✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 385 to 396 of 5035
Spanish Authorities Dismantle €140 Million Cyber Fraud Network
In July 2026, Spanish authorities dismantled a cybercrime and money-laundering network responsible for defrauding €140 million through investment fraud and Business Email Compromise (BEC) schemes. The operation led to the arrest of four individuals across Spain, Portugal, and Panama. The criminals managed over 800 bank accounts, utilizing sophisticated social engineering tactics such as impersonating executives and issuing false invoices to divert funds into accounts they controlled. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spanish-police-take-down-140-million-cyber-fraud-ring-arrest-four/?utm_source=openai)) This incident underscores the escalating threat of BEC attacks, which exploit organizational trust and email communications to execute financial fraud. The substantial financial impact highlights the necessity for organizations to implement robust email security measures, employee training, and stringent verification processes to mitigate such risks.
2 weeks ago
Kill Chain
Microsoft's Unprecedented Patch Tuesday: 622 Vulnerabilities Addressed
On July 14, 2026, Microsoft released patches for a record-breaking 622 vulnerabilities across its product suite, including Windows, Office, Azure, Defender, and SQL Server. Notably, two zero-day vulnerabilities were actively exploited: CVE-2026-56155 in Active Directory Federation Services, allowing local privilege escalation to administrator, and CVE-2026-56164 in SharePoint Server, enabling network-based privilege escalation without authentication. Additionally, a BitLocker security feature bypass (CVE-2026-50661) was publicly disclosed prior to the patch release. ([securityweek.com](https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/?utm_source=openai)) This unprecedented volume of patches underscores the increasing complexity of Microsoft's ecosystem and the growing sophistication of threat actors. Organizations are urged to prioritize applying these updates promptly to mitigate potential risks associated with these vulnerabilities.
2 weeks ago
Kill Chain
SAP Releases Critical Patch for NetWeaver ABAP Vulnerability CVE-2026-44747
In July 2026, SAP released a critical security update addressing CVE-2026-44747, a memory corruption vulnerability in SAP NetWeaver Application Server ABAP. This flaw allows authenticated attackers to exploit memory management errors, potentially leading to unauthorized data access, modification, or system unavailability. The vulnerability affects multiple versions of the SAP NetWeaver AS ABAP kernel, including 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20. Organizations using these versions are urged to apply the provided patches promptly to mitigate the risk of exploitation. The disclosure of CVE-2026-44747 underscores the ongoing challenges in securing enterprise resource planning (ERP) systems. As these platforms are integral to business operations, vulnerabilities within them present significant risks. This incident highlights the necessity for organizations to maintain rigorous patch management practices and to stay vigilant against emerging threats targeting critical business applications.
2 weeks ago
Kill Chain
Critical Vulnerability in 'Claude for Chrome' Exposes User Data
In July 2026, security researchers identified a critical vulnerability in Anthropic's 'Claude for Chrome' extension, allowing malicious browser extensions to exploit Claude's automation capabilities. This flaw enables unauthorized access to sensitive user data, including Gmail, Google Docs, and Calendar, by triggering tasks without user consent. Despite previous mitigation efforts, the vulnerability persists in version 1.0.80, posing significant security risks to users. The incident underscores the growing threat of prompt injection attacks targeting AI-powered browser extensions. As AI tools become more integrated into daily workflows, ensuring robust security measures and user awareness is paramount to prevent unauthorized data access and maintain user trust.
2 weeks ago
Kill Chain
FBI Issues Warning on Fake Permit Fee Phishing Scam
In March 2026, the FBI issued a public alert regarding a sophisticated phishing campaign where cybercriminals impersonated city and county planning officials to defraud property owners. By leveraging publicly accessible permit records, these actors sent emails to individuals with active applications, demanding payments for fictitious permit fees via wire transfers, peer-to-peer transfers, or cryptocurrency. The emails were meticulously crafted, incorporating real permit details to enhance credibility, leading victims to authorize payments that bypassed traditional fraud detection mechanisms. This scheme resulted in significant financial losses and highlighted vulnerabilities in existing payment verification processes. The urgency of this issue is underscored by the rapid escalation of government impersonation scams, which nearly doubled in reported losses to approximately $798 million in 2025. The increasing sophistication of these attacks, particularly their ability to exploit publicly available data and evade standard fraud detection systems, necessitates immediate attention and the development of more robust security measures to protect individuals and businesses from such fraudulent activities.
2 weeks ago
Kill Chain
Russian Cyberattacks in 2026 Exploit Weak Router Security
In July 2026, state-sponsored threat actors affiliated with Russia's Federal Security Service (FSB) Center 16 exploited weakly protected routers and networking equipment to infiltrate critical infrastructure networks globally. Targeted sectors included defense, energy, financial services, government, and healthcare. The attackers utilized techniques such as scanning for exposed SNMP services with default or easily guessed passwords and exploiting known vulnerabilities in Cisco devices. This activity led to significant disruptions and data breaches across multiple countries. The incident underscores the persistent threat posed by nation-state actors exploiting basic security lapses. It highlights the urgent need for organizations to implement robust network security measures, including updating device firmware, enforcing strong authentication protocols, and disabling unnecessary services to mitigate such risks.
2 weeks ago
Kill Chain
Critical Vulnerability in Cursor IDE: Automatic Execution of Malicious Code in Compromised Repositories
In July 2026, a critical vulnerability was discovered in Cursor IDE, an AI-powered coding platform. This flaw allows attackers to embed a malicious 'git.exe' file within a repository. When a developer opens such a compromised project, Cursor automatically executes the malicious binary without any warnings or prompts, leading to potential unauthorized code execution on the developer's machine. Despite being reported to Cursor in December 2025, the vulnerability remains unpatched, posing significant risks to developers using the platform. This incident underscores the growing security challenges associated with AI-assisted development tools. As these platforms become more integrated into software development workflows, they present new attack vectors that can be exploited by threat actors. The lack of prompt remediation highlights the need for developers and organizations to remain vigilant, implement robust security measures, and advocate for timely patches from software vendors to mitigate emerging threats.
2 weeks ago
Kill Chain
ClickFix Malware Campaign: A 2026 Cybersecurity Wake-Up Call
In early 2026, a significant malware campaign known as 'ClickFix' exploited a critical vulnerability in the Ghost Content Management System (CVE-2026-26980) to compromise over 700 websites, including those of prominent educational institutions and tech companies. Attackers injected malicious JavaScript into these sites, presenting users with fake Cloudflare verification prompts that instructed them to execute commands leading to malware installation. This social engineering tactic effectively bypassed traditional security defenses, resulting in widespread data breaches and operational disruptions. The ClickFix campaign underscores a growing trend in cyber threats where attackers leverage trusted platforms and social engineering to deploy malware. The rapid evolution of such tactics highlights the need for organizations to adopt advanced detection methods, such as YARA-based structural analysis, and to enhance user awareness training to mitigate the risks associated with these sophisticated attacks.
2 weeks ago
Kill Chain
ShinyHunters' Year-Long Exploitation of OAuth in Salesforce Breaches
Between mid-2025 and mid-2026, the cybercriminal group ShinyHunters orchestrated a series of data extortion attacks targeting corporate Salesforce environments. By exploiting trust relationships through OAuth connections, they gained unauthorized access without exploiting platform vulnerabilities. Their methods included voice phishing to trick employees into approving malicious connected apps, stealing OAuth tokens from compromised software vendors, and leveraging misconfigured guest access to Salesforce sites. These tactics allowed them to exfiltrate sensitive CRM data from numerous organizations across various industries. This incident underscores the evolving threat landscape where attackers exploit trusted integrations and social engineering to bypass traditional security measures. Organizations must enhance their monitoring of OAuth activities, audit third-party app permissions, and educate employees on the risks of social engineering to mitigate such sophisticated attacks.
2 weeks ago
Kill Chain
Strengthening Router Security Against State-Sponsored Cyber Threats
In July 2026, a joint advisory from the NSA, CISA, FBI, and international partners highlighted that Russian FSB Center 16 cyber actors, also known as Berserk Bear and Dragonfly, have been exploiting poorly configured and vulnerable networking devices worldwide. These actors primarily target critical infrastructure sectors such as communications, energy, defense, financial services, government facilities, and healthcare. Their tactics include scanning for devices with default or weak SNMP credentials and exploiting known vulnerabilities in Cisco devices and protocols, enabling unauthorized access and potential disruption of essential services. This incident underscores the persistent threat posed by state-sponsored cyber actors targeting critical infrastructure through common vulnerabilities. Organizations are urged to enhance their network security by updating device configurations, disabling legacy protocols, and implementing strong authentication measures to mitigate such risks.
2 weeks ago
Kill Chain
Lucide Proxy Campaign: A New Wave of Supply Chain Attacks
In May 2026, a campaign involving 148 malicious npm packages, disguised as student web proxies, covertly transformed users' browsers into nodes of a distributed denial-of-service (DDoS) botnet. These packages, branded as 'Lucide' and presented as tutoring services like 'Riverbend Tutoring' and 'Northstar Tutoring,' lured students seeking to bypass school web filters. Upon visiting these proxy sites, users' browsers loaded remote JavaScript payloads that executed DDoS attacks and injected aggressive popunder advertisements. The campaign exploited the npm ecosystem to distribute these packages, leveraging the browsers of end-users for malicious activities without their knowledge. ([research.jfrog.com](https://research.jfrog.com/post/lucide-proxy-npm-malware-campaign/?utm_source=openai)) This incident underscores a significant evolution in supply chain threats, highlighting the vulnerability of end-user systems to malicious code distributed through trusted platforms. The attackers' use of mutable remote loaders and rapid iteration of package versions indicates a low operational security posture, focusing on maximizing short-term impact. Organizations must remain vigilant against such deceptive tactics, emphasizing the importance of scrutinizing third-party packages and educating users about the risks associated with untrusted proxy tools.
2 weeks ago
Kill Chain
U.S. Sanctions 1VPNS and Cryptor Seller for Enabling Ransomware Attacks
On July 13, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS), its Ukrainian administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev for facilitating ransomware attacks against American entities. 1VPNS provided anonymizing infrastructure that enabled ransomware groups to obscure their operations, while Silayev sold cryptors that disguised malware to evade detection. These services were instrumental in attacks targeting U.S. businesses, financial services, hospitals, and municipal governments, resulting in billions of dollars in losses. ([publicnow.com](https://www.publicnow.com/view/0E2E8ABF10AF6840E4588F09B8C6B2408783C702?utm_source=openai)) This action underscores the U.S. government's commitment to disrupting the cybercriminal ecosystem by targeting not only the perpetrators but also the enablers of ransomware operations. The sanctions highlight the critical role that infrastructure providers and tool developers play in the proliferation of ransomware, emphasizing the need for comprehensive cybersecurity measures and international cooperation to combat these threats.
2 weeks ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
