STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 2497 to 2508 of 6903 threat reports

Health Care / Life Sciences4 months ago

ARToken: The Next Evolution in BEC-as-a-Service Platforms

In April 2026, Cisco Talos identified ARToken, a sophisticated phishing platform linked to the EvilTokens phishing-as-a-service operation. ARToken is designed to bypass multi-factor authentication and compromise Microsoft 365 accounts, featuring advanced capabilities such as inbox rule manipulation and shared access links. The platform employs a seven-layer anti-analysis system to evade detection, and its phishing lures are highly targeted, often impersonating legitimate vendor communications to deceive accounts-payable staff into processing fraudulent invoices. The emergence of ARToken underscores a significant evolution in business email compromise (BEC) tactics, highlighting the increasing sophistication and accessibility of phishing-as-a-service platforms. This development poses a heightened risk to organizations, emphasizing the need for enhanced email security measures and employee vigilance against such targeted attacks.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Government Administration4 months ago

Urgent Alert: Ransomware Gangs Exploit Microsoft Defender 'BlueHammer' Vulnerability

In early April 2026, a security researcher known as 'Nightmare Eclipse' publicly disclosed a high-severity privilege escalation vulnerability in Microsoft Defender, dubbed 'BlueHammer' (CVE-2026-33825), along with proof-of-concept exploit code. This flaw allows local attackers to access the Security Account Manager (SAM) database, enabling them to escalate privileges to SYSTEM level and potentially take full control of the affected system. Microsoft addressed the vulnerability on April 14, 2026, as part of its Patch Tuesday updates. However, by late June 2026, the Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware gangs had begun exploiting this vulnerability in their attacks, leading to significant security concerns for organizations using unpatched systems. The exploitation of BlueHammer underscores a growing trend where threat actors rapidly weaponize newly disclosed vulnerabilities, particularly those with publicly available exploit code. This incident highlights the critical importance of timely patch management and proactive security measures to mitigate the risks associated with such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Automotive4 months ago

Blackfield Ransomware Targets Nidec Corporation with $2 Million Demand

In June 2026, Nidec Corporation, a leading Japanese manufacturer of electronic components, disclosed a ransomware attack on its Taiwanese subsidiary, Nidec Chaun Choung Technology. The Blackfield ransomware group demanded a $2 million ransom, threatening to publish or sell stolen data if the payment was not made. Nidec implemented emergency measures, including shutting down affected servers and networks, to contain the damage. The company is assessing the impact on its operations but does not anticipate significant effects on other subsidiaries. This incident underscores the persistent threat of ransomware attacks targeting critical manufacturing sectors. Organizations must remain vigilant, as threat actors continue to evolve their tactics, employing double extortion methods that combine data encryption with the threat of data exposure to pressure victims into paying ransoms.

High impact

Kill Chain

ICInitial Compromise(low)

PEPrivilege Escalation(low)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(high)

Read report

Computer Software/Engineering4 months ago

Beware: Malicious 'Perplexity AI' Chrome Extension Intercepts User Searches

In June 2026, a malicious Chrome extension named "Search for perplexity ai" was discovered impersonating the legitimate Perplexity AI search engine. This extension altered users' default search settings, intercepting all address-bar queries and routing them through attacker-controlled infrastructure before redirecting to legitimate search services. While no credential theft was confirmed, the extension's permissions allowed for extensive data collection, posing significant privacy risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fake-perplexity-extension-on-chrome-web-store-tracked-searches/amp/?utm_source=openai)) This incident underscores the growing trend of cybercriminals exploiting trusted AI brands to distribute malicious software. It highlights the need for enhanced vigilance in verifying browser extensions and the importance of robust security measures to prevent unauthorized data interception.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services4 months ago

Defending Against AI-Enhanced Business Email Compromise in 2026

In 2026, Business Email Compromise (BEC) attacks have evolved into sophisticated, multi-stage operations. Threat actors gain access to organizational mailboxes or SaaS accounts, meticulously analyze internal communications, and exploit financial processes to execute fraudulent transactions. The integration of AI technologies has enhanced the quality and efficiency of these scams, making them increasingly difficult to detect. The prevalence of BEC attacks has surged, with 74% of organizations reporting incidents in 2025, up from 63% in 2024. ([nacha.org](https://www.nacha.org/news/business-email-compromise-attempts-rose-sharply-2025-report-finds?utm_source=openai)) This trend underscores the urgent need for organizations to bolster their cybersecurity measures and employee training to mitigate the escalating threat posed by BEC schemes.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering4 months ago

Malicious PyPI Packages Compromise Telegram Bot Servers in 2026

Between November 2025 and June 2026, a campaign dubbed 'Operation Navy Ghost' targeted Python developers creating Telegram bots by distributing trojanized versions of the Pyrogram library on the Python Package Index (PyPI). These malicious packages, including 'VLifeGram' and 'pyrogram-styled', contained a hidden backdoor that, upon activation, allowed attackers to execute arbitrary code and access sensitive data on compromised servers. The backdoor was designed to operate silently, suppressing errors and disabling logging, thereby granting attackers extensive control over the affected systems. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/malicious-pypi-packages-give-hackers-control-of-telegram-bot-servers/?utm_source=openai)) This incident underscores the persistent threat of supply chain attacks in open-source ecosystems. The exploitation of widely-used libraries like Pyrogram highlights the need for developers to exercise caution when integrating third-party packages. Ensuring the integrity of software dependencies is crucial to prevent unauthorized access and data breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Computer Software/Engineering4 months ago

BioShocking Attack: A New Threat to AI Browser Security

In June 2026, researchers at LayerX identified a novel prompt injection attack named 'BioShocking' targeting AI-powered browsers. The attack involves a malicious webpage presenting a BioShock-themed puzzle game that rewards incorrect answers, conditioning the browser's control agent to disregard standard safety protocols. In the final stage, the agent is directed to access a GitHub repository and extract sensitive data, such as passwords. This proof-of-concept was tested against six mainstream agentic browsers, with only OpenAI's ChatGPT Atlas implementing an effective fix after disclosure. The BioShocking attack underscores the critical need for robust security measures in AI-driven applications. As AI agents become more integrated into daily tasks, their susceptibility to manipulation poses significant risks. This incident highlights the urgency for developers to implement explicit user confirmations for sensitive actions, enhance context checks, and establish strict boundaries for agentic sessions to prevent similar exploits.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT4 months ago

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints

In March 2026, threat actors exploited a critical vulnerability in Langflow (CVE-2026-33017), an open-source AI workflow tool, to deploy Monero cryptocurrency miners on exposed AI application endpoints. This unauthenticated remote code execution flaw allowed attackers to execute arbitrary Python code via the public flow build API endpoint, leading to unauthorized system access and resource hijacking. The attacks were observed between March 27 and April 15, 2026, with malicious scripts terminating competing miners, disabling security controls, and establishing persistence mechanisms. ([thehackernews.com](https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html?utm_source=openai)) The rapid exploitation of this vulnerability underscores the increasing targeting of AI infrastructure by cybercriminals. Organizations utilizing Langflow versions prior to 1.9.0 are urged to upgrade immediately and review their systems for signs of compromise. ([thehackernews.com](https://thehackernews.com/2026/06/langflow-rce-exploited-to-deploy-monero.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(high)

Read report

Telecommunications4 months ago

RustDuck Botnet's Evolution: A New Era of DDoS Threats

Since February 2026, the RustDuck botnet has been actively compromising home routers, IP cameras, Android devices, and poorly secured servers to orchestrate large-scale Distributed Denial-of-Service (DDoS) attacks. Researchers at QiAnXin's XLab have observed its rapid evolution, notably transitioning its core codebase from C to Rust, enhancing its adaptability and resistance to analysis. The malware propagates through weak password brute-forcing on Telnet/SSH services and exploits various remote code execution vulnerabilities in devices from manufacturers like TVT, Ruijie, TP-Link, and ZTE, as well as web applications such as ThinkPHP, Jenkins, and Hadoop YARN. ([thehackernews.com](https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html?utm_source=openai)) The emergence of RustDuck underscores a concerning trend in botnet development, where threat actors adopt modern programming languages like Rust to create more resilient and evasive malware. This shift complicates detection and mitigation efforts, highlighting the need for continuous adaptation in cybersecurity defenses. ([thehackernews.com](https://thehackernews.com/2026/06/rustduck-botnet-rebuilds-in-rust-to.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(low)

IImpact(high)

Read report

Computer Software/Engineering4 months ago

Microsoft Identifies Critical AI Agent Vulnerability in MCP Tool Descriptions

In June 2026, Microsoft researchers identified a critical vulnerability in AI agents utilizing the Model Context Protocol (MCP). Attackers can exploit this by embedding malicious instructions within tool descriptions, causing AI agents to inadvertently exfiltrate sensitive company data without triggering security alerts. This method leverages the trust AI agents place in tool descriptions, leading to unauthorized data disclosures. This incident underscores the evolving threat landscape as AI agents become more integrated into business operations. Organizations must reassess their AI security protocols to address these sophisticated attack vectors, emphasizing the need for stringent validation of third-party tools and continuous monitoring of AI agent activities.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services4 months ago

The Rise of AI-Powered Phishing Attacks in 2025

In 2025, the cybersecurity landscape witnessed a significant surge in AI-powered phishing attacks. Cybercriminals increasingly leveraged artificial intelligence to craft highly convincing phishing emails, leading to a 140% increase in browser-based phishing attacks and a 130% rise in zero-hour phishing incidents compared to the previous year. This escalation resulted in substantial financial losses, with an estimated $17 billion worth of Bitcoin stolen through AI-enhanced scams. The integration of AI into phishing tactics has not only increased the volume of attacks but also their sophistication, making detection and prevention more challenging for organizations. ([pcworld.com](https://www.pcworld.com/article/2645617/ai-driven-phishing-scams-exploded-last-year-the-trend-continues-in-2025.html?utm_source=openai)) The current relevance of this trend is underscored by the continuous evolution of AI technologies, which are being exploited by cybercriminals to automate and personalize phishing campaigns at an unprecedented scale. This development necessitates a proactive approach from organizations to enhance their cybersecurity measures and adapt to the rapidly changing threat landscape.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Utilities4 months ago

Nation-State Cyberattacks on Water Systems: A Growing Threat

Between 2024 and 2026, nation-state actors from Iran, Russia, and China have increasingly targeted water and wastewater systems worldwide. These cyberattacks exploit vulnerabilities such as weak passwords, exposed programmable logic controllers (PLCs), and inadequate network segmentation, leading to unauthorized access and potential operational disruptions. Notably, in 2025, Russian-linked actors caused a municipal water tank overflow in Muleshoe, Texas, by accessing a remote industrial interface. Similarly, Iranian groups have been observed exploiting exposed PLCs in the U.S. and Israel, while China's Volt Typhoon group has compromised critical infrastructure, including water systems, aiming for strategic pre-positioning. ([darkreading.com](https://www.darkreading.com/ics-ot-security/iran-russia-china-target-water-systems-sabotage?utm_source=openai)) The current relevance of these incidents is underscored by the persistent and evolving nature of cyber threats to critical infrastructure. The exploitation of basic security oversights by sophisticated threat actors highlights the urgent need for enhanced cybersecurity measures in the water sector to prevent potential disruptions and safeguard public health and safety.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

1...207 208 209 210 211...576

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

ARToken: The Next Evolution in BEC-as-a-Service Platforms

Urgent Alert: Ransomware Gangs Exploit Microsoft Defender 'BlueHammer' Vulnerability

Blackfield Ransomware Targets Nidec Corporation with $2 Million Demand

Beware: Malicious 'Perplexity AI' Chrome Extension Intercepts User Searches

Defending Against AI-Enhanced Business Email Compromise in 2026

Malicious PyPI Packages Compromise Telegram Bot Servers in 2026

BioShocking Attack: A New Threat to AI Browser Security

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints

RustDuck Botnet's Evolution: A New Era of DDoS Threats

Microsoft Identifies Critical AI Agent Vulnerability in MCP Tool Descriptions

The Rise of AI-Powered Phishing Attacks in 2025

Nation-State Cyberattacks on Water Systems: A Growing Threat

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

ARToken: The Next Evolution in BEC-as-a-Service Platforms

Urgent Alert: Ransomware Gangs Exploit Microsoft Defender 'BlueHammer' Vulnerability

Blackfield Ransomware Targets Nidec Corporation with $2 Million Demand

Beware: Malicious 'Perplexity AI' Chrome Extension Intercepts User Searches

Defending Against AI-Enhanced Business Email Compromise in 2026

Malicious PyPI Packages Compromise Telegram Bot Servers in 2026

BioShocking Attack: A New Threat to AI Browser Security

Langflow RCE Exploited to Deploy Monero Miner on Exposed AI App Endpoints

RustDuck Botnet's Evolution: A New Era of DDoS Threats

Microsoft Identifies Critical AI Agent Vulnerability in MCP Tool Descriptions

The Rise of AI-Powered Phishing Attacks in 2025

Nation-State Cyberattacks on Water Systems: A Growing Threat

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?