✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3601 to 3612 of 5263
Trust Wallet Breach 2023: How a Shai-Hulud NPM Supply Chain Attack Stole $8.5M
In November 2023, Trust Wallet suffered a significant security breach in which an attacker exploited a malicious NPM supply chain package—most notably associated with the "Shai-Hulud" attack campaign. By leveraging this industry-wide incident, threat actors managed to compromise the Trust Wallet web browser extension, executing a targeted attack to steal approximately $8.5 million from over 2,500 crypto wallets. The threat actors utilized sophisticated techniques to inject malicious code via the open-source software supply chain, highlighting vulnerabilities in component dependencies and the risk of lateral movement within affected environments. This incident is especially relevant as supply chain attacks using compromised open-source packages are on the rise, impacting a broad range of organizations that rely on third-party code. The Trust Wallet breach underscores the urgency for robust supply chain security strategies, better monitoring of dependencies, and solid east-west traffic controls to detect anomalous behaviors and restrict lateral movement.
- Computer Software/Engineering
- Computer/Network Security
- Investment Management/Hedge Fund/Private Equity
7 months ago
Kill Chain
Mustang Panda’s 2025 Kernel Rootkit: How a Signed Driver Enabled Stealth Espionage in Asia
In mid-2025, the Chinese cyber espionage group Mustang Panda deployed a previously undocumented, signed kernel-mode rootkit to secretly load a TONESHELL backdoor variant during targeted attacks against government organizations in Southeast and East Asia—mainly Myanmar and Thailand. Leveraging a stolen legacy digital certificate, the attackers installed a Windows minifilter driver to inject TONESHELL into system processes, evade security controls, and shield their malware and associated files from detection. The backdoor enabled ongoing remote control, data exfiltration, and further malware deployments via encrypted channels, establishing persistent clandestine access. This incident is notable for its innovative use of signed kernel drivers to enhance stealth, resilience, and anti-forensic measures. It reflects a broader trend among sophisticated threat actors who increasingly leverage advanced rootkit technology and certificate abuse to bypass endpoint protections and remain undetected for extended periods.
7 months ago
Kill Chain
US Treasury Lifts Sanctions on Key Intellexa Predator Spyware Figures
In December 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) removed three individuals previously sanctioned for their involvement with Intellexa and its Predator commercial spyware from the Specially Designated Nationals (SDN) list. The individuals—Merom Harpaz, Andrea Nicola Constantino Hermes Gambazzi, and Sara Aleksandra Fayssal Hamou—were linked to leadership and distribution roles within the Intellexa Consortium. Their removal followed a petition and OFAC’s evaluation that they had separated themselves from the Intellexa ecosystem, but no underlying details or independent confirmation were disclosed. The original sanctions stemmed from their roles in developing, distributing, and enabling Predator software, a tool implicated in high-profile surveillance of civil society figures, including journalists and activists, through stealth zero-day and social engineering attacks. This case underscores the continued risks posed by commercial spyware vendors and associated compliance exposures. Ongoing public reporting highlights Predator’s persistent activity despite regulatory efforts, as well as geopolitical pressures that drive international balkanization and new attack trends targeting sensitive sectors. With regulatory frameworks evolving and threat actors shifting tactics, the risk of spyware misuse for human rights abuses and espionage remains acute.
7 months ago
Kill Chain
Worm in the Code: Shai Hulud & Cobalt Strike Unleash Supply Chain Threats on npm and Maven (2025)
In December 2025, researchers identified a modified strain of the Shai Hulud worm circulating in the npm registry via the package '@vietmoney/react-big-calendar.' While detected early with no large-scale infections, analysis showed the worm’s ability to compromise developer environments, harvest API keys, cloud credentials, and npm/GitHub tokens, and exfiltrate them to attacker-controlled GitHub repositories. Simultaneously, an unrelated but similar threat surfaced on Maven Central, where a typosquatted 'org.fasterxml.jackson.core/jackson-databind' package delivered an obfuscated Cobalt Strike beacon through supply chain compromise. Both incidents exploited weaknesses in public software repositories, targeting developer trust and facilitating potential lateral spread across the ecosystem. These incidents underscore the escalating risks of open source supply chain attacks, in which adversaries leverage trusted development components to sneak malware into organizations. With attacker sophistication growing and repository defenses lagging, enterprises face pressure to enhance visibility, automate dependency monitoring, and enforce zero-trust principles for third-party code integration.
7 months ago
Kill Chain
Over 10,000 Fortinet Firewalls Still Exposed to 2FA Bypass Attack in 2026
In early January 2026, it was revealed that over 10,000 Fortinet FortiGate firewalls remain exposed to a critical authentication bypass vulnerability (CVE-2020-12812) first patched by Fortinet in July 2020. Attackers exploit this flaw by manipulating username case sensitivity to bypass two-factor authentication (2FA) on SSL VPNs—allowing unauthorized access to devices with unpatched software and certain LDAP configurations. Despite years of vendor and government warnings, more than 1,300 vulnerable systems in the United States alone are still online, placing organizations at ongoing risk of compromise. The persistence of this five-year-old flaw’s exploitation highlights chronic issues in vulnerability management and patch adoption within network infrastructure. Active targeting by both cybercriminal and state-backed actors, combined with evidence of ransomware deployment, underscores the need for continuous configuration hardening, zero trust adoption, and rapid remediation of exposed security controls.
7 months ago
Kill Chain
Phishing Goes Cloud-Native: Google Cloud Application Integration Abused in 2026 Attack
In early 2026, a sophisticated phishing campaign was uncovered in which cybercriminals leveraged Google Cloud’s Application Integration service to send deceptive emails that mimicked legitimate Google communications. By exploiting the inherent trust in Google’s cloud infrastructure, attackers generated emails from authentic Google addresses, increasing the likelihood of victims engaging with malicious links or sharing sensitive information. According to Check Point researchers, this multi-stage approach enabled attackers to bypass traditional email security measures, posing significant risks to organizations that rely heavily on cloud-based productivity suites for daily operations. This campaign highlights an emerging trend in the abuse of trusted SaaS and cloud platforms for targeted phishing attacks. As adversaries shift toward cloud-native TTPs and social engineering techniques, organizations must enhance detection, improve user awareness, and adapt inline controls to mitigate risks tied to trusted service abuse.
7 months ago
Kill Chain
How the 2022 LastPass Breach Fueled $35M+ in Crypto Thefts
In 2022, LastPass suffered a significant data breach after attackers infiltrated a developer environment and stole company source code, later exploiting stolen credentials to breach cloud storage and extract encrypted customer password vaults. Despite vault encryption, weak or reused master passwords allowed attackers to eventually crack vaults offline, exposing sensitive credentials—including cryptocurrency wallet keys and seed phrases. Over the following years, coordinated threat actors drained victim wallets in distinct waves, laundering more than $35 million through techniques such as CoinJoin mixing, before cashing out via Russian-linked exchanges. This incident highlights the security risks of weak master passwords and illustrates the growing sophistication of post-breach credential exploitation, including the long-tail impact on industries handling digital assets. Organizations now face mounting regulatory pressure to strengthen secrets management and rapidly adapt to evolving attacker tradecraft targeting credential stores.
7 months ago
Kill Chain
IBM API Connect Critical Authentication Bypass (2025): What You Must Know
In December 2025, IBM disclosed a critical security vulnerability (CVE-2025-13915) in its API Connect platform, rated 9.8 on the CVSS scale. The flaw allowed remote attackers to bypass authentication mechanisms and gain unauthorized access to exposed applications. Exploitation could enable attackers to manipulate sensitive workloads, extract confidential data, or pivot deeper into network environments. The incident highlighted how a simple authentication bypass in widely deployed enterprise middleware presents major risks for organizations relying on API-enabled digital ecosystems. This breach underscores the escalating sophistication of identity-focused attacks and the necessity for robust authentication and segmentation controls. With API-driven architectures proliferating in nearly every sector, such vulnerabilities are increasingly targeted; urgency is amplified by regulatory pressure and the rising adoption of zero trust frameworks.
7 months ago
Kill Chain
478,000 Patients Impacted: Covenant Health Suffers Major Qilin Ransomware Breach in 2025
In May 2025, Covenant Health, a prominent Catholic healthcare provider in New England and Pennsylvania, experienced a significant ransomware attack by the Qilin group. The attackers breached the organization's systems on May 18, exfiltrated approximately 852GB of sensitive data—including names, addresses, social security numbers, medical records, and health insurance information—and subsequently encrypted essential files. Discovery of the breach occurred on May 26, with the scale initially underestimated, before forensic analysis revealed that nearly 478,000 patients were affected. The organization launched a comprehensive investigation, secured its systems, and is offering 12 months of free identity protection to impacted individuals. This breach highlights the continued targeting of healthcare organizations by sophisticated ransomware groups seeking to exploit large troves of sensitive personal and medical data. With ransomware tactics evolving and threat actors increasingly publishing stolen data for extortion, robust data protection and incident response have become critical priorities for healthcare providers.
7 months ago
Kill Chain
How Transparent Tribe’s 2026 RAT Offensive Breached Indian Government & Academia
In early 2026, the advanced persistent threat group Transparent Tribe (APT36) launched a sophisticated cyber espionage campaign targeting Indian governmental and academic institutions. Attackers distributed spear-phishing emails containing ZIP archives with malicious Windows shortcut (LNK) files, disguised as legitimate PDFs. Upon execution, these files deployed remote access trojans (RATs) by loading encrypted payloads in-memory and displaying decoy documents to evade suspicion. The malware adapted its persistence techniques based on detected antivirus solutions and enabled functions such as file management, system reconnaissance, data exfiltration, and command execution via a dynamic command-and-control infrastructure. This incident highlights the persistent evolution of state-linked cyber threats and the rising use of multi-stage spear-phishing, evasive loaders, and context-aware persistence. As state-sponsored attacks become more adaptive and target the public sector, organizations face increased regulatory and operational pressure to fortify internal security controls and monitor lateral movement.
7 months ago
Kill Chain
Kimwolf Botnet: When Residential Proxies Turn Your LAN Into a Global Attack Platform
In late 2025, a rapidly growing botnet called Kimwolf infected over two million devices worldwide, primarily through compromised Android TV boxes and digital photo frames lacking basic security controls or authentication. Attackers abused vulnerabilities in residential proxy networks—particularly via IPIDEA—to tunnel through external firewalls, gaining direct access to devices inside private networks. Kimwolf malware leveraged DNS tricks and default-enabled Android Debug Bridge (ADB) to enable lateral movement, turning victim devices into nodes for ad fraud, account takeovers, content scraping, and high-volume DDoS attacks, demonstrating unprecedented attacker reach into home and small business LANs. Kimwolf's swift expansion and post-takedown resilience reveal a new class of threats exploiting insecure IoT and overlooked network entry points inside residential and SMB environments. The incident highlights emerging risks from mass-produced, inadequately secured consumer tech and proxy networks, urging organizations to reconsider internal network trust assumptions and prioritize visibility, segmentation, and policy-driven controls to stop lateral movement and botnet proliferation.
7 months ago
Kill Chain
VVS Stealer: Advanced Infostealer Targets Discord Users with Pyarmor Obfuscation
In April 2025, Palo Alto Networks researchers uncovered the VVS Discord Stealer, a Python-based infostealer distributed via Telegram and targeting Discord users. Leveraging Pyarmor for advanced code obfuscation and detection evasion, the malware bundled itself as a PyInstaller executable and used sophisticated techniques such as AES-128-CTR encryption and injection of persistent JavaScript payloads into Discord’s Electron framework. VVS Stealer exfiltrated Discord credentials, tokens, browser data, and session information to attacker-controlled webhooks, targeting both Discord-specific and multi-browser artifacts with stealth and persistence. The campaign highlights the rise of infostealers employing dual-use obfuscation to bypass modern security controls, extending dwell time and increasing the risk of credential-based account takeovers across personal and enterprise platforms. This incident exemplifies an ongoing surge in credential theft campaigns leveraging advanced obfuscation tools, notably as infostealers adapt to evade both static and endpoint detection solutions. The widespread abuse of dual-use security tools for malicious purposes is fueling regulatory scrutiny and underscores the urgent need for enhanced threat visibility, real-time anomaly detection, and credential hygiene in communication and collaboration platforms.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
