✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 757 to 768 of 5051
Cordyceps Vulnerabilities Threaten Over 300 GitHub Repositories
In June 2026, cybersecurity firm Novee identified a systemic class of vulnerabilities, dubbed 'Cordyceps,' within GitHub Actions workflows. These flaws enable unauthenticated attackers to hijack continuous integration and continuous deployment (CI/CD) pipelines by exploiting insecure configurations in YAML files. The vulnerabilities affect repositories from major organizations, including Microsoft, Google, Apache, Cloudflare, and the Python Software Foundation, potentially compromising software supply chains and exposing sensitive credentials. ([securityweek.com](https://www.securityweek.com/exploitable-ci-cd-vulnerabilities-expose-millions-of-repositories-to-hijacking/?utm_source=openai)) This incident underscores the escalating risks associated with CI/CD pipeline security, especially as AI-driven coding tools proliferate. Organizations must prioritize securing their development workflows to prevent similar supply chain attacks, which are becoming increasingly sophisticated and widespread. ([mallory.ai](https://www.mallory.ai/stories/019ef4cf-b141-7c22-b785-3b7e99e1c73f?utm_source=openai))
1 month ago
Kill Chain
U.S. Authorities Dismantle Huione Group's Cybercrime Infrastructure in 2026
In June 2026, the U.S. Department of Justice seized a cloud computing account linked to subsidiaries of the Cambodia-based Huione Group, a conglomerate implicated in extensive cyber scams and money laundering activities. This infrastructure supported Huione Guarantee, a Telegram-based marketplace facilitating the sale of stolen personal data, malware-enabled thefts, and laundering of proceeds from various scams, including romance and investment frauds. The operation disrupted a significant node in the global cybercrime ecosystem, which had laundered over $4 billion in illicit funds between August 2021 and January 2025. This action underscores the escalating efforts by U.S. authorities to dismantle transnational cybercriminal networks exploiting digital platforms for large-scale fraud. The seizure highlights the critical need for robust cybersecurity measures and international cooperation to combat the evolving landscape of cyber threats targeting individuals and financial systems worldwide.
1 month ago
Kill Chain
Microsoft and Partners Execute Unprecedented Takedown of Amadey and StealC Cybercrime Tools
In June 2026, Microsoft, in collaboration with international law enforcement agencies and industry partners, executed a court-authorized operation to simultaneously disrupt the Amadey botnet and StealC infostealer. These tools, often used in tandem by cybercriminals, were linked to over 140,000 infected computers globally in early May 2026. The operation targeted more than 200 command-and-control servers, significantly hindering the infrastructure supporting these malware families. This coordinated effort marked a strategic shift in cyber defense, emphasizing the importance of disrupting interconnected cybercrime tools to enhance the effectiveness of takedown operations. The success of this operation underscores the necessity for collaborative approaches in combating sophisticated cyber threats that exploit modular, pay-as-you-go models to escalate attacks rapidly.
1 month ago
Kill Chain
LastPass Data Breach via Klue Supply Chain Attack in 2026
In June 2026, LastPass experienced a data breach resulting from a supply chain attack on Klue, a third-party market intelligence platform integrated with LastPass's Salesforce environment. Attackers exploited compromised OAuth tokens obtained from Klue to access LastPass customer data, including names, phone numbers, email addresses, physical addresses, support case information, and sales-related data. Importantly, LastPass's core products, services, and customer vaults remained unaffected. ([blog.lastpass.com](https://blog.lastpass.com/posts/klue-supply-chain-incident-and-lastpass-response?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and supply chain vulnerabilities. Organizations must reassess their security postures, particularly concerning external partnerships, to mitigate potential threats arising from interconnected systems.
1 month ago
Kill Chain
AI-Driven Acceleration in Vulnerability Exploitation Demands Immediate Action
In June 2026, a report highlighted the dramatic acceleration in the exploitation of software vulnerabilities due to AI advancements. The Zero Day Clock indicated that the average time from vulnerability disclosure to exploitation had decreased from 53 days in 2024 to just 8 hours in 2026. This rapid reduction challenges traditional vulnerability management practices, which relied on longer remediation windows. Organizations now face increased risks as attackers can exploit vulnerabilities almost immediately after disclosure, outpacing conventional patching and mitigation efforts. This development underscores the urgent need for organizations to adopt proactive security measures, such as continuous threat exposure management and automated security validation, to effectively address the evolving threat landscape.
1 month ago
Kill Chain
Scattered Spider's 2024 Cyberattack on Transport for London: A Case Study
In late August 2024, the cybercriminal group Scattered Spider infiltrated Transport for London's (TfL) systems, compromising the Oyster refunds system and causing significant operational disruptions. The attack led to the theft of customer data and forced all 28,000 TfL employees to reset their passwords, resulting in financial damages estimated at £29 million ($38.3 million). This incident underscores the escalating threat posed by cybercriminal groups targeting critical infrastructure. Organizations must enhance their cybersecurity measures to prevent similar breaches and mitigate potential operational and financial impacts.
1 month ago
Kill Chain
New macOS ClickFix Attack Silently Mounts DMGs to Deploy Infostealer
In June 2026, a new macOS ClickFix campaign emerged, utilizing Terminal commands to silently download, mount, and execute info-stealing malware from malicious disk image (DMG) files. This attack infects Mac devices with the Atomic macOS Stealer (AMOS), which exfiltrates browser credentials, cryptocurrency wallet data, Keychain information, messaging app data, and user documents. The campaign begins with a fake CAPTCHA page instructing users to open Terminal and paste a malicious command, leading to the automatic execution of the malware. This method represents an evolution in ClickFix attacks, combining social engineering with automated malware deployment to enhance stealth and effectiveness. The significance of this incident lies in the increasing sophistication of social engineering attacks targeting macOS users. By leveraging trusted system utilities and deceptive prompts, attackers can bypass traditional security measures and user vigilance. This trend underscores the need for enhanced user education, robust endpoint protection, and continuous monitoring to detect and mitigate such evolving threats.
1 month ago
Kill Chain
Xsolis Data Breach 2026: A Wake-Up Call for Healthcare Cybersecurity
In January 2026, healthcare technology company Xsolis experienced a data breach affecting nearly 1.4 million individuals. The breach resulted from a targeted phishing attack on January 20, 2026, which allowed unauthorized access to Xsolis's network. The attackers accessed files containing sensitive personal and health information, including names, addresses, dates of birth, Social Security numbers, health insurance details, and medical treatment information. Xsolis detected the unauthorized activity on January 22, 2026, promptly contained the breach, and initiated an investigation with external cybersecurity experts. The company has since notified affected individuals and implemented additional security measures to prevent future incidents. This incident underscores the persistent threat of phishing attacks in the healthcare sector, highlighting the critical need for robust cybersecurity measures and employee training to protect sensitive patient data. The breach also raises concerns about potential identity theft and fraud for the affected individuals, emphasizing the importance of vigilance and proactive monitoring of personal information.
1 month ago
Kill Chain
WhatsApp Phishing Campaign Installs ManageEngine RMM Tool via VBScript
In June 2026, a sophisticated phishing campaign was identified targeting users of WhatsApp Desktop and WhatsApp Web across multiple countries, including Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, and Australia. Attackers utilized compromised WhatsApp accounts to distribute malicious Visual Basic Script (VBScript) files disguised as legitimate business documents, such as invoices and billing statements. Upon execution, these scripts installed ManageEngine Endpoint Central, a legitimate Remote Monitoring and Management (RMM) tool, granting attackers full remote control over the victim's system. This unauthorized access enabled the exfiltration of sensitive data, installation of additional malware, and potential lateral movement within corporate networks. This incident underscores a concerning trend in cyber threats where attackers leverage legitimate software tools to evade detection and maintain persistent access within compromised systems. The use of social engineering tactics, such as distributing malware through trusted communication platforms like WhatsApp, highlights the evolving nature of phishing campaigns and the necessity for organizations to enhance their security awareness training and implement robust endpoint protection measures.
1 month ago
Kill Chain
Critical Cisco Unified CM Vulnerability CVE-2026-20230 Under Active Exploitation
In June 2026, a critical server-side request forgery (SSRF) vulnerability, identified as CVE-2026-20230, was discovered in Cisco Unified Communications Manager (Unified CM) and its Session Management Edition (Unified CM SME). This flaw allows unauthenticated remote attackers to send crafted HTTP requests, enabling them to write files to the underlying operating system and potentially escalate privileges to root. Cisco released security updates on June 3, 2026, to address this vulnerability. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Unified+Communications+Manager+Server-Side+Request+Forgery+Vulnerability%26vs_k%3D1&utm_source=openai)) By June 23, 2026, threat intelligence firm Defused reported active exploitation of this vulnerability in the wild. Attackers were observed using file:// payloads to create test files on vulnerable devices, indicating reconnaissance activities. The availability of a proof-of-concept exploit increases the urgency for organizations to apply the provided patches promptly.
1 month ago
Kill Chain
Tata Electronics Cyberattack: A Wake-Up Call for Supply Chain Security
In June 2026, Tata Electronics, a division of the Tata Group specializing in electronic components and semiconductor manufacturing, confirmed a cyberattack that impacted parts of its IT infrastructure. The company stated that operations remained unaffected. The World Leaks threat group claimed responsibility, leaking over 200,000 files totaling approximately 630 GB, including sensitive manufacturing data for Apple and Tesla products. The leaked information comprises internal component schematics, PCB designs, material specifications, and SDK files. ([business-standard.com](https://www.business-standard.com/companies/news/tata-electronics-hit-by-cyber-breach-exposing-apple-tesla-trade-secrets-126062201241_1.html?utm_source=openai)) This incident underscores the escalating threat posed by data extortion groups like World Leaks, which focus on stealing and leaking sensitive corporate data without deploying traditional ransomware. The breach highlights the critical need for robust cybersecurity measures and supply chain security, especially for companies handling proprietary information of major technology firms. ([business-standard.com](https://www.business-standard.com/companies/news/tata-electronics-cyber-breach-apple-tesla-supply-chain-security-126062300396_1.html?utm_source=openai))
1 month ago
Kill Chain
Malicious npm Packages Masquerade as PostCSS Tools to Deploy Windows RAT
In June 2026, cybersecurity researchers identified a series of malicious npm packages masquerading as legitimate PostCSS tools. These packages, including 'aes-decode-runner-pro', 'postcss-minify-selector', and 'postcss-minify-selector-parser', were designed to deliver a Windows-based Remote Access Trojan (RAT) upon installation. The packages were published over the past month by an npm user named 'abdrizak'. The malicious code was heavily obfuscated, leveraging techniques like Base64 and XOR encoding, as well as minification, to resist analysis and detection efforts. Upon installation, the packages retrieved a malicious script from a remote server, executing it silently to deploy the RAT on Windows systems. ([research.jfrog.com](https://research.jfrog.com/post/from-postcss-typosquat-to-windows-rat/?utm_source=openai)) This incident underscores the persistent threat of supply chain attacks within the npm ecosystem. Attackers continue to exploit the trust in widely used open-source packages to distribute malware, highlighting the need for enhanced vigilance and security measures among developers and organizations.
1 month ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Attackers Learned to Use AI. Now They Built Tools to Destroy It.
Living-off-the-Agent: How AI Tool Misuse Became the Insider Threat Nobody Provisioned
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
