STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 2473 to 2484 of 6903 threat reports

Information Technology/IT4 months ago

Cybercriminals Exploit SEO and Legitimate Tools to Deploy AsyncRAT

In July 2026, cybersecurity researchers uncovered a large-scale campaign where threat actors utilized SEO poisoning to distribute malicious installer archives via spoofed websites. These installers, masquerading as popular software like OBS Studio and Bandicam, bundled a legitimate Microsoft install.exe binary with a rogue DLL, leading to the deployment of the ScreenConnect remote access tool. This tool facilitated the execution of AsyncRAT, enabling attackers to maintain control over compromised systems, steal sensitive data, and monitor user activity. The campaign spanned over 90 domain names across 10 languages, indicating a highly coordinated effort. ([thehackernews.com](https://thehackernews.com/2026/07/seo-poisoned-software-sites-abuse.html?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who exploit legitimate tools and SEO techniques to enhance the reach and effectiveness of their attacks. The use of trusted software as a delivery mechanism for malware highlights the need for heightened vigilance and robust security measures to detect and prevent such sophisticated threats.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Information Technology/IT4 months ago

Critical Unpatched Vulnerability in Argo CD Repo-Server Threatens Kubernetes Clusters

In July 2026, a critical vulnerability was disclosed in Argo CD's repo-server component, a widely used tool for deploying software to Kubernetes. The flaw allows unauthenticated attackers to execute arbitrary code by sending crafted requests to the repo-server's internal gRPC service, which lacks authentication. This vulnerability can lead to full cluster takeovers if the repo-server is accessible within the network. Despite being reported to Argo CD's maintainers in January 2025, the issue remains unpatched as of July 2026. This incident underscores the importance of securing internal services and implementing robust network policies. Organizations using Argo CD should immediately apply network isolation measures to prevent unauthorized access to the repo-server component and mitigate potential exploitation.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Financial Services4 months ago

19-Year-Old Scattered Spider Member Extradited to U.S. for Hacking Charges

On July 1, 2026, the U.S. Department of Justice announced the extradition of Peter Stokes, a 19-year-old dual U.S. and Estonian citizen, from Finland to the United States. Stokes, identified by the online handle "Bouquet," faces charges of conspiracy, computer intrusion, and fraud for his alleged involvement with the cybercriminal group Scattered Spider. This group has been linked to over 100 network intrusions, resulting in more than $100 million in ransom payments. Stokes appeared in a Chicago federal court on June 30, where he was ordered to remain in custody. The arrest underscores the persistent threat posed by Scattered Spider, known for targeting sectors such as casinos, retailers, and airlines through sophisticated social engineering tactics. Despite recent law enforcement actions, the group's methods continue to evolve, highlighting the need for organizations to bolster their cybersecurity defenses against such adaptive threats.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Telecommunications4 months ago

Iran-Nexus TAG-182 Deploys MarkiRAT Malware in Surveillance Campaign

In early 2026, the Iranian-linked threat group TAG-182 initiated a cyber espionage campaign deploying MarkiRAT malware via counterfeit Android applications, including fake VPNs and media tools, to surveil Iranian citizens domestically and abroad. This operation aligns with Iran's intensified digital surveillance efforts following the partial restoration of internet access on May 26, 2026, targeting perceived dissidents and foreign collaborators. The MarkiRAT samples exhibit tradecraft overlaps with previous variants used by Ferocious Kitten, suggesting a potential operational connection, though further evidence is required to confirm organizational links. ([staging.hawk-eye.io](https://staging.hawk-eye.io/iran-apt-threat-advisory/?utm_source=openai)) The resurgence of TAG-182's activities underscores the persistent threat posed by Iranian state-sponsored cyber operations, particularly in the realm of surveillance and intelligence gathering. Organizations and individuals, especially those involved in human rights advocacy or opposition activities, should remain vigilant against sophisticated social engineering tactics and ensure robust cybersecurity measures are in place to mitigate the risks associated with such targeted campaigns.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Hospitality4 months ago

Persistent Phishing Threats in the Hospitality Industry: A 2026 Case Study

In April 2026, a sophisticated phishing campaign targeted hospitality organizations across Europe and Asia. Attackers impersonated guests, sending emails with malicious ZIP files disguised as photo attachments. These emails exploited trusted services like Calendly and Google redirects to bypass email authentication checks. Upon opening the ZIP files, victims inadvertently executed a PowerShell script that installed a persistent Node.js-based malware implant, granting attackers long-term access to compromised systems. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs?utm_source=openai)) This incident underscores a growing trend of cybercriminals leveraging social engineering and trusted platforms to infiltrate organizations. The use of advanced techniques, such as 'authentication laundering' and blockchain-based command-and-control mechanisms, highlights the evolving nature of cyber threats in the hospitality sector. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(low)

Read report

Computer Software/Engineering4 months ago

Securing AI Endpoints: Lessons from Recent Exploits

Between March and May 2026, Zenity researchers identified three distinct campaigns where threat actors exploited exposed AI inference endpoints, such as those of Ollama and LiteLLM, to conduct offensive operations. These attacks did not require full system compromises; attackers merely needed knowledge of the exposed endpoints to leverage them for activities like autonomous penetration testing and web reverse-engineering. The incidents underscore the critical need for securing AI infrastructure against unauthorized access. This trend highlights a growing tactic among cyber adversaries: exploiting misconfigured or exposed AI endpoints to amplify their offensive capabilities. As organizations increasingly integrate AI into their operations, ensuring the security of these systems becomes paramount to prevent their misuse in cyberattacks.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Computer Software/Engineering4 months ago

Agentjacking: The Emerging Threat to AI Coding Agents

In June 2026, Tenet Security unveiled a novel attack method termed 'agentjacking,' wherein attackers exploit AI coding agents by injecting malicious code through fabricated error reports in public bug tracking services. This technique enables unauthorized code execution on developers' machines, potentially leading to the theft of sensitive credentials and compromise of development environments. The attack leverages the AI agents' inability to distinguish between genuine content and embedded instructions, allowing adversaries to manipulate these agents into executing harmful commands. The significance of this discovery lies in the escalating integration of AI coding agents into software development workflows. As these agents become more prevalent, understanding and mitigating their vulnerabilities is crucial to prevent similar exploitation methods. Organizations must reassess their security protocols to address the unique risks posed by AI-driven development tools.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Utilities4 months ago

China-Linked Group Targets Southeast Asia Critical Systems

In mid-2025, the Chinese-speaking advanced persistent threat (APT) group CL-STA-1062 initiated a cyber espionage campaign targeting government entities and critical infrastructure in Southeast Asia. The group compromised at least 10 organizations, including state-owned enterprises in the energy and government sectors, deploying a custom backdoor named TinyRCT. This backdoor facilitated unauthorized access, data exfiltration, and system control, posing significant risks to national security and operational stability. ([thehackernews.com](https://thehackernews.com/2026/06/chinese-speaking-apt-deploys-new.html?utm_source=openai)) The emergence of TinyRCT underscores the evolving sophistication of state-sponsored cyber threats in the region. Organizations must enhance their cybersecurity measures to detect and mitigate such advanced persistent threats, ensuring the resilience of critical infrastructure against future attacks. ([thehackernews.com](https://thehackernews.com/2026/06/chinese-speaking-apt-deploys-new.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Computer Software/Engineering4 months ago

Phantom Squatting: Unveiling the New AI-Driven Cyber Threat

In July 2026, cybersecurity researchers identified a new threat vector termed 'phantom squatting,' where attackers exploit AI-generated, non-existent domains associated with legitimate brands. By registering these hallucinated domains, cybercriminals can intercept traffic directed by AI systems, leading to phishing attacks and malware distribution. This method leverages the tendency of large language models (LLMs) to generate plausible yet fictitious web addresses, creating a novel supply chain vulnerability. The emergence of phantom squatting underscores the evolving landscape of AI-driven cyber threats. As organizations increasingly integrate AI assistants into their operations, the risk of such AI-induced vulnerabilities grows, necessitating proactive measures to monitor and secure potential phantom domains before they are weaponized by adversaries.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Industrial Automation4 months ago

Critical Vulnerabilities in Delta Electronics DVP12SE PLCs: CVE-2026-12819 and CVE-2026-12818

In June 2026, critical vulnerabilities were identified in Delta Electronics DVP12SE Programmable Logic Controllers (PLCs), specifically CVE-2026-12819 and CVE-2026-12818. These flaws allow remote attackers to issue commands, modify operational values, and interfere with control logic without authentication. The vulnerabilities affect all versions of the DVP12SE PLC, potentially enabling unauthorized access to sensitive control functions and causing resource exhaustion through flooding attacks. The discovery of these vulnerabilities underscores the increasing risks associated with industrial control systems (ICS) and the necessity for robust security measures. Organizations utilizing Delta Electronics DVP12SE PLCs should implement recommended mitigations, such as enabling IP filtering, setting up password protection, and ensuring network isolation, to safeguard against potential exploitation.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Financial Services4 months ago

Unveiling the Evolution of ClickFix: API-Driven Malware Delivery Exposed

In July 2026, security researcher Bert-Jan Pals analyzed approximately 3,000 live ClickFix payloads, uncovering a significant evolution in the malware delivery mechanism. ClickFix, a social engineering technique that deceives users into executing malicious commands, has transitioned to using API-driven servers. These servers dynamically generate unique, obfuscated commands for each visitor, effectively disguising the same underlying malware. Additionally, a new delivery method was identified that bypasses Windows' script scanning by downloading a file to the user's system and executing it through a seemingly innocuous command, thereby evading traditional detection mechanisms. This development underscores the increasing sophistication of social engineering attacks and the continuous adaptation of threat actors to circumvent security measures. Organizations must remain vigilant, updating their security protocols and educating users about emerging threats to mitigate the risks associated with such advanced attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Industrial Automation4 months ago

Critical XZ Utils Vulnerability Affects B&R Products (CVE-2025-31115)

In June 2026, B&R Industrial Automation GmbH disclosed a critical vulnerability (CVE-2025-31115) in their products due to a flaw in XZ Utils versions 5.3.3alpha to 5.8.0. This race condition within the multithreaded .xz decoder in liblzma could allow attackers to crash the system or corrupt memory data. Affected products include PPC3100, C50, C80, FT50, MT50, T30, T80, and T50, with specific versions listed in the advisory. The vulnerability has a CVSS v3 base score of 7.5, indicating high severity. ([cisa.gov](https://www.cisa.gov/sites/default/files/publications/web-metrics/CISA.gov-Apr-2024-Web-Metrics-508.pdf?utm_source=openai)) This incident underscores the importance of promptly addressing vulnerabilities in widely used open-source libraries. Organizations are advised to update to XZ Utils version 5.8.1 or apply the provided patches to mitigate potential risks. ([cisa.gov](https://www.cisa.gov/sites/default/files/publications/web-metrics/CISA.gov-Apr-2024-Web-Metrics-508.pdf?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

1...205 206 207 208 209...576

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Cybercriminals Exploit SEO and Legitimate Tools to Deploy AsyncRAT

Critical Unpatched Vulnerability in Argo CD Repo-Server Threatens Kubernetes Clusters

19-Year-Old Scattered Spider Member Extradited to U.S. for Hacking Charges

Iran-Nexus TAG-182 Deploys MarkiRAT Malware in Surveillance Campaign

Persistent Phishing Threats in the Hospitality Industry: A 2026 Case Study

Securing AI Endpoints: Lessons from Recent Exploits

Agentjacking: The Emerging Threat to AI Coding Agents

China-Linked Group Targets Southeast Asia Critical Systems

Phantom Squatting: Unveiling the New AI-Driven Cyber Threat

Critical Vulnerabilities in Delta Electronics DVP12SE PLCs: CVE-2026-12819 and CVE-2026-12818

Unveiling the Evolution of ClickFix: API-Driven Malware Delivery Exposed

Critical XZ Utils Vulnerability Affects B&R Products (CVE-2025-31115)

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Cybercriminals Exploit SEO and Legitimate Tools to Deploy AsyncRAT

Critical Unpatched Vulnerability in Argo CD Repo-Server Threatens Kubernetes Clusters

19-Year-Old Scattered Spider Member Extradited to U.S. for Hacking Charges

Iran-Nexus TAG-182 Deploys MarkiRAT Malware in Surveillance Campaign

Persistent Phishing Threats in the Hospitality Industry: A 2026 Case Study

Securing AI Endpoints: Lessons from Recent Exploits

Agentjacking: The Emerging Threat to AI Coding Agents

China-Linked Group Targets Southeast Asia Critical Systems

Phantom Squatting: Unveiling the New AI-Driven Cyber Threat

Critical Vulnerabilities in Delta Electronics DVP12SE PLCs: CVE-2026-12819 and CVE-2026-12818

Unveiling the Evolution of ClickFix: API-Driven Malware Delivery Exposed

Critical XZ Utils Vulnerability Affects B&R Products (CVE-2025-31115)

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?