✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4753 to 4764 of 5297
131 Chrome Extensions Hijack WhatsApp Web: The 2025 Brazilian Spam Campaign
In October 2025, a coordinated cyberattack was uncovered where 131 malicious Chrome browser extensions—clones of a popular WhatsApp Web automation tool—were used to hijack users’ sessions and launch an automated spam campaign targeting Brazilian users. Researchers from security company Socket found that these plugins, sharing an identical codebase and infrastructure, infected over 20,000 users by enticing them to install seemingly legitimate add-ons, enabling attackers to take control of browser sessions, inject spam messages, and exfiltrate private data at scale. The incident underscores the risks associated with browser extension supply chain threats, exposing enterprises and individuals to large-scale account compromise and privacy breaches. This breach is particularly significant as it demonstrates the adaptability and persistence of threat actors in abusing browser supply routes and leveraging rebranded extensions to evade traditional security controls. The campaign’s targeting of WhatsApp Web also signals a shift toward exploiting widely-used communication channels for coordinated spam and fraud, spotlighting the critical need for proactive browser extension vetting and user awareness.
7 months ago
Kill Chain
ClickFix Copy/Paste Attacks: How Browser-Based Social Engineering Breached Enterprises in 2025
In October 2025, multiple organizations were impacted by the emerging 'ClickFix' attack trend, in which threat actors leveraged deceptive browser-based prompts (like fake CAPTCHAs or repair dialogs) to manipulate users into copy-pasting malicious code or credentials. These social engineering attacks typically bypassed standard email or endpoint security controls by exploiting a user's trust in solving browser-based challenges, resulting in credential compromise, unauthorized access, and subsequent lateral movement within enterprise environments. The attackers maintained persistence by mimicking legitimate error messages and encouraging users to interact further, drastically increasing the potential for data exfiltration and ransomware deployment. This breach highlights a surge in adversary-in-the-browser tactics, with copy/paste manipulation rapidly becoming a favored method among cybercriminals due to its high success rate and the minimal technical barriers for execution. The incident underscores the growing need for organizations to adopt advanced east-west traffic controls, enforce strong zero trust segmentation, and continually educate users about novel, non-traditional social engineering threats.
7 months ago
Kill Chain
The F5 2025 Multi-Vector Breach: A Wake-up Call for Hybrid Cloud Defense
In October 2025, F5 Networks experienced a sophisticated multi-vector cyber breach in which attackers gained undetected foothold within its environment for a prolonged period. The adversaries reportedly exploited a combination of Linux rootkits, encrypted traffic evasion, and a new attack method known as Pixnapping to laterally move between internal workloads and exfiltrate sensitive data. Their persistence was enabled by bypassing both east-west and egress security controls, leveraging cloud-native environments and covert remote access tools, before the intrusion was detected. Business operations were disrupted, and F5 initiated incident response and regulatory disclosures. This breach underscores the urgent reality that advanced attackers employ stealthy, multi-stage tactics, exploiting visibility gaps, lateral pathways, and cloud complexity. As such, it highlights the evolving need for proactive threat detection, zero trust segmentation, and continuous monitoring in today’s hybrid enterprise landscapes.
7 months ago
Kill Chain
Salt Typhoon Breaches European Telecom via Citrix Flaw and Snappybee Malware
In July 2025, a major European telecommunications provider suffered a targeted cyber espionage breach attributed to Salt Typhoon (aka Earth Estries), a suspected China-nexus group. Attackers exploited a vulnerability in a Citrix NetScaler Gateway appliance to gain initial access, then deployed the custom Snappybee malware for persistent network infiltration and surveillance. The operation allowed lateral movement across critical systems, putting sensitive customer and infrastructure data at risk. Timely detection by Darktrace helped contain the breach, but the incident highlights the telecom industry's growing exposure to sophisticated APT tactics and advanced malware. This breach exemplifies how state-aligned actors are exploiting enterprise VPN and appliance vulnerabilities for initial access, a recurring trend influencing regulatory scrutiny and CISO priorities. Telecom providers remain high-value targets due to their access to critical national infrastructure and vast troves of sensitive data.
7 months ago
Kill Chain
Oracle E-Business Suite Vulnerability Breach: CVE-2025-61884 Exploited in Active Attacks
In October 2025, attackers exploited CVE-2025-61884, a critical vulnerability in Oracle E-Business Suite (EBS), enabling unauthorized remote access and manipulation of sensitive enterprise data. The breach surfaced after CISA added the flaw to its Known Exploited Vulnerabilities Catalog, confirming active exploitation in the wild. Adversaries leveraged the unpatched vulnerability to gain foothold in targeted organizations, potentially leading to data theft, operational disruption, and exposure of personal and financial information stored within Oracle EBS environments. Remediation required immediate patching and review of east-west traffic alongside network segmentation measures. This incident underscores the steady targeting of enterprise SaaS platforms via zero-day and n-day flaws, and the increasing urgency for organizations to rapidly address vulnerabilities as soon as they are disclosed. With threat actors now weaponizing newly published vulnerabilities at an accelerated pace, organizations face renewed regulatory and business pressures to align with security best practices and compliance mandates.
7 months ago
Kill Chain
Google Uncovers Rapidly Evolving COLDRIVER Malware Campaigns in 2025
In May 2025, Google’s Threat Intelligence Group (GTIG) identified a surge in new malware developed by the Russian state-sponsored hacking group COLDRIVER (also known as Callisto or SEABORGIUM). In rapid succession, three new malware families were discovered, each demonstrating increased sophistication and frequent code variations. The attackers leveraged targeted spear-phishing campaigns to compromise government, defense, and policy sector targets across Europe and North America. The swift adaptation and deployment of these malware strains highlight COLDRIVER’s evolving tradecraft and acceleration of offensive cyber operations, posing heightened risks to sensitive data and infrastructure. This campaign signals a broader trend of rapidly evolving Russian cyber-espionage efforts against Western entities. The increased pace, tooling variation, and focus on intelligence collection underline the critical need for organizations to upgrade monitoring, segmentation, and encryption controls across hybrid cloud and on-prem networks.
7 months ago
Kill Chain
PolarEdge Botnet Targets Cisco, ASUS, QNAP, Synology Routers in 2025 Operation
In February 2025, security researchers uncovered a sophisticated botnet campaign dubbed PolarEdge, targeting router devices produced by Cisco, ASUS, QNAP, and Synology. The attackers leverage a custom TLS-based ELF implant to compromise home and enterprise routers, enlisting them into an expanding botnet. Initial infection vectors are believed to exploit known and zero-day vulnerabilities in router firmware, granting the threat actors persistent access and control over thousands of devices globally. The current purpose of the PolarEdge botnet remains undetermined, but activity suggests ongoing monitoring, traffic manipulation, and possible lateral movement within affected networks. Organizations with exposed or outdated devices face heightened operational risk, including surveillance, DDoS, and data interception. This incident underscores the growing menace of router-based botnets leveraging encrypted payloads and advanced evasion techniques. With a surge in attacks on network edge hardware and the proliferation of Internet of Things (IoT) devices, organizations must prioritize firmware patching, network segmentation, and comprehensive threat detection to mitigate emerging risks.
7 months ago
Kill Chain
Inside the Synthient Stealer Log Threat Data: 2025's Monumental Infostealer Breach
In late 2025, a vast dataset known as the 'Synthient Stealer Log Threat Data' surfaced, aggregating over 3.5 terabytes and 23 billion rows of stolen credentials and website entries collected from infostealer malware and credential stuffing campaigns. This dataset comprised logs exfiltrated via platforms like Telegram, social media, and dark web forums, predominantly sourced from malware-infected endpoints. Analysis revealed 183 million unique email addresses, with over 8% never before seen in data breach collections, confirming both scale and uniqueness. The data's authenticity was validated through subscriber checks and corroborating evidence from exposed accounts. This incident underscores the escalating risks posed by mass infostealer malware campaigns, highlighting their ability to industrialize credential theft and rapidly distribute sensitive personal data. As attackers continuously refine malware arsenals and leverage broader distribution networks, organizations and individuals must act urgently to address credential reuse, enhance detection, and mitigate lateral movement threats.
7 months ago
Kill Chain
US Court Bars NSO Group from Targeting WhatsApp Users with Spyware
In June 2024, a U.S. federal judge issued a permanent injunction against NSO Group, prohibiting the Israeli spyware developer from targeting WhatsApp users with its surveillance products. The case originated from a 2019 incident in which NSO Group exploited flaws in WhatsApp's messaging platform to compromise user privacy, prompting Meta (WhatsApp's parent company) to launch a protracted legal battle. The court recognized the significant risk posed to Meta's business and user trust, as WhatsApp's core value proposition is secure, end-to-end encrypted communications. The injunction was coupled with a major reduction in damages, from $167.3 million to $4 million, marking a significant legal precedent in the spyware industry. This decision highlights mounting regulatory and legal scrutiny on commercial spyware vendors and underscores the increasing stakes for companies offering encrypted services. The ruling signals judicial awareness of privacy threats from advanced surveillance tools and may embolden similar litigation or policy action worldwide.
7 months ago
Kill Chain
NSA-Linked Cyberattack Highlights Risks to China’s National Time Service Center (2023–2024)
Between March 2022 and June 2024, China’s National Time Service Center reportedly fell victim to a sophisticated cyber-espionage campaign allegedly orchestrated by the U.S. National Security Agency (NSA). Attackers initially compromised employee mobile devices via a text-messaging service vulnerability, leading to credential theft and enabling unauthorized access to the Center’s internal systems by April 2023. From August 2023 onward, the NSA purportedly leveraged a suite of 42 advanced cyber tools to target sensitive infrastructure, using VPNs and forged certificates to evade detection and bypass defenses. The attack put critical services at risk, with potential consequences including network disruption, financial system instability, and interruptions to vital communications and national defense functions. This incident underscores escalating nation-state cyber competition, especially over foundational infrastructure. The methods used—mobile device exploitation, lateral movement, and evasion through encrypted channels—reflect trending Tactics, Techniques, and Procedures (TTPs) in state-sponsored attacks, raising concerns for governments and critical sectors worldwide about supply chain and timing-related risks.
7 months ago
Kill Chain
Malicious OAuth Apps in Microsoft 365: A 2025 Cloud Identity Wake-Up Call
In October 2025, security researchers discovered widespread abuse of OAuth applications within Microsoft 365 environments, exposing tenants to covert identity compromise. Threat actors leveraged both legitimate and custom-built ("traitorware" and "stealthware") OAuth apps to establish persistent, unauthorized access by obtaining illicit consent to sensitive permissions, often evading detection for years. The incident, analyzed across 8,000+ organizations, revealed that nearly 10% had malicious or risky apps, often due to default configurations allowing broad consent and weak app governance, resulting in increased risk of credential theft, data exposure, and lateral movement. This incident underscores the growing threat of cloud identity attacks exploiting trusted cloud-native mechanisms like OAuth. As organizations accelerate Microsoft 365 adoption and attackers pivot to persistent, stealthy access models, regular auditing of app permissions and stronger identity threat detection become urgent priorities for reducing cloud risk.
7 months ago
Kill Chain
Microsoft Windows Smart Card Authentication Breakdowns After 2025 Security Update
In October 2025, Microsoft released security updates to address a cryptographic vulnerability (CVE-2024-30098) in Windows platforms, triggering widespread smart card authentication failures. The update, which altered default behavior from using CSP to KSP for RSA-based smart card certificates, disrupted authentication services across Windows 10, Windows 11, and Windows Server systems. Affected organizations reported issues such as failed logins, inability to sign documents, and critical service interruptions in workflows dependent on certificate-based authentication. The root cause was traced to a registry change designed to mitigate a feature bypass risk, inadvertently impacting legacy compatibility and 32-bit applications. This incident highlights how routine security hardening can introduce substantial operational risk, particularly for enterprises relying on legacy authentication methods. As businesses continue their path to zero trust and increase dependency on certificate-based systems, compatibility breakdowns following security improvements are becoming more prominent, amplifying pressures for comprehensive testing and rapid response strategies.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
