✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3565 to 3576 of 5258
Critical n8n Vulnerability Enables Authenticated Command Execution (CVE-2025-68668)
In January 2026, a critical vulnerability (CVE-2025-68668) was disclosed in n8n, an open-source workflow automation platform, allowing authenticated users with workflow modification privileges to execute arbitrary system commands on the host server. The flaw, caused by a sandbox bypass in the Python Code Node (Pyodide), impacted all n8n versions from 1.0.0 up to 2.0.0. Prompted by Cyera Research Labs’ findings, the n8n team released version 2.0.0 as a fix and advised urgent security configuration changes or feature disablement as interim measures. The vulnerability poses high risks for supply-chain and SaaS environments using n8n in production, potentially enabling lateral movement or privilege escalation. This incident underscores the continued threat from vulnerabilities in low-code/no-code and automation platforms, especially as attackers increasingly leverage authenticated access and workflow manipulation to escalate privileges. Organizations should review security settings of workflow platforms due to a growing pattern of exploitation in automation pipelines.
7 months ago
Kill Chain
VS Code Forks Highlight Open VSX Supply Chain Vulnerability (2026)
In early 2026, a supply chain vulnerability involving popular AI-powered Visual Studio Code (VS Code) forks—such as Cursor, Windsurf, Google Antigravity, and Trae—was discovered. These IDEs recommended certain extensions that did not exist in the Open VSX registry, leaving the extension namespaces unclaimed and thus open to exploitation by malicious actors. Attackers could upload rogue extensions under these names, which unsuspecting developers would install due to these recommendations. Koi researchers demonstrated the risk by publishing a placeholder PostgreSQL extension on Open VSX, garnering over 500 installs, highlighting the real-world likelihood of sensitive data exposure and credential theft before the issue was mitigated by the IDE vendors and Open VSX registry maintainers. This incident underscores the persistent risk of supply chain attacks in open-source developer tooling, as adversaries increasingly exploit gaps in public code marketplaces. With threat actors targeting trusted workflows and dependency chains, organizations must elevate their scrutiny and controls around open-source software consumption.
7 months ago
Kill Chain
Kimwolf Botnet’s 2024 Assault: How Residential Proxies Fueled Widespread Android Device Infections
In 2024, the Kimwolf Android botnet rapidly expanded to over two million infected hosts by exploiting vulnerabilities in residential proxy networks to penetrate internal devices. This botnet, an evolution of Aisuru malware, leverages residential IP addresses to mask malicious activity and facilitate lateral movement inside targeted networks. By abusing these proxies, Kimwolf can bypass perimeter defenses, execute command-and-control operations, and enable wide-scale internal compromise of Android and IoT devices, causing extensive disruption and exposing organizations to data theft, downtime, and potential extortion. Kimwolf highlights a growing threat: attackers are increasingly leveraging residential proxies and internal lateral movement tactics to amplify reach and evade detection. Its success underscores the need for improved egress filtering, network segmentation, and east-west traffic monitoring as threat actors adopt more sophisticated methods to breach internal assets.
7 months ago
Kill Chain
Critical AdonisJS Bodyparser Flaw Exposes Servers to Arbitrary File Write (CVE-2026-21440)
In January 2026, a critical vulnerability (CVE-2026-21440, CVSS 9.2) was disclosed in the widely-used @adonisjs/bodyparser npm package, a foundational component for handling multipart form data in AdonisJS applications. The flaw, attributed to improper validation of user-supplied input, allowed remote attackers to exploit a path traversal bug, thereby enabling arbitrary file writes to affected servers. Successful exploitation could ultimately lead to full system compromise, data breach or destructive attacks, due to the broad permissions often held by server-side runtimes. The risk was amplified by the widespread use of AdonisJS across SaaS, fintech, and e-commerce platforms. This incident underscores broader supply-chain security concerns impacting open-source software ecosystems. Attackers are aggressively targeting commonly used packages to gain upstream access, making robust dependency management, real-time vulnerability monitoring, and rapid patch adoption vital defensive practices for modern development teams.
7 months ago
Kill Chain
Tenfold Spike: Chinese State Cyberattacks on Taiwan’s Energy Sector in 2025
In 2025, Taiwan experienced a dramatic surge in cyberattacks against its energy sector, with incidents increasing tenfold compared to the previous year, as reported by the country's National Security Bureau. Chinese nation-state groups, such as BlackTech, Flax Typhoon, Mustang Panda, APT41, and UNC3886, orchestrated targeted campaigns that leveraged hardware and software vulnerabilities, DDoS, social engineering, and supply-chain tactics. These attacks predominantly focused on industrial control systems and aimed to implant malware during key software upgrade windows, affecting vital infrastructure in petroleum, electricity, and natural gas domains and raising geopolitical and operational security concerns. This incident highlights the persistent threat of coordinated nation-state cyber activity against critical infrastructure, especially during politically sensitive periods. The tactics and techniques observed reflect global trends in the exploitation of operational technology and underscore the increasing need for advanced defense and cross-border intelligence sharing.
7 months ago
Kill Chain
DCRat Delivered Through Fake Booking Emails Hits European Hotels in 2026
In early 2026, a sophisticated cyberattack campaign, tracked as PHALT#BLYX, targeted the European hospitality sector using malicious fake booking emails. These emails redirected recipients to fraudulent Blue Screen of Death (BSoD) pages, pressuring hotel staff to install fake fixes. This social engineering technique resulted in the deployment of DCRat, a remote access trojan capable of stealing sensitive data, harvesting credentials, and providing attackers with persistent network access. The campaign, reported by Securonix, underscores the increasing professionalization of phishing lures and multi-stage malware delivery aimed at high-turnover verticals like hospitality. The attack highlights a recent trend of leveraging socially engineered booking-themed lures paired with malware disguised as system utilities. As similar TTPs proliferate and more malware-as-a-service tools become accessible, such incidents foreshadow growing risks for sectors with transient workforces and limited security training.
7 months ago
Kill Chain
TOTOLINK EX200 Unpatched Flaw Enables Remote Takeover in 2026
In January 2026, a critical unpatched firmware vulnerability (CVE-2025-65606) was disclosed by CERT/CC affecting TOTOLINK EX200 wireless range extenders. This flaw resides in the device’s firmware-upload error-handling logic, allowing a remote authenticated attacker to trigger processes leading to full device compromise. Successful exploitation provides total administrative control, enabling attackers to alter configurations, secretly listen to traffic, or pivot to other devices on the network. TOTOLINK has not released an update, leaving vulnerable devices exposed in both home and enterprise environments. This breach highlights the ongoing threat posed by IoT device vulnerabilities—especially as attackers increasingly exploit authentication-bypass flaws and manufacturer patch delays. The incident underscores the importance of swift vulnerability management and robust network segmentation in mitigating the risk from unpatched IoT endpoints.
7 months ago
Kill Chain
900,000 Users Targeted: Malicious Chrome Extensions Harvest AI Chat & Browser Data
In January 2026, cybersecurity researchers uncovered two malicious Chrome extensions—'Chat GPT for Chrome with GPT-5, Claude Sonnet & DeepSeek AI' and 'AI Sidebar with Deepseek, ChatGPT, Claude, and more.'—that secretly exfiltrated ChatGPT, DeepSeek conversations, and extensive browsing data from over 900,000 users. These extensions masqueraded as legitimate browser tools but harvested sensitive data by scraping web pages and Chrome tabs, transmitting this information to attacker-controlled command-and-control servers every 30 minutes. This breach potentially exposed confidential business information, intellectual property, and user identities, underscoring the heightened risks posed by seemingly innocuous browser add-ons in enterprise environments. The incident marks a broader uptick in malicious and even some legitimate browser extensions turning to 'prompt poaching'—stealing user interactions with AI and chatbots. As AI adoption accelerates, organizations face new data exposure risks, demanding updated monitoring, awareness, and policy enforcement around browser extensions.
7 months ago
Kill Chain
Ransomware 2026: Inside the Surge of DDoS, Insiders, and Gig Worker Threats
In early 2026, ransomware groups rapidly adapted their extortion playbooks following a revenue decline, marked by a 47% year-over-year surge in attacks but falling ransom payments. Threat actors broadened tactics—reviving DDoS-for-hire within the Ransomware-as-a-Service (RaaS) model, ramping up recruitment of insiders (including targeting trusted employees and gig workers), and executing data theft via both technical and social attack vectors. Notably, attackers expanded beyond traditional Russian operators, evidencing global proliferation. These methods bypassed conventional defenses, with incidents tracked across multiple sectors and frequently resulting in significant data breaches, operational disruption, and reputational harm. The evolution of ransomware in 2026 highlights a rising urgency for enterprises to harden insider defenses, revisit DDoS mitigation, and validate physical security and third-party access. With attackers exploiting workforce instability, gig economy platforms, and hybrid extortion, a modernized, multi-layered security posture is now critical across all industries.
7 months ago
Kill Chain
Columbia Weather Systems MicroServer Critical Firmware Exploits Threaten US Critical Infrastructure
In January 2026, multiple severe vulnerabilities were disclosed in the Columbia Weather Systems MicroServer, impacting critical infrastructure sectors in the United States. Attackers could exploit these flaws—improper restriction of communication channels (CVE-2025-61939), cleartext storage of credentials (CVE-2025-64305), and an exposed webshell with unrestricted shell access (CVE-2025-66620)—to redirect secure connections to malicious devices, gain admin-level web access, and establish persistent shell access with rights to modify or exfiltrate sensitive data. The affected firmware versions allowed attackers with network or admin privileges to perform high-impact actions, risking both operational continuity and data confidentiality for organizations relying on these devices. This incident underscores the growing challenge to secure Internet of Things (IoT) and Industrial Control Systems (ICS), especially as attackers increasingly target insecure firmware, lateral movement vectors, and privileged machine access. Regulatory attention and attacker focus on supply-chain and device firmware attacks continue to intensify, heightening the urgency for proactive remediation and layered ICS defenses.
7 months ago
Kill Chain
Insider Threat Reality: US Cyber Pros Caught as BlackCat Ransomware Affiliates
In 2023, two U.S.-based cybersecurity professionals—formerly employed by major security firms—pleaded guilty to acting as affiliates for the ALPHV/BlackCat ransomware group. The individuals leveraged their insider knowledge and technical expertise to facilitate the deployment of the ransomware, compromising sensitive systems in targeted organizations. By exploiting weaknesses in internal security protocols and bypassing detection mechanisms, they assisted in the encryption of files and extortion of affected businesses, resulting in operational disruptions and significant reputational damage across multiple sectors. This incident highlights an escalating threat posed by insiders with privileged knowledge and skills, who collaborate with sophisticated ransomware groups like BlackCat. The convergence of advanced ransomware-as-a-service operations and trusted industry insiders signals a dangerous shift, amplifying calls for more robust zero trust strategies, stricter network segmentation, and improved insider threat monitoring.
7 months ago
Kill Chain
Inside the ClickFix Campaign: How Hospitality Firms Were Hit with DCRat Remote Access Attacks
In early 2024, a sophisticated phishing campaign known as 'ClickFix' targeted organizations in the hospitality sector with convincing fake 'Blue Screen of Death' error messages. Attackers leveraged social engineering techniques combined with a legitimate Microsoft utility to trick victims into executing malicious payloads. Once engaged, the attack delivered the DCRat remote access trojan, granting cybercriminals ongoing access and control over affected systems. The campaign demonstrated how legitimate tools and realistic lures can bypass conventional defenses, resulting in compromised credentials, lateral network movement, and potential data exfiltration. This incident reflects a wider trend of threat actors increasingly turning to legitimate software and advanced social engineering to evade detection. Remote access trojans like DCRat continue to be used in targeted attacks, particularly against sectors with complex digital footprints and limited security controls, making it vital for organizations to adapt their threat detection capabilities.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
