✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5113 to 5124 of 5299
ShadowLeak: Zero-Click OpenAI ChatGPT Bug Exposes Gmail Data in 2025
In June 2025, a critical zero-click vulnerability, codenamed ShadowLeak, was discovered in OpenAI ChatGPT’s Deep Research agent. This flaw enabled attackers to exfiltrate sensitive Gmail inbox content merely by sending a specially crafted email to victims using the agent, requiring no user action. Security researchers from Radware, after identifying the issue, disclosed it responsibly to OpenAI, which released a fix in early August 2025. The flaw had the potential to compromise confidential data across enterprise and personal Gmail accounts, raising major concerns around AI-driven integrations and email ecosystem security. This breach highlights the accelerating convergence of artificial intelligence with traditional email attack surfaces, raising unique risks around invisible, automated threat vectors. With GenAI agents increasingly embedded into communication flows, attackers are rapidly adapting zero-click tactics to exploit new behaviors and trust assumptions.
7 months ago
Kill Chain
MalTerminal: GPT-4-Powered Malware Signals New Era of AI Cyberattacks
In September 2025, SentinelOne’s SentinelLABS revealed the existence of 'MalTerminal,' the first documented malware leveraging GPT-4-powered Large Language Model (LLM) capabilities. Demonstrated at LABScon 2025, MalTerminal introduces LLM-driven automation within the malware lifecycle—enabling it to generate ransomware payloads, establish reverse shells, and craft social engineering content in real time. The attack method shows that malware authors are blending AI models directly into code to rapidly escalate privilege, automate lateral movement, and obfuscate command-and-control traffic. Business impact includes advanced, adaptive attacks that defeat legacy detection, heightening risks of data exfiltration, extended dwell time, and operational disruption. MalTerminal’s emergence is a bellwether for the rapid weaponization of generative AI technology by threat actors. This incident highlights the urgent need for organizations to re-evaluate traditional controls and accelerate adoption of cognitive security, visibility, and real-time policy enforcement frameworks to keep pace with evolving adversary techniques.
7 months ago
Kill Chain
LastPass Exposes macOS Atomic Infostealer Attack via Fake GitHub Repositories
In mid-2025, LastPass identified and warned users about a sophisticated information-stealing campaign targeting Apple macOS users. Attackers set up fraudulent GitHub repositories impersonating reputable projects, including LastPass, to distribute versions of the 'Atomic' infostealer malware. Unsuspecting users downloading these fake tools had their credentials, browser data, and sensitive files compromised. The campaign leveraged social engineering, search poisoning, and open-source developer trust to infiltrate victims’ systems, posing significant risk to both individual and enterprise security. The incident highlights continued abuse of trusted development platforms to target the software supply chain. This breach is noteworthy as it reflects the growing trend of attacker focus on macOS endpoints and the exploitation of open-source ecosystems. With supply chain attacks and infostealer campaigns rising sharply in 2025, organizations face increasing pressure to enhance their controls for code provenance, user awareness, and endpoint defense.
7 months ago
Kill Chain
How 'ShadowLeak' Turned ChatGPT into a Data Exfiltration Channel
In mid-2024, security researchers uncovered a novel cyberattack—dubbed 'ShadowLeak'—that exploits OpenAI’s ChatGPT platform to surreptitiously exfiltrate emails and sensitive enterprise data. Threat actors leveraged covert techniques to route data through OpenAI’s infrastructure, effectively bypassing traditional network security controls and leaving virtually no forensic traces within the victim organization. The attack exploits the trusted status of sanctioned AI platforms inside corporate environments, making malicious exfiltration activity blend in with legitimate AI-assisted workflow traffic. As a result, internal monitoring and traditional DLP tools fail to identify or intercept the breach, putting confidential business communications and data at risk. This incident spotlights the growing risk posed by increasingly sophisticated methods of data exfiltration over legitimate AI services. With organizations accelerating the adoption of generative AI in critical business processes, attackers are exploiting technical and policy blind spots, making traditional perimeter defenses inadequate against such stealthy insider threats.
7 months ago
Kill Chain
Critical Fortra GoAnywhere 2025 Vulnerability Enables Command Injection Attacks
In early June 2025, Fortra disclosed a critical command injection vulnerability (CVE-2025-10035) in its GoAnywhere managed file transfer (MFT) solution. The flaw could be exploited by unauthenticated attackers if the management interface was exposed to the Internet, allowing remote code execution and potential takeover of affected servers. Fortra warned that active exploitation had been observed, and threat actors were leveraging the vulnerability to move laterally within compromised networks and facilitate data exfiltration. The incident affected a broad range of organizations reliant on GoAnywhere for secure file transfers, raising concerns about operational continuity and potential data exposure. The attack underscores the ongoing risk posed by internet-exposed enterprise services and highlights the urgent need for timely patching of high-severity vulnerabilities. Increasingly, ransomware and data theft campaigns are targeting known security flaws in widely-used third-party solutions, putting supply chains and regulatory compliance at risk.
7 months ago
Kill Chain
AI Supercharges Ransomware: SMBs Face New Extortion Tactics in 2024
In early 2024, small and medium-sized businesses (SMBs) experienced a significant surge in ransomware attacks, with threat actors leveraging AI-driven tools to automate reconnaissance, exploit vulnerabilities, and escalate extortion tactics. Attackers typically gained initial access through phishing emails, credential compromise from infostealer malware, or unpatched systems, then deployed dual-pronged ransomware campaigns involving both data encryption and data theft for double extortion. These incidents were characterized by rapidly evolving tactics, including deployment of 'EDR killer' malware to neutralize security controls and the emergence of AI-powered ransomware strains like PromptLock, further complicating incident recovery. Businesses reported severe operational disruptions, permanent data loss, and in some cases, closure due to the financial and reputational fallout. The proliferation of ransomware-as-a-service (RaaS), combined with AI-enabled attack chains, has dramatically widened the threat landscape for SMBs—who account for nearly 9 in 10 ransomware breaches. The current wave highlights the urgent need for organizations of all sizes to revisit their defensive posture, ensure visibility, and adopt zero trust and modern detection solutions to mitigate evolving risks.
7 months ago
Kill Chain
Gamaredon & Turla: Joint APT Campaign Strikes Ukraine in 2025
In early 2025, a previously unseen collaboration between advanced persistent threat groups Gamaredon and Turla was discovered in Ukraine. Utilizing ESET telemetry, researchers identified co-compromises in which Gamaredon provided initial access using spearphishing and malicious PowerShell-based tools (such as PteroGraphin and PteroOdd), allowing Turla to deploy its exclusive Kazuar backdoor on select high-value targets. The attacks, attributed to Russian FSB-linked groups, targeted governmental entities and leveraged encrypted channels, PowerShell scripting, and multi-stage malware delivery via compromised web services and cloud platforms. Impact was mainly concentrated on the potential exfiltration of sensitive national intelligence. This incident underscores a growing trend of threat actor collaboration within nation-state cyber operations, blurring lines between operational roles and increasing attack efficiency. The overlapping TTPs and use of novel access and persistence mechanisms signal heightened complexity in the Eastern European threat landscape, demanding urgent operational and strategic defensive improvements.
7 months ago
Kill Chain
GoAnywhere 2025: Maximum-Severity Vulnerability Spurs Ransomware Fears Globally
In September 2025, a critical vulnerability (CVE-2025-10035) was disclosed in Fortra's GoAnywhere Managed File Transfer (MFT) service, exposing over 3,000 organizations, including major Fortune 500 companies, to significant risk. The flaw, a maximum-severity deserialization bug requiring no authentication, allows remote attackers to gain unauthorized code execution by leveraging a crafted license response signature. While no exploitation was detected at the time of disclosure, researchers warn that ransomware groups—such as Clop, known for previously targeting file-transfer software—are likely to attempt mass exploitation based on past patterns and the high impact of this vulnerability. If exploited, this flaw could result in widespread data theft, business disruption, and regulatory penalties. This incident is especially important as it mirrors techniques used in highly publicized attacks on file-transfer applications, highlighting increased sophistication and urgency among ransomware operators. The ongoing evolution of such vulnerabilities amplifies the threat to critical data flows and underscores rising compliance and zero trust enforcement needs across enterprises.
7 months ago
Kill Chain
ICS Malware Attacks Spike in Q2 2025: Key Lessons for Industrial Automation Security
In Q2 2025, industrial automation systems worldwide experienced significant and persistent threats, with 20.5% of ICS (Industrial Control Systems) computers encountering malicious objects, despite a slight quarterly decrease. Attackers leveraged a multi-stage campaign, beginning with phishing emails and malicious documents to gain access, and subsequently deploying next-stage malware such as spyware, ransomware, and cryptominers. Regions like Africa and sectors such as biometrics were among the most targeted, while common initial infection sources included malicious internet resources, infected emails, and removable media devices. Multiple sophisticated malware families (over 10,000 variants) exploited ICS security gaps to enable lateral movement, persistent access, and data exfiltration, impacting operational resilience and increasing risk of service disruption for critical industries. This incident underscores the continued evolution of ICS-targeting malware and the increasing sophistication of attack vectors in the operational technology sector. The upward trend in email-based infiltration and malicious cloud links, coupled with persistent use of multi-stage payloads, highlights the urgent need for robust, layered security, Zero Trust policies, and compliance alignment to protect critical infrastructure environments against both commodity and targeted threats.
7 months ago
Kill Chain
CISA Warning: Malware Exploits Ivanti EPMM Vulnerabilities in 2025 Breach
In September 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) disclosed the discovery of two new malware strains that exploited critical zero-day vulnerabilities (CVE-2025-4427, CVE-2025-4428) in Ivanti Endpoint Manager Mobile (EPMM). Threat actors breached an unnamed organization’s EPMM server, deploying custom loader malware which enabled remote code execution and persistent control over the compromised environment. The attack leveraged unpatched flaws to bypass network and application controls, potentially exposing sensitive enterprise and mobile device data, and allowing attackers to pivot deeper within the victim’s infrastructure. This incident highlights a rising trend in sophisticated exploitation of mobile device management (MDM) platforms and underscores the growing risk posed by supply chain attacks, advanced malware loaders, and rapid weaponization of newly disclosed vulnerabilities. Security teams must act swiftly as threat actors increasingly target widely deployed IT infrastructure software with automated, multi-stage campaigns.
7 months ago
Kill Chain
Teen Hackers Arrested for Scattered Spider Cyber Attack on TfL in 2024
In August 2024, Transport for London (TfL) experienced a cyber attack attributed to teen members of the Scattered Spider hacking group, known for leveraging social engineering and identity compromise. Attackers allegedly gained access to internal systems, disrupting service operations and putting critical transport and passenger information at risk. U.K. authorities arrested Thalha Jubair (19) and Owen Flowers (18) in September 2024 for their involvement, underlining the rapid evolution of cybercriminal tactics and the challenge of securing public infrastructure. This incident is a prime example of increasingly sophisticated attacks leveraging compromised credentials and insider tactics, even involving younger threat actors. It highlights both the threat to public services and the urgency for robust Zero Trust controls amid a landscape of rising identity-driven intrusions.
7 months ago
Kill Chain
Russian APTs Gamaredon and Turla Join Forces: Kazuar Backdoor Attack on Ukraine (2025)
In February 2025, cybersecurity researchers observed a coordinated attack on Ukrainian organizations involving collaboration between Russian APT groups Gamaredon and Turla. Utilizing tools such as PteroGraphin and PteroOdd, Gamaredon gained initial access and facilitated the deployment of Turla’s advanced Kazuar backdoor onto a compromised Ukrainian endpoint. This multi-stage intrusion enabled persistent remote access and potential data exfiltration, underscoring a notable escalation in Russian state-sponsored cyber tactics, as adversaries actively combined resources and malware capabilities to maximize operational impact. The attack targeted sensitive Ukrainian infrastructure, heightening concerns over the defense of critical systems. This incident exemplifies the increasing integration and sophistication among nation-state threat actors, specifically through sharing or chaining malware tools for greater effect. The cooperative tactics and advanced persistence mechanisms highlight the evolving threat landscape and emphasize the urgency for enhanced east-west traffic security, zero trust segmentation, and anomaly detection across critical sectors.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
