✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5281 to 5292 of 5322
Sitecore Vulnerabilities: Cache Poisoning and RCE Exploit Chain Uncovered (2025)
In August 2025, researchers disclosed an exploit chain in the Sitecore Experience Platform involving three newly uncovered vulnerabilities—CVE-2025-53693 (HTML cache poisoning), CVE-2025-53691 (remote code execution via insecure deserialization), and CVE-2025-53694 (not yet detailed). The flaws allow attackers to first poison cached content by manipulating reflected inputs, and then leverage insecure deserialization to remotely execute arbitrary code on targeted Sitecore servers. If exploited, these issues can expose sensitive data and potentially compromise the full web application environment of affected organizations, particularly in sectors relying on large-scale digital experience management. This incident highlights the persistent risk of chained application vulnerabilities enabling critical attacks, such as lateral movement and RCE, within enterprise environments. With web applications being frequent targets and exploit code often surfacing soon after disclosures, organizations must prioritize proactive vulnerability management and robust segmentation to contain blast radius.
7 months ago
Kill Chain
Attackers Exploit Velociraptor Forensics Tool for Covert C2 Tunneling With Visual Studio Code
In June 2025, cybersecurity researchers reported a sophisticated incident in which attackers abused the open-source forensic tool Velociraptor to deploy Visual Studio Code on compromised endpoints and establish an encrypted command-and-control (C2) channel. Threat actors leveraged the legitimate forensic software as a Living Off The Land Binary (LOLBin) to evade detection, achieve execution, and enable covert lateral movement within enterprise environments. This innovative TTP circumvented traditional perimeter detections, and resulted in unauthorized access to sensitive internal systems, raising concerns over the misuse of trusted IT tools in targeted intrusions and potential data exfiltration. The incident highlights a growing trend of blending legitimate IT and developer software within attack chains, making malicious activity harder to distinguish from normal operations. Organizations face increasing regulatory and operational pressure to implement robust east-west traffic monitoring, behavioral detection, and zero trust controls as attackers adopt stealthier methods.
7 months ago
Kill Chain
Amazon Stops APT29 Watering Hole Leverage of Microsoft Device Code
In August 2025, Amazon Security Intelligence teams detected and disrupted a sophisticated nation-state watering hole campaign attributed to the Russian-linked APT29 group. The attackers compromised multiple legitimate websites, redirecting unsuspecting visitors to malicious infrastructure designed to exploit Microsoft's device code authentication flow. By tricking users into authorizing attacker-controlled devices, APT29 was able to gain unauthorized access to victim accounts and sensitive data. The rapid response by Amazon limited the scope of the compromise, but the incident highlights evolving tactics by advanced persistent threats targeting cloud identity systems. This incident is notable for its exploitation of widely used authentication protocols and the opportunistic use of trusted websites for redirection. It reflects a broader escalation in targeted attacks on cloud identities and authentication flows, as well as the sophistication of nation-state threat actors seeking persistent access to corporate and government assets.
7 months ago
Kill Chain
Q2 2025 Vulnerability Exploitation: Multi-Platform Attacks and C2 Automation
In Q2 2025, there was a surge in the exploitation of both newly reported and longstanding software vulnerabilities across enterprise environments. Threat actors leveraged critical CVEs—targeting platforms like Microsoft Windows, Linux, document-editing suites, UEFI firmware, AI frameworks, and remote access tools—to gain initial access and escalate privileges on victim systems. Notably, advanced persistent threat (APT) groups demonstrated increased use of C2 frameworks such as Sliver, Metasploit, Havoc, and Brute Ratel to automate exploitation and maintain persistence, highlighting attackers’ growing sophistication and automation. The operational impact ranged from data theft and malware deployment to strategic risks, as attackers pivoted laterally and disabled security mechanisms. The Q2 2025 wave underscores a broader industry trend: attackers are rapidly exploiting both legacy and emerging weaknesses, especially as vulnerability disclosure volumes continue to rise. Automation within C2 frameworks and exploitation targeting multi-cloud and hybrid environments reinforce the urgency to modernize detection and patch-management programs to keep pace with evolving threats.
7 months ago
Kill Chain
Scattered Spider SIM-Swapping & Wire Fraud: Anatomy of a 2022 Corporate Breach
In 2022, a cybercriminal cell known as Scattered Spider orchestrated a widespread campaign of SIM-swapping and sophisticated social engineering attacks against major US companies. Led in part by 20-year-old Noah Michael Urban (alias "King Bob"), the group tricked mobile provider and corporate employees into divulging credentials and approving phishing requests, allowing attackers to hijack authentication flows and gain deep access to internal systems, including Okta and VPN platforms. Over several months, their schemes compromised more than 130 organizations—including Twilio, LastPass, DoorDash, and others—resulting in the theft of corporate and customer data, and millions in cryptocurrency. The operational impact included large-scale operational disruption and significant financial losses for victims. Scattered Spider’s tactics showed a fusion of SIM-swapping, credential phishing, and insider targeting that has reshaped industry concerns over identity-driven breaches and lateral movement. The group’s use of persistent social engineering, paired with technical exploitation, highlights the urgent need for organizations to strengthen multi-factor authentication, enforce Zero Trust principles, and adopt modern anomaly detection for internal east-west traffic.
7 months ago
Kill Chain
AI Turbocharges Exploit Development: Are You Ready for Machine-Speed Cyber Threats?
In mid-2024, two independent Israeli cybersecurity researchers developed an AI-powered system, "Auto Exploit," that can generate proof-of-concept exploit code for new vulnerabilities in as little as 15 minutes. Leveraging large language models like Anthropic's Claude and open-source LLMs, the system parses CVE advisories and code patches, quickly creating vulnerable test environments and customized exploit code. This approach successfully produced exploits for 14 open source software vulnerabilities, dramatically shortening the typical window for defenders to patch their systems before seeing exploitation in the wild. The project highlights the risk posed by adversaries who can now weaponize vulnerabilities and bypass LLM guardrails at machine speed, raising the stakes for enterprise security teams. As automation and AI further accelerate exploit development, organizations face increasing pressure to adapt their vulnerability management and incident response processes. The emergence of such techniques indicates a shift where traditional exploitability scoring is less relevant, and exposure of assets becomes the key risk consideration.
7 months ago
Kill Chain
Critical SAP S/4HANA Code Injection Vulnerability Exploited in 2025
In August 2025, a critical code injection vulnerability (CVE-2025-42957) in SAP S/4HANA was exploited in the wild, enabling attackers with even low-privileged user access to inject ABAP code and achieve full compromise of both the SAP environment and the underlying host OS. Publicly disclosed and patched by SAP in its August security updates, the flaw affects both private cloud and on-premise deployments. The exploit requires only a basic user account and a remote function call, after which attackers can manipulate or delete SAP data, create persistent admin backdoors, exfiltrate sensitive data, and control the OS. Exploitation attempts surged following patch publication, with confirmed abuse reported by specialist vendors. This incident highlights the increasing risk of low-complexity, high-impact ERP vulnerabilities, especially as attackers rapidly weaponize disclosed flaws. It underscores the continued targeting of critical business platforms by threat actors leveraging phishing and privileged escalation, emphasizing the urgent need for swift patching and stronger access controls.
7 months ago
Kill Chain
Session Hijacking and Browser Cookies: The State of Web App Security in 2024
In mid-2024, multiple web applications faced a surge in session hijacking incidents arising from insecure management of browser cookies. Attackers exploited weaknesses such as unencrypted HTTP traffic, poor cookie attributes, cross-site scripting (XSS), and predictable session identifiers to steal user session cookies, especially the Session ID. This allowed cybercriminals to impersonate users, gain unauthorized access to accounts, and exfiltrate sensitive data, including personal and payment information. The business impact was heightened customer risk, regulatory scrutiny, and erosion of trust, while common attack vectors included public Wi-Fi interception, malicious scripts, and subdomain cookie manipulation. The incident is relevant today as web app complexity and regulatory pressure increase, while attackers leverage more advanced session hijacking techniques. With ongoing changes in privacy laws (GDPR, CCPA, etc.) and threat actor innovation, organizations must harden cookie security and session management to avoid breaches with far-reaching consequences.
7 months ago
Kill Chain
Argo CD 2025 API Flaw Exposes Repository Credentials: What Enterprises Must Know
In September 2025, a critical vulnerability (CVE-2025-55190) in Argo CD—a widely used Kubernetes-native continuous deployment platform—was discovered that allowed API tokens, including those with minimal project-level permissions, to access API endpoints and retrieve all repository credentials for a given project. While the flaw required possession of a valid Argo CD API token, even low-privileged users could exploit this issue to bypass established isolation mechanisms and exfiltrate sensitive repository usernames and passwords. This exposure could enable attackers to clone proprietary codebases, inject malicious configurations, and potentially initiate supply chain compromises or further lateral movement, particularly impactful given Argo CD's widespread enterprise adoption by organizations like Adobe, Google, IBM, and Capital One. The incident underscores the ongoing risks posed by misconfigured API permissions in CI/CD pipelines, particularly as attackers increasingly target software supply chains. With credential-based attacks on the rise and major regulatory and industry scrutiny on API security, organizations must act quickly to patch, enhance access controls, and apply zero-trust principles in DevOps contexts.
7 months ago
Kill Chain
TP-Link Routers Hit by 2025 Zero-Day: What You Need to Know About the CWMP Exploit
In September 2025, TP-Link confirmed a critical zero-day vulnerability impacting multiple router models, including Archer AX10 and AX1500. Discovered by independent researcher Mehrun (ByteRay), the stack-based buffer overflow exists within the routers' CWMP (CPE WAN Management Protocol) implementation, specifically in handling SOAP messages due to improper validation in 'strncpy' calls. Attackers can exploit this flaw to achieve remote code execution by redirecting devices to malicious CWMP servers or leveraging unchanged default credentials, leading to device compromise. Once compromised, adversaries can reroute DNS queries, intercept traffic, and inject malicious payloads, raising severe risks for users and organizations relying on affected devices. The continued exploitation of similar router vulnerabilities by groups like Quad7 botnet highlights a shift in attacker TTPs towards leveraging consumer and SOHO networking devices as entry points and persistence mechanisms. The prevalence of these attacks underscores the urgent need for robust patch management and secure configuration in edge infrastructure.
7 months ago
Kill Chain
Q2 2025 Global Ransomware Surge: Qilin, Nefilim, Black Kingdom, and the Modern Threat Landscape
In Q2 2025, the global ransomware threat landscape saw a significant surge with the discovery of 1,702 new ransomware variants and nearly 86,000 users targeted. High-profile law enforcement actions included indictments and extraditions involving Black Kingdom, Nefilim, Ryuk, DoppelPaymer, and RobbinHood operators. Major campaigns leveraged vulnerabilities in SAP NetWeaver, Fortinet devices, and Microsoft Windows (CLFS driver), with actors like Qilin and DragonForce demonstrating adeptness in exploiting zero-days and supply chain weaknesses. Double extortion and rapid lateral movement were widely observed, affecting critical sectors worldwide, including healthcare, government, and managed service providers. This incident underscores the advancement of ransomware attack tactics, the spread of sophisticated variants, and the persistence of threat actors despite law enforcement measures. The continued exploitation of newly discovered vulnerabilities and focus on high-revenue targets highlight the urgent need for enhanced prevention, detection, and incident response across organizations of all sizes.
7 months ago
Kill Chain
GodRAT: New RAT Targets Financial Institutions via Skype with Evolved Tactics in 2024
In late 2024, a targeted campaign leveraged a new remote access trojan, GodRAT, to infiltrate trading and brokerage firms across Hong Kong, the UAE, and other countries. Attackers, likely linked to the Winnti APT group, distributed malicious .scr and .pif files disguised as financial documents via Skype. These files deployed GodRAT—an evolved variant of Gh0st RAT—using innovative techniques like steganography to evade detection. Once inside victim networks, the campaign used file management plugins and browser password stealers to exfiltrate sensitive credentials, while also deploying secondary implants such as AsyncRAT for persistent control. This ongoing incident highlights both the durability of legacy RAT codebases and the adaptability of threat actors employing advanced delivery and evasion tactics. It reflects a wider trend where financial institutions face persistent threats from intelligent, identity- and credential-focused attacks using proven malware frameworks.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
