✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4813 to 4824 of 5297
PhantomVAI Loader in 2024: Advanced Malware Delivery and Infostealer Risks
In early 2024, cybersecurity researchers at Palo Alto Networks Unit 42 identified PhantomVAI, a new loader malware designed to deliver a variety of infostealers such as Lumma Stealer and LokiBot. The campaign uses advanced steganography and heavily obfuscated scripts to evade detection, enabling attackers to distribute payloads through malicious downloads and compromised websites. PhantomVAI’s modular design allows cybercriminals to easily switch the delivered malware, raising the risk for rapid adaptation against defense mechanisms. Affected organizations may experience credential compromise, data exfiltration, and exposure of sensitive information. This incident exemplifies the increasing sophistication of malware loaders and highlights a growing trend toward customizable, evasive attack tools targeting businesses worldwide. As attackers continue to automate and obfuscate their delivery methods, organizations must enhance their monitoring and threat detection to keep pace with evolving threats.
7 months ago
Kill Chain
Officials Dismantle Major Southeast Asia Cybercrime Network in $15B Bitcoin Seizure
In early 2024, federal authorities from the U.S. and U.K. conducted a large-scale operation against Southeast Asia cybercrime networks, seizing 127,271 Bitcoins worth approximately $15 billion from Chen Zhi, the alleged head of the Prince Group based in Cambodia. The Prince Group, operating since 2015, is accused of running transnational scam compounds utilizing human trafficking and forced labor to enact wide-reaching financial fraud across over 30 countries, including the U.S. where a Brooklyn network victimized more than 250 individuals. The operation resulted in sanctions on 146 people and organizations, the severing of Huione Group from the U.S. financial system, and the dismantling of 117 illicit Prince Group-affiliated businesses. This record-breaking crackdown underscores the severity and international scale of cyber-enabled financial fraud, money laundering, and the role of organized crime groups leveraging technology across borders. The incident highlights growing regulatory and enforcement focus, as well as the evolving threat posed by sophisticated scam and laundering operations exploiting multi-region financial networks.
7 months ago
Kill Chain
Microsoft Patch Tuesday: October 2025 Brings Critical Zero-Day Exploits
In October 2025, Microsoft disclosed and patched 175 vulnerabilities affecting its major products, marking the year's largest vulnerability release from the company. Notably, two zero-day vulnerabilities (CVE-2025-24990 in the Agere Windows Modem Driver and CVE-2025-59230 in Windows Remote Access Connection Manager) were discovered to be actively exploited in the wild. Attackers leveraging these flaws could elevate privileges, potentially gaining administrative or system-level access across all supported Windows versions. Microsoft acted promptly, removing the vulnerable modem driver and providing fixes for the Remote Access Connection Manager, with the U.S. Cybersecurity and Infrastructure Security Agency adding both zero-days to its known exploited catalog. This incident underscores the persistent threat posed by zero-day exploits and highlights the increasing rate at which attackers are targeting system-level services and third-party drivers. The surge of high-severity vulnerabilities, along with rapid exploitation, demonstrates the need for organizations to strengthen vulnerability and privilege management programs to respond to modern attack trends.
7 months ago
Kill Chain
Startling Satellite Breach: How $600 Unlocked a Global Data Leak in 2025
In early 2025, researchers from the University of Maryland and UC San Diego revealed widespread leakage of sensitive and private data—including military and telecom communications—through unencrypted transmissions sent over geostationary (GEO) satellites. By using only $600 in commercially available equipment, the team passively intercepted vast amounts of plaintext data from major organizations, government entities, and telecom users around the globe. The incident highlighted fundamental lapses in network-layer encryption practices, allowing phone calls, SMS messages, internal application data, and even military vessel information to leak with no authentication or protection. The research further demonstrated that even technically unsophisticated actors could compromise critical satellite backhaul links using minimal resources. This event underscores the urgent need for end-to-end encryption and robust monitoring of satellite communications as reliance on these channels increases and barriers to interception continue to fall. Government and industry must now address the rapidly evolving risk landscape, especially as critical infrastructure becomes more dependent on satellite connectivity.
7 months ago
Kill Chain
F5 2024 Breach: Nation-State Attack Highlights Supply Chain Risks
In June 2024, F5—a leading provider of application security and delivery products—disclosed a sophisticated cyberattack attributed to a nation-state actor. The breach was first discovered on August 9, 2023, and involved unauthorized, prolonged access to F5’s BIG-IP product development environment and its internal engineering knowledge platform. Although the attackers exfiltrated files containing segments of BIG-IP source code and limited customer configuration details, external forensic reviews confirmed no tampering with F5’s supply chain processes or build systems. No customer-facing platforms, including NGINX and Distributed Cloud Services, were affected, and the company found no evidence of critical vulnerabilities or malicious code insertion. This incident is particularly important due to increasing nation-state supply chain attacks targeting core infrastructure vendors. It highlights growing risks to software development environments and the potential cascade effects on enterprise and government clients dependent on widely used technologies.
7 months ago
Kill Chain
Chinese APT Exploits ArcGIS Tool for Stealthy Persistence and Credential Theft
In 2025, a Chinese state-sponsored Advanced Persistent Threat (APT) group, attributed to Flax Typhoon, maintained over a year of undetected access to an organization's network by exploiting a public-facing ArcGIS geo-mapping server. The attackers leveraged stolen administrator credentials to upload a malicious Java Server Object Extension (SOE) acting as a covert web shell, allowing them to execute commands via a REST API and escalate privileges internally. Persistence was further established by deploying SoftEther VPN Bridge, enabling encrypted outbound connectivity and facilitating lateral movement, data exfiltration, and credential harvesting within the victim's environment. This incident underscores the increasing sophistication of APTs exploiting legitimate third-party software and obscure admin features for stealthy, long-term persistence. The method's novelty, combined with highly targeted credential theft and the use of living-off-the-land techniques, highlights urgent gaps in detection, segmentation, and secure configuration, especially in public-facing or critical GIS applications.
7 months ago
Kill Chain
Framework’s 2025 Secure Boot Bypass: How Signed UEFI Debug Tools Created a Supply-Chain Crisis
In October 2025, firmware security researchers revealed a supply-chain vulnerability affecting nearly 200,000 Framework Linux laptops, caused by the inclusion of signed UEFI shells with the powerful 'mm' (memory modify) command. This legitimate but dangerous command, intended for hardware debugging, could be used by attackers with local or physical access to bypass Secure Boot by overwriting memory critical to the boot process—disabling signature verification and enabling the loading of bootkits like BlackLotus or HybridPetya. The issue was not the result of an external compromise but a manufacturing oversight, impacting several Framework 13 and Framework 16 models, with firmware updates and mitigation guidance swiftly issued. This vulnerability highlights a growing risk in hardware supply-chain security, where trusted vendor-signed components can inadvertently enable sophisticated attacks that persist even after OS reinstalls. As attackers increasingly target firmware and boot processes, the incident underscores the urgency for robust device-level and manufacturing-time security controls.
7 months ago
Kill Chain
Oracle EBS Zero-Day: How ShinyHunters and Clop Launched 2025's Most Notorious Data Extortion Attacks
In October 2025, Oracle silently released out-of-band patches for a critical zero-day vulnerability (CVE-2025-61884) in its E-Business Suite, following active exploitation by the ShinyHunters extortion group. The flaw allowed attackers to perform unauthenticated Server-Side Request Forgery (SSRF) and potentially remote code execution, leading to unauthorized access and data theft from affected servers. Clop ransomware actors also launched parallel extortion campaigns targeting Oracle EBS customers, leveraging separate yet related zero-day vulnerabilities to steal sensitive corporate data and demand ransom payments. Multiple exploits and proofs-of-concept were shared publicly, increasing organizational risk and pressure for rapid patching. This incident underscores the growing sophistication and collaboration among ransomware and extortion groups exploiting enterprise zero-day vulnerabilities for data theft and financial gain. The release and weaponization of public exploits highlight a rising trend of supply chain risk and the urgent need for continuous vulnerability management, proactive patching strategies, and advanced east-west traffic controls.
7 months ago
Kill Chain
US Seizes $15B in Crypto from Global 'Pig Butchering' Syndicate
In October 2025, the U.S. Department of Justice seized $15 billion in bitcoin from the leader of the Prince Group, a transnational criminal organization responsible for orchestrating large-scale cryptocurrency investment scams, widely known as 'pig butchering.' Operating from Cambodia since 2015, Prince Group exploited social media, dating apps, and messaging platforms to lure victims into fraudulent investment schemes, funneling billions via complex laundering tactics and a vast network of shell companies in over 30 countries. The syndicate trafficked and forced thousands into labor-intensive scam compounds, evading law enforcement and leveraging bribery, automated call centers, and violence. The stolen funds were laundered and spent on luxury assets and high-value goods. The Prince Group incident underscores the escalating threat of organized cyber-enabled financial fraud, particularly those leveraging cryptocurrency to obfuscate illicit gains. Despite large-scale law enforcement crackdowns, similar tactics—ranging from romance baiting to advanced obfuscation—have proliferated globally, highlighting persistent regulatory and security challenges for fintech and law enforcement agencies.
7 months ago
Kill Chain
Microsoft October 2025 Patch Tuesday: Six Zero-Days and 172 Vulnerabilities Addressed
In October 2025, Microsoft released security patches addressing 172 vulnerabilities across its product suite, including six actively-exploited zero-day flaws. These vulnerabilities exposed users to potential remote code execution, privilege escalation, and data leakage risks. The zero-days were exploited prior to patch release, affecting Windows, Office, and other core services. Security researchers and threat intelligence teams observed active exploitation in the wild, prompting urgent patching and incident response from enterprises globally. Microsoft’s rapid disclosure and remediation response helped to mitigate further threat actor activity and contain the immediate risk. The significance of this Patch Tuesday lies not only in the sheer number of vulnerabilities and zero-days but also in the increasing prevalence of opportunistic and targeted attacks against widely-used software. Organizations are under heightened pressure to maintain timely patch cycles, given growing regulatory scrutiny and sophisticated attacker TTPs.
7 months ago
Kill Chain
Pixnapping: The 2025 Android Vulnerability Stealing MFA Codes Pixel by Pixel
In October 2025, researchers unveiled a new Android vulnerability called 'Pixnapping,' enabling malicious applications with zero special permissions to exfiltrate sensitive screen data—such as multi-factor authentication (MFA) codes, chat messages, and emails—pixel by pixel via a GPU-based side-channel attack. The attack exploits the way Android's SurfaceFlinger composes app windows and leverages a graphics compression side-channel (GPU.zip) to reconstruct sensitive on-screen information. Pixnapping affects modern and fully patched Android 13–16 devices from Google and Samsung, and researchers demonstrated that 2FA codes could be exfiltrated in under 30 seconds, while more extensive data (such as chat logs) could be compromised within hours. Although Google attempted a patch in September, an effective fix is only expected in the December 2025 Android update, with GPU vendors yet to announce mitigation plans. This incident underscores a growing trend in side-channel and screen-based attacks, reflecting how even trusted software stacks and hardware abstraction layers can be used to bypass isolation. The Pixnapping method exposes the gaps in mobile OS zero-trust models—and with rising adoption of MFA and privacy-driven apps, the risk to enterprises and consumers is heightened.
7 months ago
Kill Chain
Malicious VSCode Extensions: TigerJack’s 2025 Supply Chain Attack on OpenVSX
In October 2025, the threat actor known as TigerJack resurfaced with a sophisticated supply chain attack targeting developer environments by publishing malicious Visual Studio Code (VSCode) extensions to both the official marketplace and the OpenVSX registry. Despite removal from the VSCode marketplace after 17,000 downloads, the extensions remained accessible on OpenVSX and continued to proliferate through renamed and republished versions. These extensions exfiltrated source code, ran unauthorized cryptocurrency miners, and enabled arbitrary remote code execution, greatly increasing the risk to individual developers and organizations relying on open-source tools. This incident highlights a rising trend of supply chain attacks targeting developer tools and open-source ecosystems, where trust in community-maintained registries is frequently exploited. With minimal oversight and delayed response from registry maintainers, businesses face a persistent risk of compromise through their software development pipelines.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
