✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4441 to 4452 of 5296
ChatGPT 2025 Vulnerabilities: How AI Memory Leaks Put Data at Risk
In November 2025, cybersecurity researchers uncovered and disclosed a set of seven critical vulnerabilities affecting OpenAI's ChatGPT, specifically the GPT-4o and GPT-5 models. The vulnerabilities allowed attackers to exploit memory and chat history mechanisms, enabling the unauthorized extraction of sensitive user information—including personal data and confidential conversation content—without user awareness. The flaws could be triggered remotely through crafted prompts and API calls, presenting a considerable risk both to individuals and enterprises leveraging ChatGPT in production environments. OpenAI has issued patches and advisories, but the revelations highlight the rapid evolution and complexity of securing AI models at scale. This incident is especially significant given the increasing reliance on generative AI in business workflows and the concurrent surge in attacks targeting AI-powered infrastructure. With regulatory scrutiny intensifying around AI data handling and the advent of new compliance frameworks, protecting AI systems against data leakage has become a board-level imperative.
7 months ago
Kill Chain
Pro-Russian APT Uses Linux VMs to Evade Windows Security in 2024
In early 2024, the pro-Russian threat group known as Curly Comrades leveraged Linux virtual machines within Windows environments to bypass security controls and evade detection. By deploying Linux VMs on compromised Windows hosts, the attackers concealed their activities, used native tools for lateral movement, and exfiltrated sensitive data without triggering traditional endpoint or network monitoring. This novel cross-OS technique allowed extended dwell time and left organizations vulnerable to espionage, data loss, and operational disruption. This incident is especially relevant given the continuing evolution of threat actor tactics, including living-off-the-land and virtualization abuse. Organizations must adapt defenses to anticipate adversaries' creative use of multi-platform infrastructures and strengthen their east-west visibility to prevent stealthy attacks.
7 months ago
Kill Chain
Proliance Surgeons Breach: Ransomware Exposes Hidden Supply Chain Risks
In January 2024, Proliance Surgeons, a major US healthcare provider, suffered a significant data breach after ransomware group Midas targeted its third-party vendor, PJ&A, which provides medical transcription services. The attackers exploited insufficient east-west traffic segmentation and leveraged VPN credentials to move laterally through Proliance’s environment, encrypting data and exfiltrating files containing patient names, addresses, dates of birth, medical record numbers, and clinical details. Business operations were disrupted for days, and regulatory investigations are underway, posing severe operational and reputational risks for both Proliance and its downstream partners. This breach underscores the ongoing vulnerability of healthcare organizations to supply chain ransomware attacks. With ransomware groups shifting tactics to exploit third-party vendors and focusing on lateral movement for maximum damage, healthcare organizations must modernize network segmentation, enhance detection capabilities, and achieve compliance with stricter data protection mandates.
7 months ago
Kill Chain
Iranian APTs Target US Policy Influencers in Sophisticated 2024 Phishing Campaign
In mid-2024, Iranian state-aligned advanced persistent threat (APT) actors launched a sophisticated spear-phishing campaign targeting prominent US foreign policy influencers, think tank members, and government advisors. The attackers employed socially engineered emails and credential harvesting tactics, using well-crafted phishing lures to compromise email accounts and exfiltrate sensitive conversations. While attribution remains uncertain among Iranian groups, the campaign utilized advanced operational security measures, making detection difficult and demonstrating high levels of persistence. As a result, sensitive policy information and strategic communications were potentially exposed, raising concerns about foreign influence and espionage risks. This campaign is especially relevant as it highlights a broader surge in highly personalized phishing attacks by nation-state actors against geopolitical targets. It underscores the need for advanced identity protection, more robust security around internal communications, and ongoing vigilance among organizations operating in the policy and government sectors.
7 months ago
Kill Chain
Kimsuky Unleashes HTTPTroy Backdoor in Targeted Attack on South Korea
In early 2024, the North Korean state-sponsored group Kimsuky launched a targeted cyberespionage campaign using a new backdoor called HTTPTroy, aimed at South Korean users. Leveraging sophisticated obfuscation and advanced anti-analysis features, Kimsuky distributed the malware primarily via phishing emails containing malicious attachments. Once installed, HTTPTroy enabled the attackers to execute commands remotely and exfiltrate sensitive data while evading detection. The campaign underscores the increasing technical capabilities of North Korean APT groups and their persistent focus on South Korean government, critical infrastructure, and research sectors. This incident highlights an accelerating trend of advanced persistent threats deploying stealthy, resilient malware to bypass traditional defenses. As attackers evolve their toolchains, organizations—especially in frequently targeted regions—face heightened risk from espionage operations that blend social engineering, evasion tactics, and custom malware.
7 months ago
Kill Chain
Major Supply-Chain Exposure Discovered in Popular Software Update Tool – 2024
In early 2024, a critical supply-chain vulnerability was identified in a widely used software update tool, threatening some of the world's largest technology enterprises. Attackers exploited insecure update mechanisms within this tool, enabling the potential injection of malware directly into production software across multiple organizations. The breach exposed businesses to risks including unauthorized access, lateral movement, and possible data theft. While no confirmed exploitation has been publicly reported to date, the threat mirrors the scale and impact of the infamous SolarWinds compromise, underscoring the profound risks inherent in trusted third-party code dependencies. This incident highlights the urgent and growing threat from software supply-chain attacks, which have rapidly increased in frequency and sophistication over the past two years. It spotlights the cybersecurity community’s intensified focus on software bill of materials (SBOM), continuous monitoring, and robust supply-chain controls as regulatory and industry expectations tighten.
7 months ago
Kill Chain
WordPress Sites Under Siege: Critical Post SMTP Plugin Flaw Exposes 400,000+ Websites
In June 2024, a critical vulnerability was discovered in the Post SMTP mailer plugin for WordPress, widely used by over 400,000 sites. This flaw allows unauthenticated attackers to reset admin accounts and take full control of affected websites. Threat actors have already exploited the vulnerability by leveraging malicious password reset links, leading to complete site compromise, potential data theft, and abuse of compromised infrastructure for further attacks. The vulnerability prompted emergency patching and urgent advisories from both the plugin authors and security firms. This incident underscores the persistent threat posed by plugin vulnerabilities in the WordPress ecosystem, which remains a popular target for cybercriminals due to its vast user base. The surge in attacks exploiting supply chain and third-party plugin weaknesses highlights the need for rapid vulnerability management and robust security controls for web applications.
7 months ago
Kill Chain
Apple Patches Over 100 Multi-Platform Vulnerabilities in Major 2025 Security Update
In November 2025, Apple released security updates addressing over 100 vulnerabilities affecting core operating systems and components across iPhones, Macs, iPads, Safari, visionOS, watchOS, and Xcode. The update covered 105 vulnerabilities in macOS 26.1, 56 in iOS/iPadOS 26.1, and dozens more in related platforms. While Apple stated that no active exploitation was detected for these flaws, the sheer breadth of affected systems and lack of severity ratings heightened concern among security professionals about potential entry points for future attacks, especially given the criticality of WebKit-related issues and minimal vulnerability detail disclosure by Apple. This incident highlights persistent gaps in vendor transparency on vulnerability risk and the ongoing challenge of prioritizing patching in complex technology environments. As platforms like Apple’s remain in the crosshairs for attackers and as software interdependencies grow, organizations must stay vigilant in rapidly applying updates despite limited public clarity on bug severity.
7 months ago
Kill Chain
U.S. Treasury Sanctions North Korean Firms for Cryptocurrency Crime and IT Fraud (2024)
In June 2024, the U.S. Treasury Department sanctioned eight individuals and two companies linked to North Korea for laundering proceeds from cybercrime and IT worker schemes. These sanctioned parties allegedly funneled over $3 billion in stolen cryptocurrency and hundreds of millions in illicitly earned IT wages to the North Korean regime, supporting its weapons programs. Entities sanctioned include North Korean banking officials, an IT company operating in China, and financial institution representatives in both China and Russia, all accused of violating international sanctions, managing illicit funds, and enabling large-scale money laundering through sophisticated cyber and identity subterfuge. This incident underscores the advanced capabilities of North Korea’s cyber operations and their direct link to geopolitical threats, as well as the ongoing shift towards state-sponsored cryptocurrency theft and IT fraud as major funding sources for sanctioned regimes.
7 months ago
Kill Chain
F5’s 2023 Supply Chain Breach: When Nation-State Attacks Undermine U.S. Cyber Readiness
In October 2023, a significant nation-state supply chain attack targeted F5, a leading provider of network and application security solutions. Threat actors believed to be linked to China successfully gained unauthorized access to F5's source code and undisclosed vulnerabilities, providing them with intimate knowledge required to craft advanced exploits capable of bypassing traditional security defenses. BIG-IP, F5's flagship product, is widely deployed by major enterprises, federal agencies, healthcare institutions, and utilities, making the impact of this breach exceptionally far-reaching. In response, CISA issued an emergency directive urging federal agencies to promptly patch vulnerable systems, citing the potential for cascading impacts across critical infrastructure. This incident is particularly relevant as it underscores the growing sophistication of supply chain attacks, where adversaries target foundational software providers instead of individual end-users. The breach comes amidst rising threats from nation-state actors and highlights the urgent need for proactive security controls, rapid patching, and improved cross-sector collaboration to strengthen cyber resilience.
7 months ago
Kill Chain
Hackers Exploit Authentication Bypass in JobMonster WordPress Theme (2024)
In June 2024, threat actors exploited a critical authentication bypass vulnerability in the JobMonster WordPress theme, enabling attackers to gain unauthorized administrative access on affected websites. The flaw, discovered and disclosed by security researchers, allowed attackers to escalate privileges and hijack admin accounts under certain misconfiguration conditions. Attackers rapidly leveraged the flaw in active campaigns, placing thousands of sites at risk of compromise, defacement, or further malware infection. The widespread usage of the JobMonster theme among job board and recruitment-firm websites amplified the potential impact and data exposure. This incident demonstrates the rising trend of web application targeting via plugin and theme vulnerabilities. The exploitation reinforces concerns around supply chain security in the WordPress ecosystem and highlights growing attacker sophistication in exploiting authentication flaws before site owners can apply available patches.
7 months ago
Kill Chain
Curly COMrades: Russian Hackers Hide Malware in Hyper-V Linux VMs to Evade Detection
In early 2024, threat intelligence analysts uncovered a sophisticated campaign by the Russian-backed group Curly COMrades, wherein attackers abused Microsoft's Hyper-V virtualization feature to bypass endpoint detection on target Windows systems. The attackers covertly deployed an Alpine Linux virtual machine, invisible to conventional security tools, and used it as a persistent foothold to run malware, facilitate lateral movement, and exfiltrate sensitive data. This technique allowed them to mask malicious processes and evade established EDR and antivirus solutions, posing serious risks to affected organizations. This incident highlights an alarming evolution in advanced persistent threat tactics, with adversaries exploiting virtualization infrastructure to evade modern security controls. As virtualized environments and cloud workloads proliferate, organizations must harden hypervisors, enhance east-west security, and advance detection capabilities to fend off similar stealthy threats.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
