✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5197 to 5208 of 5299
Raven Stealer Uses Telegram to Pilfer Chromium Data in 2024
In early 2024, security researchers identified a new infostealer variant, Raven Stealer, being distributed via underground forums and cracked software packages. The malware targets Windows systems and focuses on stealthy extraction of browser data, particularly from Chromium-based browsers such as Google Chrome. Once installed, Raven Stealer harvests credentials, cookies, browser histories, and cryptocurrency wallets before exfiltrating the data through encrypted Telegram channels. The attack exploits unmonitored endpoints and capitalizes on users’ download of pirated or repackaged software, resulting in widespread compromise of sensitive authentication data across multiple organizations. This incident underscores the ongoing evolution of commodity malware and demonstrates the sophistication with which even low-cost infostealers are leveraging encrypted communications and social engineering. As attackers continue to innovate with new TTPs and delivery vectors, organizations must strengthen endpoint monitoring and policy enforcement to reduce exposure to similar threats.
7 months ago
Kill Chain
Microsoft September 2025 Patch Tuesday: Critical Privilege Escalation Flaws Demand Immediate Action
In September 2025, Microsoft disclosed 81 security vulnerabilities across its portfolio, with a significant focus on escalation of privilege (EoP) flaws. Of the CVEs released, 38 enabled attackers to gain elevated access after initial compromise, affecting modules like SMB and NTLM. Notably, CVE-2025-55234 (SMB) and CVE-2025-54918 (NTLM)—both rated CVSS 8.8—were publicly known and considered high impact, allowing attackers to leverage relay and crafted packet attacks for system takeover. Additional critical vulnerabilities were identified in Windows UI XAML and HPC components. While no active exploitation was confirmed at release, the breadth of affected products and criticality prompted urgent patching recommendations. This wave of privilege escalation vulnerabilities underscores the ongoing risk posed by identity-based attacks and lateral movement, compelling organizations to accelerate patch deployment and strengthen segmentation controls. With the end-of-life of Windows 10 and expanded MFA mandates on the horizon, the incident reinforces the necessity for layered defenses and up-to-date asset management.
7 months ago
Kill Chain
K2 Think AI Model Jailbroken Within Hours of 2024 Release
On September 9, 2024, the UAE-backed 'K2 Think' large language model (LLM) was released with the goal of industry-leading transparent reasoning. Within hours, however, cybersecurity researchers discovered a critical vulnerability known as Partial Prompt Leakage. This flaw allowed adversaries to observe the model's internal logic in plain text, making it easier to methodically bypass safeguards and jailbreak the AI system. The exploit was demonstrated by researcher Alex Polyakov, who publicly documented how attackers could uncover and iterate against the model’s defenses, enabling harmful behaviors such as malware generation. The breach did not result in immediate large-scale misuse, but it revealed a key tradeoff between transparency and security in modern LLM development. This incident is emblematic of new AI security risks emerging as open, auditable models grow in popularity. It underscores the urgency for vendors to balance transparency with robust protection, as attackers quickly adapt to and exploit unique model features. With increased regulatory scrutiny and rising enthusiasm for open-source AI, safeguarding model reasoning is now a critical surface organizations cannot ignore.
7 months ago
Kill Chain
Lies-in-the-Loop: When AI Coding Agents Become Supply Chain Threats
In June 2024, researchers at Checkmarx Zero demonstrated a novel supply chain attack called 'Lies-in-the-Loop' (LITL) targeting AI-assisted coding agents, specifically Anthropic's Claude Code. By leveraging prompt injection, attackers manipulated the AI into concealing malicious code execution behind benign prompts, effectively tricking human operators into approving dangerous actions. The attack exploited trust in the 'human-in-the-loop' workflow, showing that malicious context within public resources like GitHub issues could hide remote code execution triggers. Successful exploitation enabled attackers to deploy arbitrary commands and potentially introduce malicious packages into software repositories, increasing the risk of downstream supply chain compromise. This incident highlights a concerning trend: as AI coding agents are rapidly adopted, their interfaces become a ripe target for adversaries using social engineering and prompt manipulation. The attack underscores the evolving sophistication of supply chain threats, especially those that blur the lines between human fallibility and machine autonomy in development environments.
7 months ago
Kill Chain
Vidar Infostealer Returns in 2024 with Stealthier Malware Campaigns
In June 2024, cybersecurity researchers observed a significant resurgence of the Vidar infostealer malware, marked by notable advancements in evasion and data exfiltration techniques. Vidar, which originated as a variant of Arkei and has remained active since 2018, now leverages encrypted command-and-control (C2) channels, sophisticated PowerShell-based delivery, and covert exfiltration methods to siphon credentials, cookies, authentication tokens, and sensitive financial information. The latest campaigns employ phishing, malvertising, and compromised websites as entry vectors. Tactics such as obfuscated PowerShell scripts, living-off-the-land binaries (LOLBins), Windows Defender exclusion manipulation, persistence via scheduled tasks, and exfiltration over TLS have enabled Vidar to bypass traditional detection controls and ensure lasting presence within infected enterprise and individual user environments. The rapid iteration and adaptability of Vidar reflect broader trends in malware-as-a-service (MaaS) operations—demonstrating how popular infostealers continually implement new stealth and evasion tactics. This highlights the urgent need for organizations to adopt layered security defenses and proactive threat detection, as infostealers like Vidar push the boundaries of stealth and data theft in an era of increasing hybrid work, regulatory scrutiny, and sophisticated social engineering.
7 months ago
Kill Chain
Critical Chaos Mesh Vulnerabilities Enable Kubernetes Cluster Takeover (2024)
In early June 2024, multiple critical vulnerabilities known collectively as "Chaotic Deputy" were disclosed in Chaos Mesh, a widely used open-source chaos engineering platform for Kubernetes. These bugs, including authentication bypass and privilege escalation flaws, allowed unauthorized attackers to obtain elevated access within Kubernetes clusters. Exploitation could lead to total cluster takeover, lateral movement, and the compromise of sensitive resources and data across affected environments. The disclosure prompted rapid patches from maintainers and advisories from security organizations and cloud providers due to the severe risk and broad adoption of Chaos Mesh in enterprise deployments. This incident highlights the increasing focus of attackers and researchers on the Kubernetes and supply chain ecosystem. With Kubernetes now foundational to cloud-native infrastructure, vulnerabilities in operational tools like Chaos Mesh underline the need for robust segmentation, continuous security monitoring, and timely patch management to protect against emerging threats to hybrid and multi-cloud environments.
7 months ago
Kill Chain
North Korean Kimsuky Leverages Deepfake Military IDs in Sophisticated Social Engineering Attack
In April 2024, threat group Kimsuky, attributed to North Korea, launched a cyberattack campaign targeting South Korean organizations using advanced social engineering tactics. The attackers exploited ChatGPT to generate sophisticated deepfake military ID documents, which were then used as bait to compromise targets via phishing emails and messaging apps. By mimicking authentic credentials, Kimsuky aimed to breach sensitive military and governmental networks, potentially facilitating credential harvesting and further lateral movement within critical infrastructures. This incident highlights the increasing convergence of generative AI and cyberattack techniques, making impersonation and credential-based attacks far more convincing and widespread. It underscores rising urgency for organizations to strengthen verification processes and stay vigilant against emerging deepfake-enabled attack vectors.
7 months ago
Kill Chain
SXVM Ransomware PoC Reveals Next-Gen DLL Unhooking to Bypass EDR
In September 2024, a novel ransomware proof-of-concept dubbed 'SXVM' showcased advanced defensive evasion capabilities through DLL unhooking, enabling it to bypass traditional endpoint detection and response (EDR) tools. The threat leverages in-memory manipulation to restore .text sections of key system DLLs—effectively undoing any hooks or software breakpoints set by debuggers and security products. This approach allows ransomware operators to conceal malicious actions and access powerful Windows APIs unchecked. While initial analysis points to a low detection rate and proof-of-concept status, the technique underscores an escalating trend in ransomware sophistication and anti-forensic tactics. This incident is especially relevant as ransomware variants increasingly adopt anti-debugging and anti-EDR methods. The widespread use of DLL unhooking signals a maturing threat landscape, where attackers are continuously innovating to defeat security controls and leverage memory-based evasion techniques.
7 months ago
Kill Chain
Code Assistant LLM Vulnerabilities Expose New AI Supply Chain Risks (2024)
In early 2024, multiple leading code assistant platforms powered by Large Language Models (LLMs) were found to be vulnerable to security threats such as indirect prompt injection, model misuse, and code suggestion manipulation. Attackers exploited weaknesses in prompt handling and insufficient contextual isolation, allowing harmful code or misleading content to be surfaced to end users and potentially exposing enterprise environments to supply chain risks. These risks highlight the growing attack surface in organizations leveraging AI-driven development tools, where impaired oversight can lead to deceptive or insecure code entering production systems. This incident underscores the urgency for enterprises to evaluate the deployment and integration practices for generative AI tools, particularly given the rapid rise in adoption and regulatory focus on AI safety. Attacker tactics are evolving quickly, and threat actors are increasingly targeting AI models and their usage contexts as a new cyber frontier.
7 months ago
Kill Chain
Q2 2025 Mobile Malware Surge: Mamont and Triada Lead Sophisticated Attacks
In Q2 2025, Kaspersky detected a substantial wave of mobile malware impacting Android and iOS, blocking 10.71 million attacks involving Trojans, adware, and unwanted applications. The campaign was notable for a surge in banking Trojans—primarily the Mamont family—pre-installed backdoors like Triada, and novel threats such as SparkKitty, which targets crypto wallet recovery codes via image theft. Attackers leveraged fake app stores, porn-viewing apps that secretly built DDoS botnets, and deceptive VPNs that intercepted OTP codes through notification hijacking. Regionalized attacks exploited localized malware families to increase efficacy and evade global threat visibility, raising risks for financial and privacy exposure worldwide. This incident highlights a persistent trend of increasingly sophisticated mobile threats focused on financial theft and data exfiltration. The continued evolution of malware TTPs, including use of pre-installed Trojans, modular SDK-based payloads, and cross-platform attack vectors, emphasizes the urgent need for advanced endpoint protection and vigilant detection routines in the mobile security domain.
7 months ago
Kill Chain
RevengeHotels 2025: AI-Fueled VenomRAT Breach Hits Hospitality Sector
In the summer of 2025, the RevengeHotels cybercrime group (also tracked as TA558) significantly escalated its campaigns targeting the hospitality sector across Latin America, especially Brazil. Leveraging large language models (LLMs) to dynamically generate phishing lures and scripted malware loaders, the attackers delivered new VenomRAT payloads via sophisticated, invoice-themed phishing emails. These emails led hotel staff to malicious websites that dropped JavaScript and PowerShell-based loaders, ultimately granting persistent remote access for data theft and lateral movement. The attack exploited evolving tactics such as anti-kill mechanisms, registry persistence, custom encryption, and use of AI-generated code to evade detection. This incident demonstrates a marked evolution in attacker methodology, combining commodity malware, AI-driven code generation, and targeted social engineering. Such developments highlight how AI is accelerating the sophistication and reach of cyber threats, particularly in sectors with high-value payment data and limited security resources.
7 months ago
Kill Chain
2025 Salesforce Data Breach: Supply Chain Extortion Hits Retail Sector
In mid-2025, a coordinated cybercriminal campaign led by UNC6395 and affiliates of Muddled Libra targeted Salesforce tenants via a multi-stage supply chain attack stemming from infiltrated third-party integrations such as Salesloft and Drift. Attackers used advanced social engineering and process exploitation rather than technological vulnerabilities to gain access to Salesforce customer data—including sensitive records like accounts, contacts, and opportunities. The operation highlighted the growing focus on data theft extortion tactics and the use of encrypted communications, with threat actors actively marketing stolen data through Telegram channels under monikers like "Scattered LAPSUS$ Hunters." The impact has been significant for retailers and digital platform users, driving urgent defensive and policy changes at Salesforce and affected enterprises. This incident underscores an accelerating threat shift in 2025: attackers are increasingly leveraging social engineering and the SaaS supply chain to circumvent traditional defenses, monetizing access through extortion rather than ransomware. The event has intensified industry efforts to tighten access controls and enforce encryption, amid persistent regulatory and law enforcement actions.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
