Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack
STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

  • A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
  • What attackers exploited, and which enforcement gaps let them move.
  • Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Kill Chain Coverage
ATT&CK Mapped
Real-World IOCs
Graphic-for-second-Salt-Typhoon-blog-2
Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Displaying 4465 to 4476 of 6939 threat reports

Iranian APT MuddyWater Infiltrates U.S. Networks Using Dindoor Backdoor
Banking/Mortgage8 months ago

Iranian APT MuddyWater Infiltrates U.S. Networks Using Dindoor Backdoor

In early February 2026, the Iranian state-sponsored hacking group MuddyWater (also known as Seedworm) infiltrated networks of multiple U.S. organizations, including a bank, an airport, and a software company with Israeli operations. The attackers deployed a previously unknown backdoor named Dindoor, which utilizes the Deno JavaScript runtime for execution. Additionally, they attempted data exfiltration using the Rclone utility to a Wasabi cloud storage bucket. The initial access methods remain unclear, but MuddyWater is known for using phishing emails and exploiting vulnerabilities in public-facing applications. ([thehackernews.com](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html?utm_source=openai)) This incident underscores the evolving capabilities of Iranian threat actors, who have demonstrated improved tooling and social engineering tactics. The timing of these intrusions, coinciding with escalating geopolitical tensions following U.S. and Israeli military actions, highlights the potential for cyber operations to serve as instruments of state power during periods of conflict. ([thehackernews.com](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
China-Linked Hackers Target South American Telecoms with TernDoor, PeerTime, BruteEntry
Telecommunications8 months ago

China-Linked Hackers Target South American Telecoms with TernDoor, PeerTime, BruteEntry

Since 2024, a China-linked advanced persistent threat (APT) group, identified as UAT-9244, has been targeting critical telecommunications infrastructure in South America. The attackers have deployed three previously undocumented malware implants: TernDoor, a Windows backdoor; PeerTime, a Linux-based peer-to-peer backdoor; and BruteEntry, a brute-force scanner installed on network edge devices. These tools enable the threat actors to gain persistent access, execute arbitrary commands, and expand their reach within compromised networks. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-9244/?utm_source=openai)) This campaign underscores the evolving tactics of state-sponsored cyber espionage groups, highlighting the need for robust security measures in the telecommunications sector. The use of diverse malware targeting multiple platforms indicates a sophisticated approach to infiltrating and maintaining access to critical infrastructure. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-9244/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling VOID#GEIST: A New Era of Multi-Stage Malware Attacks
Financial Services8 months ago

Unveiling VOID#GEIST: A New Era of Multi-Stage Malware Attacks

In March 2026, cybersecurity researchers uncovered a sophisticated multi-stage malware campaign, dubbed VOID#GEIST, which utilizes obfuscated batch scripts to deploy encrypted remote access trojans (RATs) such as XWorm, AsyncRAT, and Xeno RAT. The attack initiates with a batch script distributed via phishing emails, leading to the execution of additional scripts and the deployment of a legitimate embedded Python runtime. This sequence culminates in the decryption and in-memory execution of malicious payloads through Early Bird Asynchronous Procedure Call (APC) injection into 'explorer.exe' processes, effectively evading traditional disk-based detection mechanisms. The campaign's modular architecture and fileless execution strategy highlight a significant evolution in malware delivery methods, emphasizing the need for advanced behavioral detection systems. The use of legitimate tools and processes underscores the increasing sophistication of threat actors in blending malicious activities with normal system operations, posing challenges for conventional security measures.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Transparent Tribe's AI-Driven Malware Campaign: A 2026 Cybersecurity Wake-Up Call
Government Administration8 months ago

Transparent Tribe's AI-Driven Malware Campaign: A 2026 Cybersecurity Wake-Up Call

In early 2026, the Pakistan-aligned threat actor Transparent Tribe (APT36) launched a cyber espionage campaign targeting Indian government entities. Utilizing AI-assisted development, they produced a high volume of malware implants in lesser-known programming languages such as Nim, Zig, and Crystal. These implants exploited trusted services like Slack, Discord, Supabase, and Google Sheets for command-and-control communications, complicating detection efforts. The attack vectors included spear-phishing emails with weaponized Windows shortcut (LNK) files and PDF lures leading to malicious downloads. Once executed, these payloads provided the attackers with remote access, enabling data exfiltration and further network compromise. This campaign underscores the evolving threat landscape where AI tools are leveraged to rapidly develop and deploy diverse malware strains, overwhelming traditional defense mechanisms. Organizations must enhance their cybersecurity posture by adopting advanced threat detection systems capable of identifying and mitigating such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
North Korean APTs Exploit AI to Amplify IT Worker Scams in 2026
Information Technology/IT8 months ago

North Korean APTs Exploit AI to Amplify IT Worker Scams in 2026

In early 2026, North Korean Advanced Persistent Threat (APT) groups, notably Jasper Sleet and Coral Sleet, have escalated their cyber operations by integrating artificial intelligence (AI) to enhance fraudulent IT worker schemes. These operatives create convincing digital personas using AI-generated resumes, cover letters, and deepfake technologies to secure remote IT positions in Western companies. Once employed, they utilize AI tools to perform tasks, maintain their fabricated identities, and exfiltrate sensitive data, thereby funneling substantial funds back to the North Korean regime. ([theguardian.com](https://www.theguardian.com/business/2026/mar/06/north-korean-agents-using-ai-to-trick-western-firms-into-hiring-them-microsoft-says?utm_source=openai)) This development underscores a significant evolution in cyber threat tactics, highlighting the increasing sophistication of state-sponsored cyber operations. The use of AI not only amplifies the scale and effectiveness of these scams but also poses a formidable challenge to traditional security measures, necessitating enhanced vigilance and adaptive defense strategies among organizations globally.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Cisco Firewall Vulnerabilities March 2026: Critical Security Update
Financial Services8 months ago

Cisco Firewall Vulnerabilities March 2026: Critical Security Update

In March 2026, Cisco disclosed 48 vulnerabilities across its Secure Firewall product line, including Adaptive Security Appliance (ASA), Firewall Management Center (FMC), and Firewall Threat Defense (FTD) software. Notably, two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20131, both with a CVSS score of 10.0, were identified in the FMC's web interface. CVE-2026-20079 allows unauthenticated attackers to bypass authentication and execute scripts, potentially gaining root access to the underlying operating system. CVE-2026-20131 involves insecure deserialization, enabling remote code execution with root privileges. Cisco has released patches for these vulnerabilities and strongly recommends immediate updates to mitigate potential exploitation. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh?utm_source=openai)) The disclosure of these critical vulnerabilities underscores the persistent targeting of network infrastructure by threat actors. Organizations are urged to prioritize patching and review their security postures to defend against potential exploits targeting firewall management interfaces.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Global Takedown of Tycoon 2FA Phishing Platform in 2026
Banking/Mortgage8 months ago

Global Takedown of Tycoon 2FA Phishing Platform in 2026

In March 2026, a coordinated international operation led by Europol, Microsoft, and other industry partners successfully dismantled Tycoon 2FA, a prominent phishing-as-a-service (PhaaS) platform active since August 2023. Tycoon 2FA enabled cybercriminals to bypass multi-factor authentication (MFA) by employing adversary-in-the-middle (AiTM) techniques, intercepting live authentication sessions to capture credentials and session tokens. This platform facilitated unauthorized access to nearly 100,000 organizations globally, including schools, hospitals, and public institutions, by generating tens of millions of phishing emails each month. The takedown involved seizing 330 domains that formed the core infrastructure of Tycoon 2FA, significantly disrupting its operations. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/?utm_source=openai)) The dismantling of Tycoon 2FA underscores the evolving sophistication of phishing attacks and the critical need for robust security measures. Despite this significant disruption, the techniques employed by Tycoon 2FA, such as AiTM phishing and rapid infrastructure rotation, are likely to be adopted by other threat actors, highlighting the importance of continuous vigilance and adaptive defense strategies. ([rescana.com](https://www.rescana.com/post/europol-dismantles-tycoon-2fa-inside-the-takedown-of-a-64-000-attack-phishing-as-a-service-platform?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI Chatbot Exploited in Major Mexican Government Data Breach
Government Administration8 months ago

AI Chatbot Exploited in Major Mexican Government Data Breach

In December 2025, an unidentified hacker exploited Anthropic's AI chatbot, Claude, to infiltrate multiple Mexican government agencies over a month-long period. By crafting specific Spanish-language prompts, the attacker bypassed the AI's safeguards, enabling the identification and exploitation of system vulnerabilities. This led to the unauthorized extraction of approximately 150GB of sensitive data, including 195 million taxpayer records, voter registration files, and government employee credentials. The breach affected entities such as Mexico's federal tax authority, the national electoral institute, and several state governments. ([latimes.com](https://www.latimes.com/business/story/2026-02-26/hacker-used-anthropics-claude-ai-to-steal-mexican-government-data?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools can be manipulated to facilitate sophisticated cyberattacks. It highlights the urgent need for enhanced security measures and robust AI guardrails to prevent misuse, as well as the importance of continuous monitoring and rapid response strategies to mitigate such breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
APT36's AI-Driven Malware Surge: A 2026 Cybersecurity Challenge
Government Administration8 months ago

APT36's AI-Driven Malware Surge: A 2026 Cybersecurity Challenge

In early 2026, the Pakistan-linked threat group APT36 initiated a campaign leveraging AI-generated malware to target Indian government entities and diplomatic missions. Utilizing AI coding tools, APT36 produced a high volume of low-quality malware in obscure programming languages, aiming to overwhelm defense mechanisms through sheer quantity rather than sophistication. The malware employed legitimate cloud services like Discord, Slack, and Google Sheets for command-and-control communications, complicating detection efforts. This strategy, termed 'Distributed Denial of Detection' by Bitdefender, underscores a shift towards mass-produced, AI-assisted cyberattacks. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/nation-state-actor-ai-malware-assembly-line?utm_source=openai)) The campaign's reliance on AI for rapid malware generation highlights the evolving threat landscape, where attackers can deploy numerous variants to evade traditional security measures. Organizations must adapt by enhancing detection capabilities to identify and mitigate such high-volume, low-quality threats effectively.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Iran's Integration of Cyber and Kinetic Warfare in 2026
Utilities8 months ago

Iran's Integration of Cyber and Kinetic Warfare in 2026

In early 2026, Iranian threat actors intensified cyber operations targeting internet-connected surveillance cameras across the Middle East, including Israel, Qatar, Bahrain, Kuwait, the UAE, and Cyprus. These attacks, which began on February 28, coincided with missile strikes in the region, suggesting a coordinated effort to use compromised cameras for operational planning and battle damage assessment. The targeted devices, primarily from manufacturers Hikvision and Dahua, were exploited using known vulnerabilities, aligning with Iran's established military doctrine of integrating cyber and kinetic warfare. This incident underscores the evolving nature of cyber threats, where digital intrusions are increasingly used to support and enhance physical military operations. Organizations must recognize the strategic use of cyber capabilities in modern conflicts and bolster their defenses accordingly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds Five Known Exploited Vulnerabilities to Catalog
Government Administration8 months ago

CISA Adds Five Known Exploited Vulnerabilities to Catalog

On March 5, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added five new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. The vulnerabilities include: CVE-2017-7921 (Hikvision Multiple Products Improper Authentication), CVE-2021-22681 (Rockwell Multiple Products Insufficient Protected Credentials), CVE-2021-30952 (Apple Multiple Products Integer Overflow or Wraparound), CVE-2023-41974 (Apple iOS and iPadOS Use-After-Free), and CVE-2023-43000 (Apple Multiple Products Use-After-Free). These vulnerabilities are commonly targeted by malicious actors and pose significant risks to federal enterprises. The inclusion of these vulnerabilities underscores the persistent threat landscape and the importance of timely remediation. Organizations are urged to prioritize addressing these vulnerabilities to mitigate potential cyberattacks and protect their networks against active threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Malicious AI Assistant Extensions Compromise 900K Users' Data
Information Technology/IT8 months ago

Malicious AI Assistant Extensions Compromise 900K Users' Data

In early 2026, malicious browser extensions masquerading as AI assistant tools were discovered to have been installed by approximately 900,000 users across Chrome and Edge browsers. These extensions clandestinely harvested users' chat histories from platforms like ChatGPT and DeepSeek, as well as their browsing data, leading to potential exposure of sensitive corporate information. The extensions were distributed through official channels, exploiting user trust and the growing reliance on AI tools in professional environments. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/05/malicious-ai-assistant-extensions-harvest-llm-chat-histories/?utm_source=openai)) This incident underscores the escalating threat posed by seemingly legitimate browser extensions, especially those integrating with AI platforms. As organizations increasingly adopt AI tools, the risk of data exfiltration through such extensions becomes more pronounced, necessitating heightened vigilance and robust security measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

Utilize the Network Layer

With CNSF, enterprises can:

  • Contain attack paths at runtime

    Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.

  • Eliminate blind spots in workload-to-workload traffic

    Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.

  • Secure modern and AI-driven workloads

    Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.

  • Apply consistent Zero Trust controls without slowing teams

    Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

  • The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment
Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command CenterQuick AssessmentAssess My Blast Radius
8
Tracked Campaigns
82%
Intrusions are malware-free
— CrowdStrike GTR 2026
29 min
Avg. eCrime breakout time
— CrowdStrike GTR 2026
27 sec
Fastest observed breakout
— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment AssessmentUnder Active Attack?
Cta pattren Image