✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4561 to 4572 of 5297
Hitachi Energy TropOS ICS Flaws Threaten Critical Infrastructure Security (2025)
In October 2025, Hitachi Energy disclosed multiple critical vulnerabilities in its TropOS 4th Generation firmware (versions 8.9.6.0 and prior), widely used in critical manufacturing and energy sectors. Three CVEs—CVE-2025-1036, CVE-2025-1037, and CVE-2025-1038—were identified, including OS command injection and improper privilege management flaws in the web-based configuration utility. Exploiting these, authenticated attackers could escalate privileges and obtain root SSH access to affected devices, substantially compromising network security and potentially disrupting critical infrastructure operations. The flaws were reported by Idaho National Laboratory’s CyTRICS program and carry CVSS v4 scores between 7.5 and 8.7. This incident highlights ongoing risks posed by authentication and privilege flaws in industrial control systems (ICS), especially as critical infrastructure devices increasingly attract remote exploitation attempts. It underscores the urgent need for regular firmware updates, network segmentation, and robust access controls amid tightening regulations and persistent adversarial interest in ICS environments.
7 months ago
Kill Chain
New 2025 Guidance: Securing Microsoft Exchange Servers from Infrastructure Vulnerabilities
In October 2025, cybersecurity authorities including CISA and the NSA released urgent best practices following persistent threats targeting on-premises Microsoft Exchange servers. Despite patch releases and increased awareness, many organizations continued running outdated or misconfigured Exchange environments, leaving them vulnerable to exploitation. Attackers leveraged these weaknesses to gain unauthorized access, often leading to lateral movement, data exfiltration, and in some cases, ransomware incidents. The culmination of such ongoing attacks prompted renewed guidance emphasizing strong authentication, rigorous encryption, and decommissioning of unsupported hybrid Exchange servers to minimize operational risk. This incident underscores the ongoing trend of adversaries exploiting infrastructure vulnerabilities, especially in legacy and hybrid setups. With continued attacker innovation and regulatory scrutiny, organizations must adopt zero trust principles, prioritize patch cycles, and upgrade legacy systems to mitigate evolving threats.
7 months ago
Kill Chain
CISA Highlights Active Exploitation of XWiki & VMware Vulnerabilities in 2025 KEV Catalog Update
In October 2025, CISA added two actively exploited vulnerabilities—CVE-2025-24893 in XWiki Platform (Eval Injection) and CVE-2025-41244 in Broadcom VMware Aria Operations and VMware Tools (Privilege Defined with Unsafe Actions)—to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws enable remote attackers to inject malicious code or escalate privileges, presenting substantial risks for the federal enterprise and beyond. The inclusion in the KEV Catalog signals confirmed in-the-wild exploitation and compels agencies to expedite remediation measures under Binding Operational Directive 22-01 to protect critical federal infrastructure networks. This incident underscores the persistent trend of attackers rapidly leveraging new or previously overlooked vulnerabilities with real-world consequences. As the speed of exploitation shortens and attack surfaces broaden, timely vulnerability management, zero trust practices, and proactive monitoring remain vital to reducing enterprise cyber risk.
7 months ago
Kill Chain
ISO 15118-2 EV Charging Protocol Vulnerability: Man-in-the-Middle Risk in 2025
In October 2025, a critical vulnerability (CVE-2025-12357) impacting the ISO 15118-2 standard for electric vehicle (EV) chargers was disclosed. The flaw centers on improper restriction of communication channels, specifically enabling attackers to exploit the Signal Level Attenuation Characterization (SLAC) protocol with spoofed measurements. This manipulation facilitates man-in-the-middle attacks between EVs and compliant chargers, with attacks feasible wirelessly and in close proximity via electromagnetic induction. The vulnerability jeopardizes authentication and data exchange during the EV charging process but has not yet been publicly exploited. The incident highlights escalating risks across connected infrastructure, especially as EV adoption surges globally. As regulators, manufacturers, and utility providers converge on charging protocols, the need for mandatory end-to-end encryption is increasingly urgent to safeguard against evolving threat actors targeting critical transportation sectors.
7 months ago
Kill Chain
Dentsu Subsidiary Employee Data Stolen in 2024 Breach: What Enterprises Must Know
In June 2024, a subsidiary of global marketing and PR giant Dentsu experienced a significant data breach in which unidentified threat actors accessed and stole sensitive employee information. The breach reportedly targeted internal personnel data, potentially exposing names, contact information, and other personally identifiable details, though Dentsu has not publicly shared whether client data was affected. The precise entry vector has not been disclosed, but the attack highlights vulnerabilities in east-west traffic inspection and data-in-transit encryption within subsidiary environments. Dentsu's management responded by initiating a comprehensive forensic investigation and notifying affected employees while enhancing internal security protocols. This breach accentuates the growing targeting of large holding companies and their subsidiaries, as attackers increasingly seek weak links in global enterprise ecosystems. With regulatory pressure mounting and privacy violations facing stiffer penalties worldwide, all large organizations must urgently reassess how they secure internal traffic and control access across decentralised operational units.
7 months ago
Kill Chain
Iranian Hacker Training School Hit by Major Data Leak in 2024
In June 2024, a significant data breach struck Ravin Academy, an institution linked to training operatives for Iran’s Ministry of Intelligence and Security (MOIS). Unknown attackers infiltrated Ravin Academy’s infrastructure and exfiltrated sensitive personal information on students, instructors, and internal operations. The breach exposed emails, full names, contact info, assignment details, and evidence of the academy’s ties to cyberespionage. Responsibility was claimed by hacktivists aiming to publicly reveal Iranian cyber capabilities. The school is believed to have failed in securing internal East-West traffic, and evidence suggests lack of robust threat detection or network segmentation allowed attackers to maintain persistence long enough to extract substantial records. The breach is under investigation, but sensitive intelligence operations may have been compromised. This incident draws renewed focus on “learning supply chain” vulnerabilities: attacker interest in targeting not just state actors, but their feeder institutions and ecosystems. Such breaches underscore mounting regulatory concern over insider risk, inadequate segmentation, and the risks of unencrypted internal communications in institutions developing offensive cyber capabilities.
7 months ago
Kill Chain
PhantomRaven’s Malicious npm Packages: 2024 Supply-Chain Risk with Invisible Dependencies
In early 2024, the "PhantomRaven" campaign targeted the open-source software ecosystem by distributing 126 malicious npm packages containing concealed, 'invisible' dependencies. These packages, published over several months, bypassed detection mechanisms and were downloaded over 86,000 times by unsuspecting developers. Threat actors leveraged these supply chain attacks to potentially exfiltrate sensitive data, propagate malware, or serve as initial entry points for deeper compromises in downstream applications and organizations dependent on these packages. The campaign highlighted significant vulnerabilities in supply-chain security and the risks associated with open-source package management. This incident is part of a rising trend of sophisticated supply-chain attacks leveraging trusted developer tools and repositories. With increasing regulatory scrutiny and mounting pressure to harden software dependencies, organizations must assess their exposure and implement robust controls to thwart similar attacks in the future.
7 months ago
Kill Chain
L3Harris Insider Breach: Zero-Day Exploits Sold to Russian Broker in 2024
In 2024, a former executive at defense contractor L3Harris, Peter Williams, pleaded guilty to stealing and selling eight zero-day cyber exploits to a Russian broker linked to Operation Zero. Williams exploited privileged access at Trenchant, an L3Harris subsidiary, to covertly extract software developed for the U.S. government. He sold these sensitive trade secrets between 2022 and 2024 for several million dollars in cryptocurrency, hiding the transactions through encrypted communications. The sale of these advanced cyber capabilities to an entity catering to Russian state clients exposed L3Harris to estimated damages of $35 million and raised concerns about offensive tools in adversarial hands. This case highlights the increasing risks posed by insider threats exploiting specialized knowledge in the cyber-arms marketplace. Recent trends show threat actors—often with national ties—actively pursuing zero-day exploits via brokers, making supply chain trust and internal controls critical concerns for organizations managing sensitive cyber assets.
7 months ago
Kill Chain
PhantomRaven Floods npm with Malicious Credential-Stealing Packages
In April 2024, the 'PhantomRaven' threat campaign targeted the JavaScript software ecosystem by flooding the npm package repository with dozens of malicious packages. These packages, aimed at developers and CI/CD environments, were crafted to harvest authentication tokens, CI/CD secrets, and GitHub credentials when installed. Attackers employed typosquatting and deceptive package naming techniques to trick developers into integrating the compromised code into their applications, thereby enabling broad access to source code and sensitive internal systems. The attack underscores the growing risk posed by software supply chain compromises, impacting thousands of potential downstream applications and organizations. This incident highlights an ongoing surge in supply chain attacks leveraging public code repositories, targeting both individual developers and enterprise development pipelines. Attackers are increasingly employing credential harvesting via trusted open-source channels, intensifying regulatory scrutiny and driving immediate needs for enhanced software integrity controls and threat detection across development workflows.
7 months ago
Kill Chain
Microsoft 2024 DNS Outage Paralyzes Azure & Microsoft 365 Globally
On June 20, 2024, Microsoft experienced a global DNS outage that disrupted access to Azure and Microsoft 365 services for customers worldwide. The outage was triggered by an internal DNS configuration issue that affected service resolution and authentication to corporate networks. Users reported being unable to access several core Microsoft services, including email, cloud storage, and collaboration tools. Microsoft’s engineering teams identified the root cause and began remediation, but the incident resulted in widespread operational downtime lasting several hours and affected businesses dependent on Microsoft’s cloud infrastructure. This incident highlights the increasing business impact of cloud infrastructure dependencies and emphasizes the importance of resilient and redundant DNS architectures. Service disruptions of this magnitude reinforce regulatory and customer scrutiny regarding cloud service reliability and prompt renewed attention to business continuity, availability controls, and third-party risk management.
7 months ago
Kill Chain
Canada’s Water & Energy Sectors Breached by Hacktivist Attackers in 2024
In early 2024, multiple Canadian critical infrastructure sectors, including water and energy facilities, were breached by hacktivist groups. According to the Canadian Centre for Cyber Security, attackers exploited exposed internet-facing industrial control systems, gaining access and, in some instances, making unauthorized modifications that could have resulted in dangerous physical effects. The threat actors, likely with a political or ideological motive, targeted operational technology (OT) environments, highlighting the vulnerabilities present in essential public services and raising alarm over the potential for severe disruption or damage. This breach reflects a broader trend of hacktivist-driven attacks targeting critical infrastructure worldwide, often leveraging OT/IT convergence and insufficient network segmentation. The incident underscores the urgent need for modern security controls, enhanced monitoring, and robust response strategies to keep pace with rapidly evolving threat actor tactics in the industrial sector.
7 months ago
Kill Chain
Malicious npm Package Attack Exposes Software Supply Chain Risks in 2024
In June 2024, security researchers identified a supply chain attack involving at least ten malicious npm packages uploaded to the public registry. Masquerading as legitimate software components, these packages were designed to infect developer environments across Windows, Linux, and macOS. Once installed, they downloaded and executed an information-stealing payload capable of harvesting sensitive data such as credentials and environment variables, potentially enabling lateral movement or further breaches within affected organizations. The attack leveraged trusted software distribution channels to bypass traditional defenses and amplify impact among open-source users. This incident underlines escalating risks in the software supply chain, highlighting how open-source package ecosystems have become prime targets for attackers. The trend represents a growing challenge for organizations relying on third-party code, driving new urgency around vetting procedures, continuous monitoring, and enforcing granular security controls in developer pipelines.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
