✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4609 to 4620 of 5297
Remote Code Execution: WSUS Patch Bypass Turns Trusted Update Service Into Attack Platform
In June 2024, attackers exploited a critical remote code execution vulnerability (CVE-2025-59287) in Microsoft’s deprecated Windows Server Update Services (WSUS), bypassing an emergency patch that was meant to mitigate the threat. Attackers leveraged publicly exposed WSUS servers, executing unauthenticated commands that enabled environmental enumeration and potential data exfiltration. Researchers observed threat activity just hours after Microsoft released a revised patch, with at least 2,800 exposed WSUS instances identified globally. These servers, operating with high system privileges, presented an ideal entry point for attackers to target downstream systems via malicious software updates, elevating the risk of a far-reaching internal supply chain compromise. This incident highlights the increasing risk associated with outdated and internet-exposed infrastructure. It underscores the rapid pace of threat actor adaptation—often outpacing defenders’ patch cycles—and demonstrates the necessity for organizations to promptly apply patches and follow defense-in-depth practices for critical administrative tools.
7 months ago
Kill Chain
RedTiger Infostealer Attack Hits Discord Users in 2024
In early June 2024, cybersecurity researchers uncovered a new campaign in which attackers used a RedTiger-based infostealer to target Discord users. The campaign leveraged the open-source red-team tool RedTiger to build a custom infostealer designed to harvest Discord account credentials and stored payment information by injecting malicious code into Discord’s directories. Victims typically became infected through malicious downloads or phishing websites, unknowingly handing over sensitive data, including authentication tokens and payment details, to the attackers. As a result, stolen Discord accounts were sold or used for further fraud and account takeovers, risking both personal and organizational information leakage. This incident highlights an escalating trend of using open-source red-team tools for malicious infostealer campaigns, boosting attackers’ agility and reach. It underscores the risk of credential-based attacks on popular platforms, the need for real-time threat detection, and reinforces the importance of continuous endpoint monitoring and stronger egress security controls.
7 months ago
Kill Chain
How Memento Labs' ForumTroll Campaign Exploited Chrome Zero-Day with Dante Spyware
In early 2024, cybersecurity researchers at Kaspersky uncovered an advanced malware campaign, codenamed 'Operation ForumTroll,' targeting Russian government entities, media outlets, financial institutions, and research organizations. The campaign was linked to Memento Labs, the successor to the notorious Italian surveillance company Hacking Team. Leveraging a zero-day vulnerability in Google Chrome, attackers distributed personalized phishing emails which, when clicked, led victims to malicious websites; no further interaction was required to infect devices. The campaign enabled espionage, data exfiltration, and surveillance with high sophistication, including the deployment of a new commercial spyware tool known as 'Dante.' This incident highlights the increasing commercialization and sophistication of spyware operations, the targeting of Russian organizations by state-aligned APTs, and the ongoing exploitation of zero-day vulnerabilities in popular software. It underscores the urgency for organizations to proactively monitor threat activity and patch systems swiftly.
7 months ago
Kill Chain
CISA Orders Immediate Patch for Critical Windows Server WSUS Flaw Exploited in Attacks
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive requiring all U.S. government agencies to urgently patch a critical Windows Server Update Services (WSUS) vulnerability after it was found to be actively exploited in the wild. Attackers leveraged the flaw to gain unauthorized access to Windows Server environments via malicious update mechanisms, potentially allowing for privilege escalation and lateral movement within targeted networks. The incident raised concerns about the rapid exploitation of newly discovered vulnerabilities in core infrastructure and emphasized the necessity for timely patching and robust network segmentation to mitigate further risk. This incident underscores a broader surge in targeted attacks against on-premises infrastructure, with threat actors increasingly exploiting supply chain and software update mechanisms. It reveals an urgent need for organizations to prioritize vulnerability management and align with zero trust best practices, as high-profile vulnerabilities continue to be rapidly weaponized.
7 months ago
Kill Chain
QNAP Backup Software Exposed by Critical ASP.NET Vulnerability in 2024
In June 2024, QNAP, a prominent provider of network-attached storage (NAS) solutions, disclosed that its NetBak PC Agent backup utility for Windows is vulnerable to a critical ASP.NET Core flaw (CVE-2024-27348). This vulnerability, originally reported in Microsoft's platform, allows unauthenticated remote attackers to potentially execute arbitrary code or compromise data in transit. QNAP urged customers to apply security patches immediately, as exploitation may permit attackers to pivot from compromised endpoints to valuable NAS devices, affecting both business continuity and data confidentiality. The QNAP incident highlights the ongoing risk of supply-chain vulnerabilities, particularly when third-party software libraries are widely adopted. With attackers increasingly leveraging zero-day software flaws and targeting backup systems as initial entry points for ransomware and data exfiltration, IT teams must remain vigilant about patching integrations and dependencies across the entire software stack.
7 months ago
Kill Chain
Operation ForumTroll: How Memento Labs Used a Chrome Zero-Day for Global Spyware Attacks in 2024
In early 2024, a sophisticated cyber campaign, identified as Operation ForumTroll, exploited a Google Chrome zero-day vulnerability to deploy spyware linked to Memento Labs, an Italian commercial surveillance vendor. Attackers leveraged previously unknown browser flaws to quietly infect targets’ systems, enabling unauthorized espionage and data exfiltration. The malware was distributed through malicious websites and fully bypassed standard security defenses. This campaign has drawn special attention due to Memento Labs’ history—emerging from the notorious Hacking Team’s acquisition by IntheCyber Group—and its potential targeting of high-value individuals and organizations. This incident underscores the persistent threat of zero-day attacks sponsored by private spyware vendors, and signals an ongoing trend in commoditized surveillance. The rise of commercial spyware and browser-based exploits increases regulatory scrutiny and highlights gaps in enterprise endpoint and data-in-transit security.
7 months ago
Kill Chain
Google Refutes False Gmail Breach Claims: 2024’s Disinformation Lessons
In June 2024, widespread news reports falsely claimed that Google suffered a massive Gmail data breach affecting 183 million accounts. These reports, originating from threat actors attempting to sell alleged stolen data, quickly circulated across media outlets and online forums. Google promptly denied these claims, confirming after internal and external investigations that no breach had occurred and user data remained secure. The incident stemmed from recycled or previously disclosed information being misrepresented as new, leading to confusion and unwarranted concern among users and industry observers. This incident underscores the growing prevalence of cybersecurity disinformation campaigns aiming to erode trust in major service providers. Such false claims can create unnecessary panic, damage reputations, and distract from real threats, emphasizing the urgent need for robust threat validation and information hygiene in the modern digital landscape.
7 months ago
Kill Chain
Operation ForumTroll 2025: Memento Labs Revives APT Espionage with Chrome 0-day
In March 2025, Kaspersky uncovered Operation ForumTroll, a sophisticated espionage campaign targeting Russian government agencies, critical institutions, and media organizations. The threat actors employed personalized spear-phishing emails carrying unique, short-lived links; merely visiting these sites using Chrome or Chromium-based browsers enabled a zero-day exploit (CVE-2025-2783) to escape the browser sandbox. The attackers established system persistence via COM hijacking, then operated stealthy malware—LeetAgent and the commercial Dante spyware, attributed to Memento Labs (formerly Hacking Team)—to exfiltrate sensitive files and credentials, while leveraging cloud infrastructure for their C2 communications and tool delivery. This campaign exemplifies a new wave of highly targeted, sophisticated APT activity leveraging commercial spyware and advanced zero-day exploitation. As browser vulnerabilities and commercial surveillance tools increasingly intersect, organizations must urgently review security for endpoints, threat detection, and privileged access to counter fast-evolving espionage operations.
7 months ago
Kill Chain
Prompt Injection Flaw in ChatGPT Atlas Browser Enables Hidden Command Execution
In October 2025, security researchers at NeuralTrust identified a prompt injection vulnerability in the newly launched OpenAI ChatGPT Atlas Browser, allowing attackers to disguise malicious prompts as benign URLs in the omnibox. The attack exploits how the omnibox interprets user input, confusing it as either a navigation destination or a natural-language command to the agent. Malicious actors can craft deceptive URLs that bypass basic user scrutiny and trigger hidden commands, exposing users to unauthorized actions, potential data leaks, and unintended system manipulations. OpenAI was notified and subsequently began working on mitigations to address this risk. This incident underscores a rising wave of sophisticated prompt injection attacks targeting AI-powered web interfaces. As AI tools become widely integrated in everyday applications, the attack surface expands, making seamless human-computer interactions susceptible to exploitation from both classic and emerging attack vectors.
7 months ago
Kill Chain
LockBit 5.0 Resurgence: How WSUS and F5 Vulnerabilities Fueled 2025's Biggest Ransomware Wave
In October 2025, a coordinated wave of cyberattacks struck major enterprise environments worldwide. Attackers exploited Windows Server Update Services (WSUS) flaws and vulnerabilities in F5 infrastructure, deploying the new LockBit 5.0 ransomware variant. Using phishing, unauthorized RDP access, and advanced persistence techniques, LockBit affiliates moved laterally across networks, encrypting critical data and disrupting cloud-hosted workloads. Compromised systems experienced operational downtime, data theft, and subsequent ransom demands, while threat actor activity on underground forums confirmed an aggressive resurgence and evolving TTPs. This incident underscores the heightened pace and sophistication of ransomware operations, with threat actors exploiting both zero-day vulnerabilities and supply chain channels. As enterprise defenses adapt to increasingly hybrid and distributed infrastructure, recent attacks have spotlighted urgent needs for segmentation, real-time visibility, and policy enforcement to counter proactive adversary tactics.
7 months ago
Kill Chain
ChatGPT Atlas Browser Hack Reveals Persistent AI Command Exploit
In October 2025, cybersecurity researchers revealed a critical vulnerability in OpenAI’s ChatGPT Atlas web browser, enabling attackers to plant persistent hidden commands within the AI assistant’s memory. Exploiting weaknesses in browser-based AI integration, adversaries were able to inject malicious code that allowed system compromise, privilege escalation, and malware deployment. This attack vector bypassed traditional security controls, proving effective in environments that heavily relied on browser AI plugins for business workflows. The exploit was notable for its ease of delivery through crafted websites or malicious scripts and posed significant operational and reputational risks to affected organizations. This incident underscores the urgent need for robust AI security governance as businesses rapidly integrate AI-powered tools into daily operations. The exploit spotlights a growing class of AI/ML-driven attacks leveraging browser interfaces, echoing wider industry concerns on shadow AI risks and prompting fresh regulatory scrutiny.
7 months ago
Kill Chain
Qilin Ransomware Surge (2025): Hybrid Linux Attacks and BYOVD Tactics Challenge Defenses
In early to mid-2025, the notorious Qilin ransomware group (also known as Agenda/Gold Feather/Water Galura) executed a wave of aggressive hybrid cyberattacks, combining Linux-targeting ransomware payloads with a sophisticated BYOVD (Bring Your Own Vulnerable Driver) exploit. The attacks leveraged unpatched vulnerabilities to gain initial access, followed by lateral movement across multi-cloud and on-premises environments. Once inside, Qilin deployed encryption routines across both Windows and Linux servers, exfiltrated sensitive business data, and posted victim details on its dark web leak site, with attack volumes peaking at over 100 cases in June 2025. Organizations across healthcare, finance, and manufacturing were among those affected, experiencing significant operational disruptions, data exposure risks, and costly recovery processes. The rise of cross-platform ransomware with BYOVD techniques demonstrates attackers' growing technical sophistication and ability to evade traditional defenses. As ransomware-as-a-service (RaaS) operations like Qilin accelerate, organizations face increasing regulatory scrutiny and must enhance cloud, endpoint, and network segmentation strategies to defend against such adaptive threats.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
