. Both its Tor and clearnet domains were confiscated, and a seizure notice was displayed in coordination with U.S. law enforcement agencies. As one of the last prominent ransomware-friendly forums, RAMP had become a hub for multiple groups, facilitated by threat actor Mikhail Matveev (aka Orange/Wazawaka). The FBI now possesses potentially incriminating data on user identities, logins, and private communications, increasing the risk of arrests for those with poor operational security. This takedown reflects a broader law enforcement crackdown on cybercrime infrastructure supporting ransomware attacks. The RAMP seizure is significant amid heightened regulatory and industry focus on disrupting the ransomware ecosystem and demonstrates the ongoing risk of exposure for those operating in or near dark web forums.
6 months ago
Kill Chain
Electrum-Linked Wiper Attack Disables Key Systems in Polish Energy Grid
In late December 2025, a coordinated cyberattack targeted Poland’s distributed energy resource (DER) sites, including combined heat and power, wind, and solar dispatch facilities. The attackers, identified as the Russian-linked Electrum (overlapping with APT44/Sandworm), exploited misconfigurations and exposed operational technology, corrupting or destroying key OT and Windows systems at nearly 30 sites. While no electrical outages were reported and power generation largely continued, remote monitoring and control capabilities were disabled and some equipment rendered inoperable, exposing critical vulnerabilities in Poland’s decentralized energy grid. This incident highlights a significant evolution in threat actor tactics toward industrial systems, specifically targeting the backbone of modern hybrid energy infrastructure. Increased focus on OT security, zero-trust segmentation, and resilient operational controls is crucial as sophisticated groups continue probing for weaknesses in vital infrastructure globally.
6 months ago
Kill Chain
MicroWorld eScan Update Server Breach Exposes Supply Chain Risks
In June 2024, MicroWorld Technologies, developers of eScan antivirus, experienced a breach where attackers compromised one of its update servers. The intruders leveraged this access to push a malicious software update to a limited subset of customers, effectively deploying unauthorized code via the trusted antivirus delivery mechanism. MicroWorld quickly detected the incident, notified impacted users, and began forensic analysis with assistance from cybersecurity experts. The compromised update posed potential risks including malware infection and lateral network movement. This incident is part of a growing trend of supply chain attacks, where adversaries exploit trusted update channels to infiltrate enterprise environments. As organizations increasingly rely on third-party software, vigilance and layered security controls around update infrastructures have become a pressing necessity.
6 months ago
Kill Chain
Fake PyPI Spellchecker Packages Delivered RAT in Supply Chain Attack (2026)
In early 2026, security researchers uncovered a supply chain attack involving two malicious packages—spellcheckerpy and spellcheckpy—distributed on the popular Python Package Index (PyPI). Masquerading as legitimate spellchecking tools, these packages were downloaded over 1,000 times before removal, each covertly containing a remote access trojan (RAT). When unsuspecting developers installed the packages, attackers could gain persistent access to compromised systems, enabling data exfiltration, lateral movement, and remote command execution. No specific organizational victims were named, but the risk extended globally to Python developers and projects that leveraged these components. This incident is emblematic of the growing trend of supply chain attacks targeting open source repositories, exploiting trust in widely used ecosystems like PyPI. As software supply chains become common attack vectors, organizations face heightened pressure to vet dependencies and implement controls to prevent compromise via upstream components.
6 months ago
Kill Chain
Exposed Interfaces & Supply Chain Risks: The 2026 Moltbot AI Assistant Breach
In January 2026, researchers uncovered widespread security vulnerabilities in Moltbot (formerly Clawdbot), an open-source AI assistant that achieved viral adoption among both consumers and employees in the enterprise sector. Due to prevalent misconfigurations—specifically, exposed admin interfaces and reverse proxy errors—hundreds of Moltbot instances were accessible online, allowing unauthenticated attackers to steal API keys, OAuth tokens, credentials, message histories, and even execute commands remotely with system-level permissions. Additional risks arose as malicious skills (modules) could be planted in the official registry, rapidly propagating supply-chain threats to unsuspecting enterprise and developer systems, further compounded by the assistant lacking sandboxing or privilege separation by default. This incident highlights a growing trend where AI/GenAI tools, easily adopted outside corporate IT control, create new vectors for credential theft, data leakage, and lateral movement. As attackers focus on AI-driven endpoints and shadow IT, failure to enforce zero trust, segmentation, and robust monitoring introduces significant business risk and regulatory exposure.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
