✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3673 to 3684 of 5264
ASUS Live Update Supply Chain Breach: Lessons from a Sophisticated APT Attack
In 2018, ASUS suffered a major supply chain compromise in which attackers, believed to be a state-linked APT group, infiltrated the ASUS Live Update utility and distributed a malicious software update to potentially hundreds of thousands of users. The attackers inserted a sophisticated backdoor into the official ASUS update, enabling targeted compromise of devices based on specific MAC addresses. Although the vulnerability (CVE-2025-59374) has only been formally cataloged recently, the incident itself occurred years ago, impacting trust in widely used supply chain components. This breach remains relevant due to the ongoing risk of similar supply chain tactics by advanced threat actors and the late inclusion of legacy vulnerabilities in compliance and threat feeds. Security leaders must recognize that historic supply chain compromises may resurface in compliance audits or be exploited in future campaigns through neglected, end-of-life software.
7 months ago
Kill Chain
Coupang Suffers Massive 2024 Data Breach: 33.7 Million Users Impacted by Credential Abuse
In early 2024, Coupang, one of South Korea’s largest e-commerce platforms, suffered a data breach that went undetected for nearly five months, compromising the personal information of approximately 33.7 million users. The attacker, suspected to have leveraged compromised insider credentials, gained unauthorized access to databases containing user details including names, email addresses, and contact information. The breach highlights an extended dwell time during which the threat actor potentially exfiltrated significant data without detection, raising concerns over Coupang’s monitoring and response capabilities. Business impacts include reputational damage, regulatory scrutiny, and increased risk of fraud targeting affected users. This incident is highly relevant as it demonstrates the growing threat of credential and insider abuse, long dwell times, and the necessity for more rigorous data protection practices as regulatory pressure around personal data intensifies worldwide.
7 months ago
Kill Chain
University of Phoenix 2024 Clop Ransomware Breach Exposes Millions
In August 2023, the University of Phoenix suffered a significant data breach after the Clop ransomware gang exploited a vulnerability in the MOVEit file transfer software. Attackers gained unauthorized access to sensitive personal data belonging to nearly 3.5 million individuals, including current and former students, staff, and suppliers. The breach led to the theft of names, Social Security numbers, and other confidential records, severely impacting the institution’s ability to assure data privacy. Public disclosure came in June 2024 after investigation and notification procedures were completed. This incident underlines the escalating damage caused by ransomware groups leveraging supply chain vulnerabilities. Higher education institutions remain high-value targets due to large volumes of personal data and often fragmented security postures, highlighting an urgent need for proactive risk management and compliance with data protection regulations.
7 months ago
Kill Chain
Ransomware Attack Hits Romanian Water Authority: A 2024 Critical Infrastructure Wake-Up Call
In June 2024, Romania’s National Water Administration (Administrația Națională Apele Române) suffered a ransomware attack that disrupted key systems and operational processes. The attack, identified over the weekend of June 8–9, targeted core IT infrastructure, encrypting file servers and temporarily interrupting the administrative management of the country’s water resources. While water supply to the public reportedly remained unaffected, the incident led to delays in critical public and environmental services and highlighted gaps in incident response capabilities and network segmentation. Early indications suggest the attackers used a known ransomware variant, gaining access via a vulnerable remote service. This breach comes amid a surge in ransomware attacks on public utilities across Europe, emphasizing the increasing threat to operational technology and critical infrastructure. Heightened regulatory scrutiny and an evolving threat landscape put additional pressure on agencies to improve cyber resilience and visibility.
7 months ago
Kill Chain
npm Supply-Chain Breach: Malicious Package Steals WhatsApp Accounts and Messages
In June 2024, security researchers uncovered a malicious npm package masquerading as a legitimate WhatsApp Web API library. The package, downloaded from the Node Package Manager (NPM) registry, surreptitiously executed code to hijack WhatsApp accounts by stealing authentication credentials, intercepting messages, and exfiltrating contact information. Attackers leveraged this supply-chain compromise to gain unauthorized access to WhatsApp accounts, putting personal messages and sensitive user data at risk. The incident underscores growing threats targeting developer ecosystems and open-source repositories, demonstrating how a single compromised package can have widespread impact across organizations and individuals relying on shared libraries. This attack is particularly significant as adversaries increasingly exploit the software supply chain to distribute malware through trusted open-source ecosystems. Organizations face heightened regulatory scrutiny over software integrity, and similar tactics are quickly proliferating, prompting urgent calls for enhanced dependency management and real-time code vetting across the industry.
7 months ago
Kill Chain
INTERPOL Sparks Major 2024 Ransomware Takedown in Operation Sentinel
In May 2024, INTERPOL led a sweeping global cybercrime crackdown titled Operation Sentinel, targeting ransomware crews, business email compromise (BEC) groups, and extortion gangs. The coordinated action resulted in the arrest of 574 individuals across multiple countries. Six major ransomware strains were decrypted, and authorities seized over $3 million in illicit funds, effectively disrupting expansive international crime networks. Attackers leveraged a mix of phishing, malware, and lateral movement to infiltrate corporate and public-sector environments, lock critical data, and demand ransom payments. The impact was both substantial and international, affecting hundreds of organizations and drawing heavy collaboration among law enforcement agencies across continents. This case underscores the rise of global, cross-border law enforcement cooperation in tackling ransomware and financially motivated cybercrime. As threat actors become ever more sophisticated and resilient, multinational efforts and advanced decryption capabilities are now essential for effective disruption and victim support.
7 months ago
Kill Chain
Uzbekistan 2025: Wonderland Android Malware Campaign Steals Millions via Mobile Banking Fraud
In late 2025, a sophisticated cybercrime operation in Uzbekistan targeted Android users through the deployment of advanced dropper apps that installed the Wonderland malware. Disguised as legitimate Google Play or popular media files, these malicious APKs leveraged social engineering and fake landing pages to trick users into installation after enabling 'unknown sources.' The threat actor group, TrickyWonders, coordinated their campaign via Telegram, using heavily obfuscated droppers (MidnightDat and RoundRift) and dynamic C2 infrastructure. Once on a device, Wonderland enabled real-time SMS and OTP theft, phone number hijacking, lateral propagation via Telegram session compromise, and banking fraud, resulting in significant financial losses for victims. This incident underscores a broader trend: attackers are rapidly iterating their methods, shifting towards deceptive dropper-based infection chains, robust C2 agility, and hierarchically structured cybercrime operations. The campaign’s evolution, paired with similar threats like Cellik, Frogblight, and NexusRoute, signals an urgent need for improved mobile endpoint security, user awareness, and regulatory vigilance.
7 months ago
Kill Chain
MacSync Malware Bypasses macOS Gatekeeper with Notarized Infostealer in 2024
In June 2024, security researchers identified a new MacSync infostealer variant targeting macOS devices. The malware is delivered through a digitally signed and notarized Swift application that successfully evades Apple’s Gatekeeper checks, allowing it to run without typical security warnings. Once executed, MacSync exfiltrates sensitive user information including credentials, browser data, and files—leveraging encrypted command-and-control channels to avoid detection. The sophisticated dropper uses advanced evasion techniques to bypass standard macOS security controls, elevating risks for individuals and organizations running unpatched systems. This attack illustrates an evolving landscape where threat actors exploit trusted developer channels and novel evasion tactics to compromise macOS environments. With the growing adoption of macOS in enterprise and remote work settings, organizations are urged to review their controls, respond proactively, and address malware risks that legacy security tools may not detect.
7 months ago
Kill Chain
Nissan Customer Data Exposed After Red Hat Supply Chain Breach
In September 2023, Nissan Motor Co. Ltd. confirmed that the personal information of thousands of its customers was compromised due to a supply chain data breach at Red Hat, a leading software vendor. The breach stemmed from unauthorized access to customer data managed by Red Hat, which affected Nissan’s customer records, including names and contact information. While there is no current evidence of financial or highly sensitive information being lost, Nissan has notified the individuals impacted and is working with Red Hat to further assess and contain the breach’s full scope. This incident highlights the ongoing risk posed by third-party vendors in the automotive and technology sectors, as organizations increasingly rely on external service providers for software and infrastructure. The Nissan-Red Hat breach underscores the rising threats targeting supply chains, emphasizing the urgent need for robust vendor security controls and visibility into partner ecosystems.
7 months ago
Kill Chain
How Multi-Vector Attacks in 2025 Exposed Firewall and Internal Security Gaps
In December 2025, several global organizations faced a coordinated multi-vector cyber campaign in which threat actors leveraged recent vulnerabilities across enterprise firewalls, browser plugins, and connected devices. Attackers stealthily exploited zero-day flaws in network perimeter devices to access east-west traffic, deploy lateral movement, and exfiltrate sensitive data using encrypted channels. Both commercial and open-source threat detection struggled to identify activity quickly, resulting in significant operational disruptions, regulatory notification requirements, and data privacy liabilities affecting numerous sectors worldwide. This incident is indicative of a new threat paradigm in which attackers favor multi-tool, insider-style techniques, combining supply chain vulnerabilities with stealthy movements inside trusted IT environments. Security and compliance teams must now contend with adversaries who bypass traditional controls and exploit overlooked components, highlighting urgent needs for zero trust segmentation, improved traffic visibility, and robust egress monitoring.
7 months ago
Kill Chain
Uzbekistan Telegram Users Hit by Sophisticated Android SMS-Stealer Campaign in 2024
In early 2024, Android users in Uzbekistan experienced a surge of targeted attacks as cybercriminals deployed SMS-stealer malware through phishing campaigns delivered via Telegram. The attackers leveraged fake and malicious applications purpose-built to intercept and exfiltrate SMS messages, enabling unauthorized access to multi-factor authentication codes and banking credentials. Threat actors demonstrated increasing sophistication and adaptability by iterating on malware variants, incorporating obfuscation tactics, and exploiting the popularity of Telegram as a distribution channel. This resulted in significant risks of financial theft and compromised user privacy across a large segment of Uzbek Android device users. This incident highlights the evolving landscape of mobile infostealer attacks in Central Asia, with a marked uptick in the use of instant messaging platforms as malware delivery vectors. The swift adaptation of criminal tactics underscores the necessity for organizations and individuals to strengthen mobile endpoint security and remain vigilant against increasingly convincing phishing and sideloading threats.
7 months ago
Kill Chain
Malicious npm Package Exposes WhatsApp Accounts in 2025 Supply Chain Attack
In May 2025, a malicious npm package named "lotusbail" was uploaded to the JavaScript ecosystem, masquerading as a fully functional WhatsApp API. Created by a user known as "seiren_primrose," the package was downloaded over 56,000 times before discovery. Behind its legitimate capabilities, "lotusbail" stealthily exfiltrated WhatsApp credentials, intercepted all messages, harvested contacts, installed a persistent backdoor, and linked attacker devices to victims’ WhatsApp accounts for continuous unauthorized access. Data was encrypted and exfiltrated to attacker-controlled servers, with covert device pairing persisting even after package removal, compounding the risk to both individuals and organizations reliant on WhatsApp for communication. This incident highlights the growing risk of advanced supply chain attacks via trusted open-source repositories. Attackers increasingly use sophisticated evasion tactics—like anti-debugging, code obfuscation, and reputation laundering—to slip past static and reputation-based security controls. As software supply chain threats intensify, organizations must urgently reassess the hygiene, monitoring, and zero trust posture of their development pipelines.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
