✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4285 to 4296 of 5296
Logitech Suffers 2024 Data Breach from Clop Extortion Attack
In July 2024, Logitech, a leading global hardware accessory manufacturer, confirmed a data breach following a cyberattack orchestrated by the Clop ransomware group. The attackers exploited vulnerabilities in Oracle E-Business Suite, part of a broader wave of Clop extortion operations targeting organizations using the MOVEit Transfer and Oracle solutions. Sensitive customer and internal information was reportedly exfiltrated, as Clop leveraged data theft and extortion—rather than encrypting files—pressuring Logitech to pay ransom under threat of data publication. The breach has prompted Logitech to review its security protocols and notify affected stakeholders, though the full extent of the compromised data remains under investigation. This incident highlights the accelerating trend of data extortion attacks, where criminals target trusted enterprise software platforms to access valuable data at scale. Regulatory scrutiny around third-party risk, heightened focus on data handling, and the rise in ransomware-free extortion tactics make such incidents not only high-profile but pivotal for all organizations dependent on interconnected ecosystems.
7 months ago
Kill Chain
North Korean Threat Actors Weaponize JSON Services for Stealthy Malware Campaigns
In late 2025, security researchers from NVISO identified a new supply chain attack campaign attributed to North Korean threat actors, leveraging popular JSON storage services—such as JSON Keeper, JSONsilo, and npoint.io—to covertly distribute trojanized malware payloads. The attackers embedded malicious code in legitimate-looking coding projects and lured developers, weaponizing widely used file formats and cloud APIs as their delivery mechanism. Consequently, targeted organizations experienced risks of credential theft, data exfiltration, and potential network breaches, with increased threat visibility due to attackers’ creative use of benign infrastructure as covert command and control channels. This incident highlights a broader trend: state-sponsored actors are rapidly innovating malware delivery by abusing cloud-based, trusted SaaS platforms. The use of developer-centric resources and supply chain lures expands attack surfaces and increases risk to technology-driven enterprises, intensifying the need for zero trust controls and supply chain vigilance.
7 months ago
Kill Chain
North Korean Insider Fraud Breach: How US Firms Were Infiltrated in 2024
In early 2024, the U.S. Department of Justice announced that five individuals pleaded guilty to helping North Korean operatives illicitly obtain remote IT work with American companies. The accused provided support and deception to facilitate North Korean nationals—working under assumed identities—to infiltrate U.S. organizations in a widespread insider threat campaign. These operatives gained access to proprietary data and corporate resources, generating significant revenue for North Korea through fraudulently obtained salaries, often paid in cryptocurrency. The scheme exploited remote work arrangements and weaknesses in identity verification, posing serious risks to sensitive sectors and exposing organizations to data theft and compliance violations. This case illustrates the increasing sophistication of insider threat attacks using stolen or falsified identities, especially targeting remote workforces. Organizations face growing urgency to enhance zero trust security, segment lateral movement, and strengthen controls for detecting and verifying remote personnel as geopolitical actors intensify efforts to bypass western sanctions and exploit globalized IT supply chains.
7 months ago
Kill Chain
Fortinet 2025: Chained FortiWeb Flaws Enable Remote Code Execution and Privilege Escalation
In November 2025, Fortinet disclosed two critical vulnerabilities (CVE-2025-64446 and CVE-2025-58034) affecting multiple versions of its FortiWeb web application firewall. Exploited as a chained attack, the first flaw—relative path traversal—enabled unauthenticated attackers to execute administrative commands via crafted HTTP/HTTPS requests, while the second—OS command injection—allowed privilege escalation and execution of unauthorized code by authenticated users. Security agencies confirmed observed exploitation in the wild, with potential impact including network compromise, lateral movement, and loss of control over critical web applications. Fortinet and CISA urged immediate upgrades and review of affected deployments. This incident underscores a broader trend of adversaries targeting internet-facing security appliances as entry points, chaining vulnerabilities for deeper network access. The rapid inclusion of these CVEs in CISA’s Known Exploited Vulnerabilities catalog reflects the elevated urgency and broader risk to organizations across sectors relying on web application firewalls as a key security control.
7 months ago
Kill Chain
Fortinet FortiWeb’s 2025 Path Traversal Attack: What You Need to Know
In November 2025, Fortinet's FortiWeb product was found vulnerable to an actively exploited path traversal flaw, designated as CVE-2025-64446. Malicious actors leveraged this vulnerability to bypass web application security measures, gaining unauthorized access to sensitive files on the system. As a result, attackers could exfiltrate data and potentially escalate privileges, thereby putting organizations at significant risk of broader compromise. The flaw became a critical concern for organizations using FortiWeb, prompting immediate remediation actions to protect against ongoing attacks targeting US federal and private sector networks. The incident highlights the growing trend of sophisticated exploitation of web application devices by threat actors. A surge in path traversal and similar vulnerabilities in critical infrastructure underscores the need for robust, proactive vulnerability management as required by directives like CISA BOD 22-01 and made clear by its inclusion in the Known Exploited Vulnerabilities Catalog.
7 months ago
Kill Chain
Matryoshka Malware: How Attackers hide Exploits in Nested Office Files (2025)
In November 2025, security researchers identified a novel malware delivery technique leveraging Microsoft Office documents mimicking Russian Matryoshka dolls. Attackers embedded a weaponized RTF file exploiting CVE-2017-11882 inside an OOXML Word document, circumventing Microsoft's restrictions on automatic macro execution. Upon opening, the document triggers shellcode that writes a malicious DLL to the user's local Temp directory, which is then executed using an obfuscated command to evade detection. The attack demonstrates advanced evasion tactics, potentially linked to info-stealers such as FormBook, complicating detection and response efforts for organizations relying on traditional file-type controls. This incident highlights the ongoing relevance of document-based exploitation despite reduced macro attacks, as threat actors adopt creative nesting techniques. Security teams must adapt to evolving delivery mechanisms that circumvent recent platform protections, making layered defenses and behavioral detection increasingly essential.
7 months ago
Kill Chain
Clop Ransomware Hits Washington Post via Oracle Zero-Day in 2024
In July and August 2024, The Washington Post fell victim to a cyberattack orchestrated by the Clop ransomware group, which exploited a zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite. Attackers accessed the company’s Oracle environment for over six weeks, ultimately stealing sensitive HR data on nearly 10,000 current and former employees and contractors, including names, bank account details, and Social Security numbers. The breach went undetected until late September when Clop contacted executives with extortion demands. The company confirmed the scope of stolen data in late October, after initiating an internal investigation. This incident underscores the growing trend of threat actors leveraging zero-day vulnerabilities in widely used enterprise software to facilitate mass data theft and extortion. With ransomware groups like Clop escalating the use of targeted campaigns against technology supply chains, organizations face heightened exposure to financial, regulatory, and reputational risk.
7 months ago
Kill Chain
FBI Flags Akira Ransomware as Top Threat to US Critical Infrastructure in 2024
In September 2024, federal cyber authorities, including the FBI and CISA, issued a joint advisory detailing the significant threat posed by the Akira ransomware group. First identified in March 2023, Akira employs double-extortion tactics—stealing sensitive data before encrypting systems—to pressure victims for ransom. The group is associated with additional threat actors and has links to the former Conti operation. Akira has accumulated over $244 million in illicit proceeds by targeting small and medium-sized businesses, impacting sectors such as manufacturing, education, healthcare, IT, finance, and agriculture. The group leverages known vulnerabilities in critical infrastructure software, exploits stolen credentials, and uses remote access tools to compromise organizations, often exfiltrating data in just over two hours. The FBI considers Akira among its top five most consequential ransomware variants, reflecting a broader trend of increasingly sophisticated, fast-moving, and costly ransomware attacks. Recent activity highlights the group’s adaptability and operational security, reinforcing the urgent need for organizations to harden defenses as ransomware tactics evolve.
7 months ago
Kill Chain
2024 Uhale Android Photo Frame Breach: Supply Chain Malware Risk
In mid-2024, security researchers discovered that popular Uhale-branded Android-based digital photo frames were shipping with critical security flaws, including a supply chain compromise whereby the devices automatically downloaded and executed malware upon boot. The attack exploited insecure system components and unauthorized code injection, allowing threat actors to remotely install and run arbitrary malware. As a result, affected users faced risks ranging from credential theft and device hijacking to involuntary participation in botnets, with downstream exposure to broader enterprise or home networks if connected. This incident comes amid a broader surge in supply chain attacks targeting IoT and smart devices, with attackers leveraging manufacturer or third-party vulnerabilities to pre-install malware before devices reach consumers. The event highlights the growing regulatory and operational scrutiny of supply chain security, emphasizing the urgent need for enhanced vendor risk management and enterprise device segmentation.
7 months ago
Kill Chain
CISA Flags WatchGuard Firebox Vulnerability: Network Security on High Alert in 2024
In April 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive to all federal agencies to patch a critical vulnerability in WatchGuard Firebox firewalls. This flaw, actively exploited in the wild, allowed remote attackers to gain code execution privileges on unpatched devices, placing affected organizations at risk of network compromise. Exploitation was achieved through maliciously crafted requests, providing attackers with unauthorized access, persistence, and the potential to pivot laterally within victim environments. The incident prompted the federal government and private sector organizations to accelerate patch deployment to mitigate ongoing attacks. This breach underscores the persistent threat to network appliances and the importance of rapid vulnerability management as attackers increasingly target edge devices for initial access. The current trend reflects heightened regulatory scrutiny and an evolving attack surface driven by both state and financially motivated threat actors.
7 months ago
Kill Chain
Police Disrupts Global Rhadamanthys, VenomRAT & Elysium Malware Servers in Landmark 2024 Operation
In May 2024, a coordinated international operation involving law enforcement agencies from nine countries dismantled 1,025 servers associated with the Rhadamanthys infostealer, VenomRAT, and Elysium botnet malware operations. The infrastructure takedown was part of Operation Endgame, which targeted malware botnets used to steal data, deliver ransomware, and facilitate cyberattacks globally. By disrupting these networks, authorities severely impaired the threat actors' ability to conduct ongoing credential, financial, and personal data theft campaigns against businesses and individuals across multiple regions. This incident highlights the escalating efforts among global law enforcement to target and disable cybercriminal infrastructure at scale. The takedown reflects a trend towards greater intelligence-sharing and direct action, signaling that even complex, distributed botnet operations can be disrupted through multinational cooperation.
7 months ago
Kill Chain
CISA Alert: Active Exploitation of Cisco ASA & Firepower Devices in 2024
In June 2024, CISA issued an urgent alert to federal agencies following the discovery of active exploitation of two critical vulnerabilities (CVE-2024-20353 and CVE-2024-20359) in Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) devices. Threat actors leveraged these flaws to bypass authentication and remotely execute code, potentially enabling lateral movement and unauthorized network access. Several government and enterprise environments were left exposed due to unpatched systems, raising significant risk to sensitive operations and regulated data. This incident underscores the growing sophistication of cybercriminals targeting network infrastructure, particularly edge devices, and highlights the urgent need for rapid patch management and network segmentation as threat vectors continually evolve.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
