✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5161 to 5172 of 5299
Fake Madgicx Plus & SocialMetrics Browser Extensions Hijack Meta Business Accounts in 2025
In September 2025, cybersecurity researchers reported a targeted infostealer campaign involving fake browser extensions, notably "Madgicx Plus" and "SocialMetrics Pro." Threat actors distributed these malicious extensions via malvertising and fraudulent websites, tricking users into installing them under the guise of gaining Meta Verified blue checkmarks on Facebook and Instagram. Once installed, the extensions stole business account credentials and session tokens, enabling attackers to hijack and monetize Meta Business accounts, potentially leading to widespread financial and reputational harm for affected organizations and individuals. This incident exemplifies the evolution of social engineering and supply-chain abuse targeting digital marketing and social media tools. The ongoing rise in sophisticated browser-based infostealers underscores the urgent need for organizations to monitor for fraudulent browser plugins, enforce software controls, and educate employees about new methods of business account compromise.
7 months ago
Kill Chain
Akira Ransomware Exploits SonicWall SSL VPN Flaw in 2025 – What You Need to Know
In late July 2025, threat actors affiliated with the Akira ransomware group launched a wave of attacks by exploiting a vulnerability and misconfigurations in SonicWall SSL VPN appliances. Cybersecurity firm Rapid7 reported a notable surge in intrusions targeting these devices, leveraging unsecured remote access pathways for initial compromise. Once inside, attackers escalated privileges, moved laterally, and deployed ransomware to encrypt critical data, causing extensive operational disruptions for affected organizations. The attacks highlighted gaps in east-west traffic monitoring, segmentation, and visibility, leaving many networks vulnerable to rapid malware spread and data loss. This breach underscores ongoing ransomware innovation and the persistent targeting of networking appliances as low-hanging fruit for initial access. It also reveals the increasing urgency for organizations to enforce zero trust network segmentation, proactively patch perimeter devices, and continuously monitor for anomalous access to defend against evolving ransomware threats and regulatory scrutiny.
7 months ago
Kill Chain
Active Exploitation of Critical CVE-2025-5086 in DELMIA Apriso Threatens Manufacturing Operations
In September 2025, a critical vulnerability (CVE-2025-5086, CVSS 9.0) in Dassault Systèmes DELMIA Apriso Manufacturing Operations Management software was found to be actively exploited in the wild. Threat actors leveraged this flaw to gain unauthorized access, bypassing authentication and executing arbitrary code on exposed systems. The breach impacted several manufacturing sector organizations globally, leading to disruptions in operational technology, potential data compromise, and urgent incident response actions. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) responded by adding the flaw to its Known Exploited Vulnerabilities (KEV) catalog and issuing public guidance for immediate patching and mitigation. This incident is significant as adversaries continue to target vulnerable OT/IoT platforms central to manufacturing operations. The increased frequency of high-severity vulnerabilities in critical infrastructure software, combined with rapid weaponization by threat actors, is driving regulatory scrutiny and highlighting the urgent need for robust vulnerability management and zero trust controls across industrial environments.
7 months ago
Kill Chain
HybridPetya: Ransomware That Bypasses UEFI Secure Boot with CVE-2024-7344
In September 2025, researchers at ESET identified a new ransomware variant named HybridPetya that combines destructive Petya/NotPetya traits with advanced UEFI attack capabilities. Leveraging the CVE-2024-7344 vulnerability, attackers were able to bypass UEFI Secure Boot, allowing the malware to execute at a privileged level prior to OS load. Initial infection vectors appear to include phishing emails and software supply-chain compromises, leading to widespread disruption of targeted organizations’ endpoints, encrypted data, and in some instances, bricked devices. The attack highlights a disturbing escalation in ransomware sophistication and targeting, with significant operational downtime and financial losses reported in affected sectors. HybridPetya represents an evolution in ransomware, merging firmware exploitation with traditional payload delivery to maximize impact. This incident underscores the expanding threat landscape as adversaries weaponize newly discovered vulnerabilities and aim higher up the trust chain, intensifying pressure on organizations to harden their endpoints and update defenses in real time.
7 months ago
Kill Chain
Apple Warns French Users of Fourth Major Spyware Campaign in 2025
In September 2025, Apple issued alerts to French users after identifying a sophisticated spyware campaign targeting their devices, marking the fourth such warning within the year. According to CERT-FR, the attack exploited vulnerabilities in Apple’s ecosystem—potentially via malicious links or zero-day exploits linked to iCloud accounts—allowing unauthorized surveillance and data exfiltration. The incident highlights persistent targeting of high-profile users in France, including journalists, activists, and officials, by advanced threat actors suspected to have nation-state-level capabilities. Impact includes compromised device privacy, risk of sensitive information leaks, and possible reputational harm to affected organizations. This incident underscores a worrying trend of recurrent, targeted campaigns using advanced spyware in Western Europe. The persistence of these attacks illustrates evolving threat actor sophistication and growing urgency for companies to strengthen device and network-level security, particularly as regulatory and public scrutiny intensifies.
7 months ago
Kill Chain
Samsung’s 2025 Critical Mobile Zero-Day: CVE-2025-21043 Exploited in the Wild
In September 2025, Samsung urgently patched a critical zero-day vulnerability (CVE-2025-21043) impacting its Android devices. The flaw, an out-of-bounds write in the libimagecodec.quram.so library, enabled remote attackers to execute arbitrary code on affected devices. This zero-day had been actively exploited in real-world attacks prior to disclosure and patch release, exposing millions of Galaxy smartphone users to the risk of compromise and potential data theft. Samsung responded by releasing its monthly security updates addressing the vulnerability before widespread exploitation could escalate. This incident underscores the persistent targeting of mobile platforms using advanced zero-day techniques, raising concerns for enterprises reliant on mobile endpoints. As threat actors innovate and focus on mobile ecosystems, rapid patch cycles and vigilant threat monitoring remain essential to protect against evolving exploitation methods.
7 months ago
Kill Chain
FBI Alert: UNC6040 & UNC6395 Target Salesforce in Sophisticated Data Theft and Extortion Attack
In mid-2025, the FBI issued a critical alert warning organizations about two cybercriminal groups, UNC6040 and UNC6395, conducting coordinated data theft and extortion attacks targeting enterprise Salesforce environments. Attackers leveraged multiple initial access vectors—believed to include credential compromise and social engineering—to infiltrate Salesforce platforms, exfiltrating sensitive data at scale. The breach campaigns led to severe business interruptions, reputational damage, and raised concerns over cloud infrastructure security, particularly in environments perceived as “well-defended.” FBI guidance included new indicators of compromise and proactive defense measures for cloud-hosted SaaS platforms. This incident marks a shift in threat actor focus toward high-value SaaS platforms, demonstrating the growing sophistication and persistence of financially-motivated attackers. It underscores the urgency for robust controls around identity, east-west traffic, and cloud-native visibility, as attack surfaces expand in digital-first enterprises.
7 months ago
Kill Chain
HiddenGh0st, Winos & kkRAT Malware: How SEO & Cloud Hosting Fueled a 2025 Chinese-Focused Attack
In September 2025, a sophisticated malware campaign targeted Chinese-speaking users through SEO poisoning and fake software sites, resulting in the widespread distribution of HiddenGh0st, Winos, and kkRAT malware. Attackers manipulated search results using SEO plugins, registered lookalike domains, and leveraged GitHub Pages to host malicious files. Unsuspecting users, believing they were downloading legitimate utilities, instead installed remote access trojans that enabled full compromise of their systems, data theft, and prolonged adversary presence. The campaign demonstrates coordinated threat actor use of both social engineering and modern cloud hosting platforms to bypass traditional security controls. This incident highlights an escalating trend of threat actors combining SEO manipulation with cloud-native infrastructure to launch convincing malware campaigns at scale. The use of popular developer tools like GitHub Pages for payload delivery complicates traditional egress controls, detection, and response, requiring organizations to bolster threat intelligence, web filtering, and zero-trust segmentation strategies.
7 months ago
Kill Chain
AI-Powered Villager Tool: How Cyberspike's PyPI Release Raised Global Supply-Chain Alarm
In 2025, a China-based group known as Cyberspike released an AI-powered penetration testing framework called 'Villager' on the Python Package Index (PyPI). Garnering nearly 11,000 downloads, Villager was marketed as a red teaming tool but drew significant attention after security researchers highlighted its dual-use potential for both legitimate and malicious activities. The framework’s advanced automation and stealth features make it attractive for attackers seeking to exploit software supply chains and pivot across cloud and hybrid environments, raising the risk profile for developers and organizations using open-source components. This incident underscores growing concerns about the unintended consequences of democratized offensive security tooling, particularly when distributed through popular code repositories. The rapid adoption and potential for supply-chain compromise highlight the urgency for heightened code vetting, continuous monitoring, and robust supply-chain security policies.
7 months ago
Kill Chain
Mass Browser-Based Attack Hits Enterprises: 2025’s Session Hijacking Wakeup Call
In August 2025, a sophisticated wave of browser-based attacks exploited vulnerabilities in popular browser components to hijack user sessions across multiple financial and technology firms simultaneously. Attackers leveraged phishing lures and malicious advertising to distribute payloads capable of intercepting authentication tokens and session cookies, enabling widespread unauthorized access. The campaign, attributed to a financially motivated eCrime group, enabled lateral movement within compromised cloud and SaaS applications, resulting in significant data exfiltration, temporary access loss, and incident-driven downtime for several affected organizations. This incident underscores a dramatic uptick in browser-native TTPs targeting identity, session integrity, and trusted cloud access. Threat actors are exploiting the growing reliance on web-based workflows and overlooked intra-browser security, making enhanced endpoint monitoring and Zero Trust controls more urgent than ever.
7 months ago
Kill Chain
Mustang Panda’s SnakeDisk USB Worm Targets Thailand: Advanced APT Breach Breakdown
In September 2025, cybersecurity analysts revealed that the China-aligned APT group Mustang Panda leveraged a novel USB worm dubbed SnakeDisk to target networks with Thailand-based IP addresses. The malware was specifically designed to execute only on devices with these geolocations, enabling highly targeted delivery of the TONESHELL loader and the Yokai backdoor. Attackers gained initial access through infected USB drives, allowing for stealthy lateral movement and installation of persistent remote access tools, posing risks to government, defense, and commercial operations in Thailand. The campaign’s use of an undocumented worm, encrypted command channels, and evasive tactics complicated detection and response efforts for affected organizations. This highly targeted operation demonstrates the continuous evolution of advanced persistent threat techniques, with regional targeting and removable media attacks making a significant comeback. The incident underscores the urgent need for robust east-west traffic controls, endpoint security, and focused detection in the face of increasingly sophisticated nation-state cyber campaigns.
7 months ago
Kill Chain
Self-Replicating Worm Strikes npm: 2025 Supply Chain Attack Exposes Critical Credential Risks
In September 2025, a major supply chain attack targeted the npm ecosystem, compromising over 40 packages and impacting projects worldwide. Attackers utilized a self-replicating worm delivered via manipulated npm modules; these modules would download, alter, and republish themselves by embedding malicious scripts directly into package files. As a result, sensitive developer credentials and system access tokens were harvested at scale, putting thousands of developer environments and downstream applications at risk, eroding trust in open-source software supply chains. This campaign highlights the growing risk and sophistication of supply chain attacks leveraging automated propagation across trusted developer channels. With the expanding reliance on open-source components and increasing regulatory scrutiny, organizations must urgently strengthen controls around development pipelines and dependency security.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
