✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4717 to 4728 of 5297
Microsoft Shuts Down IE Mode After Zero-Day Exploit Exposes Legacy Risks
In August 2025, Microsoft responded to credible reports that unknown threat actors exploited Internet Explorer (IE) mode in the Edge browser. Attackers used a combination of unpatched (zero-day) JavaScript vulnerabilities and basic social engineering to compromise legacy IE mode, which allowed unauthorized access to Windows devices. The exploitation leveraged backward compatibility for legacy web apps, serving as an entry point for attackers to install persistent backdoors and potentially exfiltrate sensitive data. Microsoft swiftly revamped and locked down IE mode to prevent further abuse, minimizing ongoing risk and alerting organizations reliant on legacy web technologies. This incident underscores the persistent risks of maintaining backward compatibility for legacy browser features. As attackers increasingly target older components embedded within modern platforms, organizations face new urgency to accelerate deprecation plans and strengthen zero trust security controls.
7 months ago
Kill Chain
RondoDox Botnet 2025: Mass Exploitation Sheds Light on Multi-Vendor Security Gaps
In October 2025, security researchers uncovered a major campaign involving the RondoDox botnet, which rapidly weaponized over 50 vulnerabilities across more than 30 device vendors. The attack leveraged an "exploit shotgun" approach, targeting a vast range of internet-facing infrastructure including routers, DVRs, NVRs, CCTV systems, and web servers. Threat actors behind RondoDox employed automated scanning and exploitation, compromising vulnerable devices at scale for botnet expansion, distributed denial-of-service (DDoS) attacks, and potential further malicious activity. The operational impact included service degradation, widespread risk of breach propagation, and the exposure of inadequately secured assets across diverse environments. This incident highlights a surging trend in large-scale, opportunistic exploitation—where attackers rapidly integrate newly disclosed vulnerabilities into botnet tools. The scale and automation reflect the growing sophistication of threat actors, amplifying risks for businesses lagging in patch management and segmentation. Regulatory scrutiny is intensifying as such campaigns threaten critical infrastructure and data security.
7 months ago
Kill Chain
2025 Mega-Breach: WhatsApp Worm & Oracle 0-Day Power Ransomware Cartel Campaign
In October 2025, a sophisticated international cybercriminal cartel launched a coordinated multi-vector campaign targeting organizations worldwide. The attackers leveraged a newly discovered zero-day vulnerability in Oracle middleware, chaining it with several critical CVEs and a rapidly spreading WhatsApp worm. Lateral movement was facilitated via unprotected east-west traffic and credential theft, allowing rapid compromise of hybrid cloud environments and on-premises resources. The impact included ransomware deployment, data exfiltration, and significant operational disruptions across sectors such as finance, healthcare, and technology. This incident highlights the unsettling trend of threat actors collaboratively exploiting multiple weaknesses—including unpatched systems, misconfigurations, and trusted collaboration tools—to bypass traditional defenses. The convergence of wormable malware, supply chain vulnerabilities, and ransomware-as-a-service underscores the necessity for adaptive security and real-time threat detection.
7 months ago
Kill Chain
TA585’s MonsterV2: Unveiling 2025’s Next-Gen Phishing Infostealer Threat
In October 2025, cybersecurity researchers uncovered new activities by the previously undocumented threat actor TA585, which was observed conducting sophisticated phishing attacks to deliver the MonsterV2 infostealer malware. The group leveraged advanced tactics, including web injections and traffic filtering, to evade detection and ensure payload delivery. Once deployed, MonsterV2 enabled TA585 to harvest sensitive information and credentials, posing significant risks to organizational data integrity and confidentiality. The attack chains exploited weaknesses in email security and endpoint controls, demonstrating a concerning evolution in social engineering and malware delivery. This incident highlights the growing prevalence of stealthy infostealer campaigns targeting enterprises across multiple sectors. It underscores the urgent need for organizations to reevaluate network segmentation, multi-cloud visibility, and anomaly detection strategies to counter increasingly capable threat actors and align with evolving compliance standards.
7 months ago
Kill Chain
How Malicious Open Source Packages Used Discord to Breach Developer Supply Chains in 2025
In October 2025, security researchers uncovered a widespread supply chain attack targeting popular open source repositories—including npm, PyPI, and RubyGems. Malicious packages were uploaded to these ecosystems and leveraged Discord webhooks as a covert command-and-control (C2) channel to exfiltrate sensitive developer data upon installation. The attackers took advantage of the ease of publishing code to open source registries, embedding scripts that silently siphoned credentials, environment variables, and other project secrets. Dozens of projects and potentially thousands of developers or organizations were impacted, risking further compromise via credential leakage and downstream dependency poisoning. This incident underscores the urgency of enforcing robust dependency hygiene and highlights a rising trend: attackers increasingly abusing trusted supply chains and common collaboration tools for exfiltration. As open source usage soars and supply chain security intensifies, organizations must be vigilant against covert exfiltration methods and adopt multilayered security controls.
7 months ago
Kill Chain
Pixnapping: The Android Flaw Allowing Rogue Apps to Bypass 2FA Security (2025 Breach Analysis)
In October 2025, security researchers from the University of California, Berkeley, uncovered a critical vulnerability affecting Google and Samsung Android devices. The flaw, dubbed "Pixnapping," enables malicious apps to perform pixel-by-pixel side-channel attacks, covertly extracting two-factor authentication (2FA) codes, mapping data (such as Google Maps timelines), and other sensitive on-screen information—all without any special permissions or user awareness. Threat actors can exploit this vulnerability by luring users into installing rogue apps, ultimately undermining common security practices that rely on device or app isolation to keep critical data secure. This incident highlights an increasing trend of advanced side-channel techniques targeting mobile devices, even in environments with strict permission models. As mobile malware continues to evolve, organizations and individuals must stay vigilant, adapt security controls, and reevaluate the effectiveness of current detection and segmentation approaches to safeguard sensitive data.
7 months ago
Kill Chain
AMD RMPocalypse: 2025 SEV-SNP Hardware Flaw Shakes Confidential Computing
In October 2025, researchers from ETH Zürich disclosed a critical vulnerability, dubbed RMPocalypse, affecting AMD's Secure Encrypted Virtualization with Secure Nested Paging (SEV-SNP) technology. The flaw allowed attackers to undermine confidential computing protections by exploiting incomplete memory protections, making it feasible to alter a single 8-byte memory location and bypass hardware security boundaries. This discovery prompted AMD to release urgent patches across impacted EPYC server platforms, as the risk permitted threat actors—potentially including malicious tenants or insiders in cloud environments—to access sensitive workload data previously thought to be isolated and encrypted. This incident highlights persistent risks within hardware-assisted security frameworks and confidential computing platforms, as attackers increasingly target trusted execution environments. With a rise in high-confidence threats and supply-chain attacks, this breach sets a new precedent for cross-layer vulnerability research and the urgency of continuous hardware and firmware security validation.
7 months ago
Kill Chain
How Flax Typhoon Used ArcGIS Server as a Backdoor: 2025 Breach Breakdown
In mid-2025, threat intelligence researchers uncovered a year-long, state-sponsored attack committed by Chinese APT group Flax Typhoon (also known as Ethereal Panda/RedJuliett). The group exploited unpatched ArcGIS servers to establish persistent unauthorized access and covertly operated a backdoor for over twelve months. Using sophisticated techniques to evade detection and maintain long-term access, the attackers leveraged lateral movement and encrypted communication within targeted networks. The breach compromised sensitive data and potentially exposed critical infrastructure, highlighting a significant risk to affected organizations. This incident exemplifies a growing threat from well-resourced nation-state actors targeting enterprise geospatial systems, exploiting overlooked or under-patched software for initial entry. Attacks on infrastructure platforms are increasingly sophisticated, raising urgency for IT and security leaders to enhance detection, zero trust segmentation, and patch management programs in response to evolving APT campaigns.
7 months ago
Kill Chain
Critical SAP NetWeaver Zero-Day in 2025 Enables Unauthenticated Server Takeover
In October 2025, SAP disclosed and patched a critical zero-day vulnerability (CVE-2025-42944) in its NetWeaver Application Server Java platform, stemming from insecure deserialization. The vulnerability, rated CVSS 10.0, enabled unauthenticated remote attackers to execute arbitrary commands on affected servers, potentially compromising entire SAP landscapes. Though SAP issued urgent patches addressing 13 issues, the deserialization flaw was particularly notable for its potential to allow complete server takeover without credential access. Organizations were urged to deploy security updates immediately to prevent exploitation. This incident highlights the ongoing risk posed by deserialization vulnerabilities in widely deployed enterprise applications. As attackers accelerate exploitation of newly disclosed flaws, organizations must prioritize rapid patching, bolster application-layer controls, and monitor for lateral movement to mitigate the risk of business-critical system breaches.
7 months ago
Kill Chain
ICTBroadcast RCE Vulnerability: Hackers Gain Remote Shell Access via Cookie Exploit in 2025
In October 2025, a critical remote code execution vulnerability (CVE-2025-2611, CVSS 9.3) in ICTBroadcast's autodialer platform was actively exploited by threat actors. By leveraging improper input validation in the application's session cookie handler, attackers achieved unauthenticated remote shell access to internet-exposed servers. This exploit enabled malicious actors to execute arbitrary system commands, potentially compromising sensitive data and business operations for organizations using ICTBroadcast. The incident required immediate patching and forensic investigation to contain the breach and restore normal operations. This breach highlights the persistent risk posed by zero-day vulnerabilities in widely used communications software, especially as remote access vector attacks surge. It underscores the strategic shift among attackers toward supply chain and software-specific exploits, which remain difficult to rapidly mitigate across diverse deployment environments.
7 months ago
Kill Chain
Two CVSS 10.0 Flaws in Red Lion RTUs Expose Industrial Control Environments
In October 2025, two critical vulnerabilities (CVE-2023-40151 and CVE-2023-42770) were publicly disclosed in Red Lion Sixnet RTU devices, which are widely used for industrial automation and critical infrastructure. Both flaws received a CVSS 10.0 rating, underscoring their exploitability and impact. Attackers exploiting these vulnerabilities could achieve remote code execution with the highest privileges, granting them full control over affected devices. These RTUs are often deployed in energy, utilities, and manufacturing, raising concerns about the potential for business disruption, safety risks, and further attacks via compromised operational technology networks. This incident is particularly relevant as it highlights how legacy and specialized industrial control systems remain a prime target for threat actors leveraging zero-day vulnerabilities. The convergence of IT and OT, combined with growing regulatory scrutiny and an uptick in supply chain exposures, means that organizations must refocus on asset visibility and patch management for embedded and hard-to-update devices.
7 months ago
Kill Chain
Microsoft’s 2025 Windows Zero-Day Exploitation: What Every Enterprise Needs to Know
In October 2025, Microsoft revealed that two previously unknown zero-day vulnerabilities had been discovered and actively exploited in every supported and unsupported version of Windows, following its Patch Tuesday release. Attackers leveraged these unpatched flaws to compromise systems, facilitating unauthorized access and the potential for privilege escalation and lateral movement. The vulnerabilities affected both enterprise and consumer endpoints, raising concerns about widespread risk at a time when older Windows 10 systems reached end-of-support unless enrolled in paid extended coverage. This incident forced rapid emergency patch deployment and incident response in enterprises worldwide. This event underscores a rising trend in the exploitation of zero-day flaws in core operating systems, putting organizations under pressure to minimize their exposure and improve vulnerability and patch management. Regulatory scrutiny and increased attacker sophistication have elevated expectations for response times and organizational cyber resilience.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
