✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4765 to 4776 of 5297
GlassWorm Supply Chain Malware: VS Code & OpenVSX Infected in 2025
In October 2025, a highly sophisticated supply chain attack involving the GlassWorm malware targeted developers via the OpenVSX and Microsoft Visual Studio Code (VS Code) extension marketplaces. Malicious actors inserted invisible Unicode characters into multiple popular extensions, enabling self-spreading malware to infect users without detection during automatic updates. GlassWorm stole credentials for developer services and cryptocurrency wallets, established remote access, and transformed compromised workstations into nodes within a broader criminal infrastructure. The malware leveraged blockchain (Solana) transactions, Google Calendar events, and distributed Peer-to-Peer protocols for resilient command-and-control, impacting at least 35,800 installations and keeping several malicious extensions available before remediation. This incident highlights the growing threat of self-propagating malware in software supply chains, especially via extension ecosystems critical to development workflows. Its combination of advanced evasion tactics, automated propagation, and leveraging of decentralized infrastructure sets a new precedent, signaling broader risks for organizations relying on trusted code repositories and accelerating regulatory and industry scrutiny on supply chain security.
7 months ago
Kill Chain
CVE-2025-33073: Windows SMB Zero-Day Highlights Risks of Privilege Escalation and Patch Gaps
In October 2025, threat actors began actively exploiting a high-severity privilege escalation vulnerability (CVE-2025-33073) in Windows SMB services, affecting Windows 10, Windows 11 (up to 24H2), and all supported Windows Server releases. The flaw, caused by improper access control in SMB, allows attackers to gain SYSTEM-level privileges by tricking victims into connecting to a malicious SMB server via a crafted script or application. With proof-of-concept details publicly available before Microsoft’s June 2025 patch, threat actors rapidly weaponized the exploit, prompting emergency guidance from CISA for federal agencies and warnings for all organizations to remediate immediately. This incident highlights renewed attacker focus on privilege escalation vectors and supply chain weaknesses in ubiquitous network protocols. The rapid exploitation window, following public disclosure but prior to broad patch deployment, underlines the need for continuous vulnerability management, robust segmentation, and vigilant detection of lateral movement.
7 months ago
Kill Chain
Over 75,000 WatchGuard Firebox VPN Devices Vulnerable to Critical RCE Flaw
In October 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-9242, was disclosed in WatchGuard Firebox network security appliances. Nearly 76,000 public-facing Firebox devices worldwide are exposed, primarily in the United States and Europe. The flaw resides in the Fireware OS 'iked' process, which handles IKEv2 VPN negotiations. Attackers can exploit the vulnerability without authentication by sending specially crafted IKEv2 packets, leading to out-of-bounds memory writes and potentially full device compromise. WatchGuard has issued patches, but thousands remain unprotected, as many affected devices run versions that are end-of-life or unpatched. This incident underscores a continuing trend of attackers targeting network infrastructure with VPN-centric vulnerabilities, particularly impacting organizations reliant on legacy or unpatched systems. The rise of critical edge device exploits heightens urgency for patching and proactive segmentation, especially as regulatory scrutiny around infrastructure security tightens.
7 months ago
Kill Chain
Muji Halts Online Sales After Supply Chain Ransomware Hits Logistics Partner
In June 2024, Japanese retail giant Muji was forced to suspend its online sales after a logistics outage caused by a ransomware attack on Askul, its major delivery partner. The incident was triggered when attackers compromised Askul's systems, encrypting critical operational data and disrupting supply chain operations. As a result, Muji's ability to fulfill customer orders was severely impacted, highlighting the downstream risk associated with third-party vendors in an interconnected retail ecosystem. This breach not only halted Muji's core e-commerce activities but also underscored the vulnerability of global supply chains to cyber extortion. This event is particularly relevant as ransomware groups increasingly leverage supply chain attacks to maximize disruption and extort multiple victims. It reflects a rapid evolution in attacker tactics, where targeting essential providers amplifies business risk, and regulatory scrutiny on supply chain resilience continues to intensify.
7 months ago
Kill Chain
Qantas 2024 Data Breach: Legal Orders Fail, Security Controls Critical
In early 2024, Qantas Airways experienced a significant data breach when cybercriminals exfiltrated sensitive passenger and employee information. Despite an Australian court issuing an injunction to prevent the distribution of stolen data, the responsible threat actors ignored the legal order and leaked the compromised datasets on the dark web. The breach was confirmed by multiple data breach notification services. Attackers leveraged unencrypted traffic vulnerabilities and lateral movement inside Qantas systems, bypassing internal controls and highlighting deficiencies in east-west traffic security and zero trust segmentation. Business operations faced regulatory pressure, reputational damage, and potential compliance issues. This incident underscores the difficulties organizations face in containing modern breaches, especially as legal measures alone cannot halt the distribution or misuse of exposed data. The continued release and trade of stolen datasets emphasize the importance of proactive technical controls and the need for robust, automated detection and data governance in line with evolving compliance standards.
7 months ago
Kill Chain
Linux Fileless Malware in 2024: Syscall(memfd_create) Unlocks New Attack Vectors
In October 2024, security researchers discovered a new Linux-targeting fileless malware that exploits Python and the direct use of syscalls—specifically 'memfd_create'—to execute payloads entirely in memory, bypassing traditional disk-based detection. The attack begins with a Python dropper embedding a base64-encoded ELF binary, which is loaded directly into memory using syscall(319), then executes file encryption using a simple 1-byte XOR key. While the second stage payload is rudimentary and appears to be a proof-of-concept, the methodology demonstrates how easily threat actors can evade filesystem-based controls and endpoint security tools on Linux systems. The incident underscores an increasing trend in fileless malware and direct syscall manipulation, especially on Linux servers and cloud workloads. These advanced tactics make traditional detection and prevention approaches less effective, urging organizations to adopt stronger memory and process monitoring, inline threat detection, and zero-trust segmentation to mitigate similar threats.
7 months ago
Kill Chain
Agentic AI's OODA Loop Vulnerability: Prompt Injection & Architecture Risks in 2025
In October 2025, a major vulnerability was revealed in agentic AI systems’ OODA (Observe, Orient, Decide, Act) decision loops, where adversaries exploited prompt injection, training data poisoning, and tool protocol confusion to compromise autonomous AI agents. Attackers planted triggers and malicious instructions in web-accessible content and tool descriptions, which were ingested by AI models, bypassing privilege separation and contaminating operational state and chat history. The incident resulted in persistent data leaks, unintentional tool actions, and the propagation of backdoors and compromised context across organizations deploying AI-driven automation and analytics. This exposure underscores a critical and growing risk: as organizations adopt increasingly autonomous AI, vulnerabilities related to data integrity, input trust, and OODA loop manipulation have escalated. Recent trends show surges in prompt injection exploits, AI-powered toolchain attacks, and regulatory focus on AI integrity controls, highlighting an urgent need for architectural reforms and robust zero trust measures.
7 months ago
Kill Chain
TikTok-Delivered Infostealer: ClickFix Campaign Compromises Credentials
In October 2025, a widespread campaign leveraged TikTok videos masquerading as free activation guides for popular software titles—including Windows, Adobe products, and Spotify—to distribute information-stealing malware. Attackers used "ClickFix" social engineering to instruct viewers to run obfuscated PowerShell commands, delivering the Aura Stealer infostealer and an additional payload via Cloudflare-hosted executables. The attack enabled threat actors to harvest browser credentials, authentication cookies, and wallet data from victims, leading to high risk of account compromise and data theft. Infection occurred after users were tricked into executing single-line commands under the guise of software activation or fixes. This incident highlights the increasing weaponization of social media platforms as initial access vectors for malware and demonstrates the growing sophistication of infostealer campaigns. The trend underscores the urgent need for organizations to address social engineering risks and update awareness programs as attackers rapidly innovate their distribution methods.
7 months ago
Kill Chain
Fake Homebrew and LogMeIn Sites Spread Infostealer Malware via Google Ads in 2025
In October 2025, a sophisticated malvertising campaign exploited Google Ads to distribute infostealing malware via fake Homebrew, LogMeIn, and TradingView websites targeting macOS users and developers. The threat actors registered over 85 convincing domains and lured victims to enter terminal commands that downloaded malware such as AMOS (Atomic macOS Stealer) and Odyssey Stealer. Once executed, these payloads bypassed security controls, harvested browser credentials, cryptocurrency wallets, and sensitive files, and forwarded the stolen data to threat actor-controlled servers. This campaign underscores the effectiveness of ClickFix social engineering techniques and highlights the risks of trust in search advertising. The incident is particularly relevant as infostealer malware continues to evolve with new tactics, including sophisticated social engineering, supply chain targeting, and persistent access capabilities. Organizations face increasing pressure to defend against rapidly shifting malware delivery channels and enforce user education to reduce the likelihood of compromise.
7 months ago
Kill Chain
Europol Takedown of SIMCARTEL: SIM Box Fraud Network Disrupted
In October 2024, Europol led a coordinated international operation to dismantle a sophisticated cybercrime syndicate known as "SIMCARTEL". This network, spanning Austria, Estonia, and Latvia, leveraged over 1,200 SIM box devices and 40,000 active SIM cards to conduct large-scale phishing, credential theft, and financial fraud across more than 3,200 recorded cases. Authorities linked the group to $5.8 million in financial losses, the creation of 49 million fraudulent accounts, and infrastructure facilitating criminal services in over 80 countries. The takedown resulted in seven arrests, seizure of servers, SIMs, websites, luxury vehicles, and the freezing of suspect assets. This incident highlights the growing global threat posed by SIM farms and SIM box networks, which enable scammers to evade detection, commit diverse types of fraud, and undermine trust in online communications. The rapid adoption of similar tactics worldwide puts financial institutions, telecoms, and consumers increasingly at risk.
7 months ago
Kill Chain
Iranian Nation-State Hackers Target John Bolton’s Email in 2021 Security Breach
In July 2021, former U.S. National Security Adviser John Bolton's personal email account was compromised by cyber actors believed to be linked to the Islamic Republic of Iran. The attackers gained unlawful access, extracted emails containing potentially sensitive information, and leveraged these materials to threaten and attempt to coerce Bolton, including by referencing classified content and threatening public disclosure. The FBI became aware when Bolton’s representative reported the intrusion and subsequent extortion attempts, with the threat actor referencing previous high-profile leaks to amplify pressure. It remains unclear if any sensitive materials were publicly disseminated, but the incident elevated concerns around the exposure of classified or sensitive government information through personal communication channels. This incident highlights a persistent risk from nation-state actors targeting senior government officials, leveraging cyber-intrusions for espionage and psychological operations. With the proliferation of similar tactics against political, governmental, and critical infrastructure targets globally, this attack reflects an urgent need for heightened security controls on personal communications of high-profile public figures.
7 months ago
Kill Chain
Sotheby’s 2025 Data Breach: Employee Financial Data Compromised
In July 2025, Sotheby's, the renowned international auction house, identified a significant cybersecurity breach in which an unknown threat actor exfiltrated sensitive employee information, including full names, Social Security numbers, and financial account details. The breach was discovered on July 24, 2025, and an internal investigation with data protection experts and law enforcement extended over two months to confirm the nature and scope of compromised data. Sotheby’s responded by notifying impacted employees and offering a year of free identity protection and credit monitoring services. No ransomware group claimed responsibility, and the number of affected individuals remains undisclosed. This incident underscores ongoing risks facing financial and high-value service sectors, especially from sophisticated attacks targeting personnel data for monetization and fraud. Organizations with sensitive employee or client financial data must act promptly as regulatory scrutiny tightens and attacks on high-net-worth entities continue to escalate.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
