STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 529 to 540 of 6836 threat reports

Computer Software/Engineering4 weeks ago

Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security

In October 2026, threat actors compromised Microsoft's official X account, which has over 13 million followers, to execute a cryptocurrency pump-and-dump scheme promoting a fraudulent $Clippy token. The attackers hijacked the account to follow and repost content from impersonation accounts claiming the token had liquidity paired with Microsoft stock. Microsoft confirmed the unauthorized access, removed the malicious posts, secured the account, and disavowed any connection to cryptocurrency projects while threatening legal action against the perpetrators. This incident highlights the escalating trend of social media account takeovers targeting high-profile organizations for cryptocurrency fraud, following similar attacks on Microsoft India's account and the SEC's official X account that manipulated Bitcoin prices.

Medium impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Information Technology/IT4 weeks ago

Dell Container Storage Modules Hit by Critical Authentication Bypass Vulnerabilities

In October 2026, Dell disclosed six critical vulnerabilities in its Container Storage Modules (CSM) that connect enterprise storage arrays to Kubernetes environments. Two maximum-severity flaws (CVE-2026-63688 and CVE-2026-63692) allow unauthenticated remote attackers to bypass authentication and gain complete administrative control over storage infrastructure across all tenants. Four additional critical vulnerabilities enable attackers to gain root access on cluster nodes, forge authentication tokens, and bypass Kubernetes access controls. Dell immediately urged customers to upgrade to CSM version 1.18.0 or later. This incident highlights the escalating risks to containerized storage infrastructure as organizations increasingly adopt Kubernetes for enterprise workloads. With state-sponsored groups like Lazarus and Chinese APT UNC6201 previously exploiting Dell vulnerabilities in the wild, these authentication bypass flaws represent a significant supply chain risk that could enable complete compromise of multi-tenant storage environments.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Banking/Mortgage4 weeks ago

Treasury Sanctions Tren de Aragua Gang for $40M ATM Jackpotting Campaign

The U.S. Treasury Department sanctioned eight members of Venezuelan gang Tren de Aragua in October 2026 for their role in sophisticated ATM jackpotting attacks that have stolen $40.73 million from U.S. financial institutions across over 1,500 incidents. Led by Anibal Alexander Canelon Aguirre ("Prometheus"), the criminal network deployed malware including Ploutus, ATMii, and GreenDispenser to force ATMs to dispense cash, then laundered proceeds through cryptocurrency addresses receiving $6.1 million in total inflows. The Treasury also designated seven TRON blockchain addresses linked to the operation, highlighting the gang's use of cryptocurrency for money laundering. This incident demonstrates the evolving threat landscape where traditional organized crime groups increasingly leverage sophisticated malware and cryptocurrency infrastructure to target critical financial infrastructure, requiring enhanced egress security controls and blockchain transaction monitoring.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering4 weeks ago

GitLab AI Gateway Under Attack: Critical RCE Vulnerability Exposes Development Infrastructure

GitLab disclosed a critical remote code execution vulnerability (CVE-2026-90970) in its AI Gateway service that allows authenticated users with Duo Agent Platform access to execute arbitrary commands on vulnerable instances. The flaw stems from improper neutralization weakness, enabling attackers to escape prompt template sandboxes through specially crafted flow configurations. GitLab released emergency patches (versions 19.2.4, 19.3.2, and 19.4.1) for self-hosted instances and conducted targeted outreach to affected customers before public disclosure. Cloud-hosted AI Gateway instances were already protected. This vulnerability highlights the growing attack surface of AI-integrated development platforms as organizations rapidly adopt AI-powered DevSecOps tools. With GitLab serving over 30 million users including 50% of Fortune 100 companies, this incident underscores the critical need for robust security controls around AI gateway services that bridge development environments with AI capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Utilities4 weeks ago

Warlock Ransomware Campaign Exploits SharePoint Flaws to Target Critical Infrastructure

The China-linked Warlock ransomware group (also tracked as Longlegs and Storm-2603) conducted a sophisticated attack campaign targeting critical infrastructure including water utilities, telecom providers, regional governments, and universities across Portuguese and Spanish-speaking regions. The group exploited the ToolShell vulnerability chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, and CVE-2025-53771) in Microsoft SharePoint deployments to gain initial access, then deployed EDR-killing tools via BYOVD techniques affecting up to 40 hosts within two hours before executing ransomware on 33 systems. This incident highlights the growing convergence of state-sponsored APT tactics with ransomware operations, demonstrating how sophisticated threat actors are increasingly targeting critical infrastructure through supply chain vulnerabilities and leveraging legitimate tools like Visual Studio Code tunneling for persistence and remote access.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(low)

IImpact(high)

Read report

Information Technology/IT4 weeks ago

Critical Dell Container Storage Module Vulnerabilities Expose Kubernetes Infrastructure to Complete Compromise

In October 2026, Dell disclosed six critical security vulnerabilities in its Container Storage Modules (CSM) affecting all versions prior to 1.17.0. The flaws, including two with perfect CVSS 10.0 scores (CVE-2026-63688 and CVE-2026-63692), enable unauthenticated attackers to gain complete administrative control over storage infrastructure, bypass authentication mechanisms, and achieve root-level access on Kubernetes cluster nodes. The vulnerabilities stem from missing authentication controls, hardcoded credentials, and improper privilege management, allowing attackers to forge administrative tokens and manipulate storage resources across all connected tenants. This disclosure highlights the growing attack surface in cloud-native infrastructure as organizations increasingly adopt containerized storage solutions. With Dell products having faced active exploitation in recent years, these vulnerabilities underscore the critical importance of securing Kubernetes environments and storage orchestration platforms.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Government Administration4 weeks ago

China-Nexus UAT-11587 Weaponizes Microsoft 365 in Multi-Nation Government Espionage Campaign

Government and policy organizations across eight Asian countries including Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria became targets of a sophisticated China-nexus espionage campaign orchestrated by threat actor UAT-11587 between September 2025 and June 2026. The attackers deployed a previously undocumented Rust-compiled backdoor called Antino, which uniquely leverages Microsoft 365 services including Outlook and OneDrive as command-and-control infrastructure instead of traditional C2 servers. The campaign utilized highly targeted spear-phishing emails with spoofed sender identities and fake Gmail attachment widgets to deliver multi-stage payloads, ultimately enabling host reconnaissance, shell execution, file transfer, and persistent access to compromised government systems. This incident demonstrates the evolving sophistication of nation-state actors who are increasingly abusing legitimate cloud services to blend malicious traffic with normal business communications, making detection significantly more challenging for traditional security controls.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering4 weeks ago

GitLab Patches Critical AI Gateway Vulnerability Enabling Command Execution

GitLab disclosed a critical vulnerability (CVE-2026-90970) with a CVSS score of 9.9 affecting its AI Gateway service, allowing authenticated users with Duo Agent Platform access to execute arbitrary commands on self-hosted gateway instances. The flaw enables prompt template sandbox escapes through specially crafted flow configurations, potentially compromising gateway infrastructure that holds sensitive JWT signing keys and connects to AI model providers. GitLab has patched the vulnerability in gateway versions 19.2.4, 19.3.2, and 19.4.1, and strongly recommends immediate updates for self-hosted deployments. This incident highlights the growing attack surface of AI-integrated development platforms as organizations increasingly adopt AI-powered workflows and autonomous systems, making secure AI gateway configurations critical for preventing unauthorized access to sensitive AI infrastructure and model interactions.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Primary/Secondary Education4 weeks ago

Frontline Education Breach Exposes Critical Gaps in EdTech Supply Chain Security

In August 2026, Frontline Education, a major edtech company serving school districts nationwide, suffered a significant data breach when attackers exploited a vulnerability in third-party software to gain unauthorized access to their systems. The incident exposed sensitive employee information including Social Security numbers, email addresses, and physical addresses of school district personnel across multiple districts. Frontline detected the breach on August 14, 2026, and engaged cybersecurity experts and law enforcement while implementing remediation measures and offering affected individuals two years of free credit monitoring services through TransUnion. This incident highlights the growing vulnerability of educational technology infrastructure and the cascading risks of third-party software dependencies in critical sectors like education, where sensitive employee and student data is increasingly targeted by cybercriminals.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(high)

IImpact(high)

Read report

Government Administration1 month ago

Zero-Day Response Strategies: Lessons from Kiteworks and Citrix NetScaler Incidents

In September 2026, two major cybersecurity incidents highlighted contrasting approaches to zero-day vulnerability response. Citrix NetScaler systems faced active exploitation of two zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) detected by GreyNoise Intelligence, with remote code execution attacks originating from US-based IP addresses. While Citrix initially remained silent about the attacks and later released patches for eight vulnerabilities, data protection provider Kiteworks took the unprecedented step of proactively advising customers to shut down systems for nine hours based on intelligence about an imminent zero-day attack affecting 1% of their customer base. This incident underscores the growing challenge of zero-day response in an era where threat actors increasingly target network infrastructure and data protection platforms. The contrasting vendor responses reveal the complex balance between operational continuity and proactive security measures, particularly as organizations face mounting pressure to prevent data breaches in highly regulated industries.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Financial Services1 month ago

The Industrialization of EDR Evasion: How Gentlemen RaaS Transformed Cybercrime

The Gentlemen ransomware-as-a-service operation emerged in late 2025 and rapidly scaled to become a top-five ransomware gang by Q1 2026, fundamentally transforming EDR evasion from individual hacker tricks into an industrialized service economy. The group developed GentleKiller, a comprehensive EDR killer framework featuring eight variants that abuse vulnerable drivers from NSecsoft, Zemana, Qihoo 360, and Safetica to terminate over 400 security processes across 48 different security products. Their business model offers affiliates a generous 90% revenue share while centralizing the most technically complex evasion capabilities, effectively democratizing kernel-level EDR bypass techniques to low-skill operators. This incident represents a critical inflection point in the ransomware ecosystem where sophisticated evasion capabilities are now productized, maintained, and distributed at scale, creating persistent threats that survive individual takedowns and continuously evolve through centralized development.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Telecommunications1 month ago

Sophisticated APT Campaign Targets Asian Email Security Appliances with Mimetic Linux Backdoors

In October 2026, cybersecurity researchers discovered sophisticated Linux backdoors targeting Asian email security appliances, specifically mimicking Korean SpamSniper and Taiwanese ShareTech products. The campaign involved updated variants of BPFdoor and Rekoobe malware, along with a novel RAT called AVERAT, all designed to blend seamlessly with legitimate mail security operations. These implants used advanced stealth techniques including passive activation via HTTPS requests, ICMP propagation, and command-and-control communications over SMTP port 25 to evade detection while maintaining persistent access to telecommunications and government networks. This incident highlights the evolving sophistication of APT groups in developing infrastructure-aware malware that exploits the trusted position of security appliances. As organizations increasingly rely on edge security devices that cannot run traditional endpoint detection tools, attackers are capitalizing on these blind spots to establish long-term footholds in critical networks.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

1...43 44 45 46 47...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security

Dell Container Storage Modules Hit by Critical Authentication Bypass Vulnerabilities

Treasury Sanctions Tren de Aragua Gang for $40M ATM Jackpotting Campaign

GitLab AI Gateway Under Attack: Critical RCE Vulnerability Exposes Development Infrastructure

Warlock Ransomware Campaign Exploits SharePoint Flaws to Target Critical Infrastructure

Critical Dell Container Storage Module Vulnerabilities Expose Kubernetes Infrastructure to Complete Compromise

China-Nexus UAT-11587 Weaponizes Microsoft 365 in Multi-Nation Government Espionage Campaign

GitLab Patches Critical AI Gateway Vulnerability Enabling Command Execution

Frontline Education Breach Exposes Critical Gaps in EdTech Supply Chain Security

Zero-Day Response Strategies: Lessons from Kiteworks and Citrix NetScaler Incidents

The Industrialization of EDR Evasion: How Gentlemen RaaS Transformed Cybercrime

Sophisticated APT Campaign Targets Asian Email Security Appliances with Mimetic Linux Backdoors

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Microsoft's X Account Hijacked for Cryptocurrency Fraud: A Wake-Up Call for Social Media Security

Dell Container Storage Modules Hit by Critical Authentication Bypass Vulnerabilities

Treasury Sanctions Tren de Aragua Gang for $40M ATM Jackpotting Campaign

GitLab AI Gateway Under Attack: Critical RCE Vulnerability Exposes Development Infrastructure

Warlock Ransomware Campaign Exploits SharePoint Flaws to Target Critical Infrastructure

Critical Dell Container Storage Module Vulnerabilities Expose Kubernetes Infrastructure to Complete Compromise

China-Nexus UAT-11587 Weaponizes Microsoft 365 in Multi-Nation Government Espionage Campaign

GitLab Patches Critical AI Gateway Vulnerability Enabling Command Execution

Frontline Education Breach Exposes Critical Gaps in EdTech Supply Chain Security

Zero-Day Response Strategies: Lessons from Kiteworks and Citrix NetScaler Incidents

The Industrialization of EDR Evasion: How Gentlemen RaaS Transformed Cybercrime

Sophisticated APT Campaign Targets Asian Email Security Appliances with Mimetic Linux Backdoors

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?