STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 385 to 396 of 6836 threat reports

Government Administration3 weeks ago

Critical SonicWall SMA1000 Vulnerability Under Active Exploitation: CVE-2026-102255 Analysis

In October 2026, attackers began exploiting CVE-2026-102255, a maximum-severity server-side request forgery (SSRF) vulnerability in SonicWall SMA1000 secure remote access appliances. The flaw affects the Appliance WorkPlace interface on models 6210, 7210, and 8200v, allowing unauthenticated remote attackers to force appliances to issue requests on their behalf and access internal functionality. Security researchers detected exploitation attempts targeting the WorkPlace Extraweb interface using crafted OPTIONS requests to reach internal CouchDB services with default credentials. Over 400 SMA1000 appliances remain exposed online, representing significant risk to enterprise VPN infrastructure used by managed service providers, corporations, and government agencies. This incident follows a pattern of SMA1000 vulnerabilities being actively exploited, with CISA cataloging 19 SonicWall flaws as exploited in the wild over four years, including 13 linked to ransomware operations. The rapid weaponization demonstrates how critical infrastructure components become prime targets for threat actors seeking network access and lateral movement opportunities.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(low)

Read report

Automotive3 weeks ago

International Cooperation Targets Qilin Ransomware Leadership in Historic Germany-Japan Extradition

In October 2026, Germany arrested a Russian national suspected of being a core member of the notorious Qilin ransomware group following extradition from Japan. The suspect was originally detained in May 2026 at an Osaka hotel after entering Japan as a tourist, where German authorities had issued an international arrest warrant. Qilin, operating as a ransomware-as-a-service (RaaS) since 2022, has targeted over 2,350 organizations across 62 countries, including major victims like Nissan, Asahi Brewery, and the U.S. Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF). Despite the arrest, the group remained highly active, listing over 450 new victims since June 2026. This arrest highlights the growing international law enforcement cooperation against ransomware operations and demonstrates that RaaS leaders can be tracked and prosecuted across borders. The continued activity of Qilin post-arrest underscores the distributed nature of modern ransomware operations and the persistent threat they pose to critical infrastructure worldwide.

Low impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Government Administration3 weeks ago

FBI Arrests Another ShinyHunters Member After Massive Agency Breach Exposes Employee Data

The FBI arrested another suspected ShinyHunters member in October 2026 following the group's breach of FBI systems through an Oracle PeopleSoft zero-day vulnerability. The attack, which occurred in September 2026, compromised FBI-managed AWS GovCloud infrastructure and resulted in the theft of 2-3TB of sensitive data including employee records, Social Security numbers, medical information, and family member details affecting all FBI personnel. This represents the fourth arrest in recent weeks as law enforcement dismantles the notorious data extortion group. This incident highlights the escalating threat landscape where even premier law enforcement agencies fall victim to sophisticated threat actors exploiting zero-day vulnerabilities and cloud infrastructure weaknesses, demonstrating the urgent need for enhanced cloud security postures across all sectors.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT3 weeks ago

AhsayCBS Zero-Day Chain Enables Stealthy Crypto Mining Campaign

In October 2026, threat actors exploited two unpatched vulnerabilities in AhsayCBS backup management platform - CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (OS command injection) - to deploy webshells and cryptocurrency miners. The attackers chained these vulnerabilities to gain initial access, conduct reconnaissance, and install XMRig miners disguised as Microsoft Edge services across at least five organizations. The malware included sophisticated evasion techniques using AI-assisted PowerShell scripts that detect Task Manager activity and automatically suspend mining operations to avoid detection. This incident highlights the growing trend of cryptomining attacks targeting unpatched enterprise software, particularly backup solutions used by managed service providers. The exploitation of critical infrastructure components like backup systems poses significant operational risks and demonstrates how attackers are increasingly using AI-enhanced tools for stealth and persistence.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Marketing/Advertising/Sales3 weeks ago

Adception Attack: When Trusted Platforms Become Malware Delivery Vectors

In October 2026, cybercriminals launched a sophisticated malvertising campaign dubbed 'Adception' targeting macOS users searching for Claude AI software. The attackers exploited Google Ads and Bing's click-tracking redirects to bypass security measures, directing victims through compromised WordPress sites to fake Claude download pages. The campaign used multi-layered cloaking and clipboard hijacking techniques, substituting legitimate installation commands with malicious Base64-encoded scripts that downloaded unknown payloads from attacker-controlled servers. This incident highlights the evolving sophistication of AI-themed social engineering attacks and the exploitation of trusted advertising platforms. As AI tools become mainstream business applications, attackers increasingly target these popular services to deliver malware while exploiting user trust in legitimate domains and installation processes.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(low)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(low)

Read report

Financial Services3 weeks ago

P7 DarkSword: Advanced iOS Exploit Kit Targets Cryptocurrency Wallets

In October 2026, cybersecurity researchers disclosed P7 DarkSword, an enhanced variant of the DarkSword iOS exploit kit that targets iPhones running iOS 18.4-18.7. This commercial exploit toolkit chains multiple iOS vulnerabilities to escape browser sandboxes, escalate to kernel privileges, and inject payloads into SpringBoard. P7 DarkSword introduces advanced capabilities including on-device cryptocurrency wallet theft, iCloud Keychain extraction, and bidirectional command-and-control communication. The kit has been deployed by multiple threat actors including Turkish surveillance vendor PARS Defense and Russian group Star Blizzard, with recent campaigns attributed to Chinese-speaking operators targeting victims across Saudi Arabia, Turkey, Malaysia, and Ukraine. This incident represents the growing commoditization of mobile exploit kits following their leak into second-hand markets, enabling financially motivated cybercriminals to conduct sophisticated iOS attacks previously limited to nation-state actors.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering3 weeks ago

GhostAction Campaign: How Compromised GitHub Maintainers Exposed Thousands of Repositories

The GhostAction campaign, active since September 2025, has escalated dramatically in October 2026 with attackers compromising high-profile GitHub maintainer accounts including Takashi Kitao (pyxel game engine) and Henry Wu (Uber's athenadriver author). Using stolen personal access tokens, threat actors injected malicious GitHub Actions workflows disguised as security audits into over 500 repositories across tens of thousands of projects. These workflows systematically exfiltrate CI/CD secrets, cloud credentials, AI API keys, and historical git data to attacker-controlled infrastructure via unencrypted HTTP connections, representing one of the largest supply chain attacks targeting developer infrastructure. This incident highlights the critical vulnerability of modern software supply chains as organizations increasingly rely on automated CI/CD pipelines and cloud-native development practices. The attack's sophisticated targeting of maintainer accounts and abuse of trusted automation workflows demonstrates how threat actors are evolving to exploit the interconnected nature of open-source ecosystems.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Law Enforcement3 weeks ago

ShinyHunters FBI Breach: How Contractor Failures Led to Massive Government Data Theft

In September 2026, the ShinyHunters extortion group breached the FBI's jobs portal (FBIjobs.gov) and stole sensitive data on nearly all FBI agents and job applicants. The breach resulted from a security failure when an Accenture contractor failed to implement a critical security patch on Oracle's PeopleSoft HR platform. The stolen data included extensive personal information, details of sensitive job roles, and psychiatric and medical records of FBI personnel. The FBI has arrested three suspected co-conspirators across multiple countries, including a 24-year-old in the Netherlands, a suspect in Jordan who is cooperating with authorities, and most recently a Canadian citizen arrested in Pennsylvania. This incident highlights the growing sophistication of extortion groups targeting high-profile government agencies and the critical risks posed by third-party contractor vulnerabilities in managing sensitive federal systems and data.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(high)

IImpact(high)

Read report

Government Administration3 weeks ago

ShinyHunters vs FBI: When Cybercriminals Strike Back at Law Enforcement

In October 2026, the ShinyHunters cybercrime collective claimed to have breached the FBI through a third-party jobs portal, allegedly obtaining data on nearly every FBI employee and job applicant. The group defaced the compromised website with their signature Umbreon Pokemon symbol and claimed the attack was retaliation against FBI characterizations of their activities involving swatting and victim harassment. The FBI responded aggressively, coordinating with international partners to arrest suspected ShinyHunters members in Jordan and the Netherlands within weeks of the incident. This incident highlights the escalating boldness of financially motivated threat actors willing to directly target U.S. government agencies, demonstrating how third-party vendor risks continue to expose critical infrastructure to sophisticated cybercrime groups with international reach and advanced operational security.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Banking/Mortgage3 weeks ago

Venezuelan Cartel's Cyber Evolution: How Tren de Aragua Weaponized ATM Malware

In October 2026, US authorities arrested Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan member of the Tren de Aragua criminal cartel and the first cybercriminal ever placed on the FBI's Ten Most Wanted Fugitives list. Canelon Aguirre, known as "Prometheus" and "The Engineer," was the principal architect of the Ploutus-D malware used in ATM jackpotting schemes that compromised cash machines across Latin and North America. The cartel physically implanted malware into ATMs, allowing remote control to dispense cash to money mules, then laundered over $5.1 million through Venezuelan, Mexican, and Colombian cryptocurrency networks including TRON. This case demonstrates how traditional criminal organizations are increasingly integrating sophisticated cyber capabilities into their operations. The convergence of physical access, custom malware development, and cryptocurrency laundering represents a new evolution in organized crime that bridges cybercrime with terrorist financing and transnational criminal enterprises.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering3 weeks ago

AgentCorruption: How One AI Prompt Nearly Broke AWS Security

In December 2025, Zenity Labs discovered 'AgentCorruption,' a critical vulnerability in AWS Bedrock AgentCore that allowed attackers to compromise entire AWS environments through a single malicious prompt to AI agents. The flaw exploited AWS Instance Metadata Services (IMDS) access within Firecracker MicroVMs, enabling lateral movement across all AgentCore resources in affected regions. Attackers could obtain temporary credentials, invoke additional agents, access secrets from AWS Secrets Manager, and poison agent memory through overprivileged default roles and insufficient network isolation. This incident highlights the growing security risks as organizations rapidly deploy AI agents in cloud environments without proper isolation controls. The vulnerability demonstrates how AI and cloud security intersect, creating new attack vectors that traditional security measures may not adequately address.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services3 weeks ago

The New Threat Vector: How Cybercriminals Target Executive Families to Breach Corporate Networks

Cybercriminals are increasingly targeting executives' family members and personal contacts as a pathway to corporate networks, exploiting the weaker security postures of non-technical household members. Research shows that 51% of organizations reported attacks on business leaders in 2025, with 39% of executives having already compromised devices during security onboarding. Attackers leverage AI-enhanced reconnaissance to map family relationships through social media, then execute impersonation attacks, device compromises, and sophisticated phishing campaigns targeting spouses, children, and trusted associates. The consequences extend beyond digital breach to physical surveillance, extortion, and fraudulent financial transfers. This trend represents a critical evolution in social engineering tactics, where the weakest link in an executive's personal ecosystem becomes the entry point for enterprise compromise, demanding immediate expansion of security awareness programs beyond corporate boundaries.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

1...31 32 33 34 35...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Critical SonicWall SMA1000 Vulnerability Under Active Exploitation: CVE-2026-102255 Analysis

International Cooperation Targets Qilin Ransomware Leadership in Historic Germany-Japan Extradition

FBI Arrests Another ShinyHunters Member After Massive Agency Breach Exposes Employee Data

AhsayCBS Zero-Day Chain Enables Stealthy Crypto Mining Campaign

Adception Attack: When Trusted Platforms Become Malware Delivery Vectors

P7 DarkSword: Advanced iOS Exploit Kit Targets Cryptocurrency Wallets

GhostAction Campaign: How Compromised GitHub Maintainers Exposed Thousands of Repositories

ShinyHunters FBI Breach: How Contractor Failures Led to Massive Government Data Theft

ShinyHunters vs FBI: When Cybercriminals Strike Back at Law Enforcement

Venezuelan Cartel's Cyber Evolution: How Tren de Aragua Weaponized ATM Malware

AgentCorruption: How One AI Prompt Nearly Broke AWS Security

The New Threat Vector: How Cybercriminals Target Executive Families to Breach Corporate Networks

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Critical SonicWall SMA1000 Vulnerability Under Active Exploitation: CVE-2026-102255 Analysis

International Cooperation Targets Qilin Ransomware Leadership in Historic Germany-Japan Extradition

FBI Arrests Another ShinyHunters Member After Massive Agency Breach Exposes Employee Data

AhsayCBS Zero-Day Chain Enables Stealthy Crypto Mining Campaign

Adception Attack: When Trusted Platforms Become Malware Delivery Vectors

P7 DarkSword: Advanced iOS Exploit Kit Targets Cryptocurrency Wallets

GhostAction Campaign: How Compromised GitHub Maintainers Exposed Thousands of Repositories

ShinyHunters FBI Breach: How Contractor Failures Led to Massive Government Data Theft

ShinyHunters vs FBI: When Cybercriminals Strike Back at Law Enforcement

Venezuelan Cartel's Cyber Evolution: How Tren de Aragua Weaponized ATM Malware

AgentCorruption: How One AI Prompt Nearly Broke AWS Security

The New Threat Vector: How Cybercriminals Target Executive Families to Breach Corporate Networks

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?