Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Aviation/Aerospace

Breach intelligence, attack campaigns, and threat reports targeting the Aviation/Aerospace sector.

74 threat reports
Page 4 of 7
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Aviation/Aerospace Threat Reports

Showing 37–48 / 74 reports
HeartlessSoul's Targeted Cyber-Espionage on Russian Aviation Firms
Airlines/Aviation6 months ago

HeartlessSoul's Targeted Cyber-Espionage on Russian Aviation Firms

In May 2026, the cyber-espionage group known as HeartlessSoul targeted Russian aviation firms and government agencies to steal sensitive geospatial data. Utilizing phishing emails and malicious advertising campaigns, they distributed malware disguised as legitimate aviation software, including a counterfeit version of GearUP on SourceForge. Once installed, the malware exfiltrated Geographic Information System (GIS) files, GPS data, and other critical infrastructure information. ([therecord.media](https://therecord.media/russia-cyber-espionage-aviation?utm_source=openai)) This incident underscores the increasing focus of cyber-espionage groups on geospatial data, highlighting the need for enhanced cybersecurity measures in sectors reliant on such information. The use of legitimate platforms like SourceForge for malware distribution also emphasizes the evolving tactics of threat actors. ([therecord.media](https://therecord.media/russia-cyber-espionage-aviation?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Insider Threats: Lessons from the BlackCat Ransomware Sentencing
Health Care / Life Sciences6 months ago

Insider Threats: Lessons from the BlackCat Ransomware Sentencing

In May 2026, two former cybersecurity professionals, Ryan Clifford Goldberg and Kevin Tyler Martin, were sentenced to four years in prison for their involvement in BlackCat (ALPHV) ransomware attacks targeting U.S. companies between May and November 2023. Utilizing their insider knowledge, they breached networks of multiple organizations, including a Maryland pharmaceutical company and a California engineering firm, demanding ransoms ranging from $300,000 to $10 million. One victim, a Tampa medical device manufacturer, paid $1.27 million after its servers were encrypted. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/us-ransomware-negotiators-get-4-years-in-prison-over-blackcat-attacks/?utm_source=openai)) This case underscores the evolving threat landscape where trusted insiders exploit their positions to facilitate cyberattacks. The incident highlights the critical need for organizations to implement robust insider threat detection mechanisms and reinforces the importance of comprehensive cybersecurity measures to protect against both external and internal threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Siemens CVE-2025-40745: Addressing Certificate Validation Vulnerabilities in Industrial Software
Automotive6 months ago

Siemens CVE-2025-40745: Addressing Certificate Validation Vulnerabilities in Industrial Software

In April 2026, Siemens disclosed a vulnerability (CVE-2025-40745) in multiple applications, including Siemens Software Center, Simcenter 3D, Simcenter Femap, Simcenter STAR-CCM+, Solid Edge SE2025, Solid Edge SE2026, and Tecnomatix Plant Simulation. The flaw involves improper validation of client certificates when connecting to the Analytics Service endpoint, potentially allowing unauthenticated remote attackers to perform man-in-the-middle attacks. Siemens has released updates to address this issue and recommends users upgrade to the latest versions. This incident underscores the critical importance of proper certificate validation in industrial software to prevent unauthorized data interception and manipulation. Organizations using affected Siemens products should promptly apply the recommended updates to mitigate potential security risks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
GPUBreach: Unveiling the 2026 NVIDIA GDDR6 RowHammer Vulnerability
Computer Games7 months ago

GPUBreach: Unveiling the 2026 NVIDIA GDDR6 RowHammer Vulnerability

In April 2026, researchers from the University of Toronto unveiled 'GPUBreach,' a sophisticated RowHammer attack targeting NVIDIA GPUs equipped with GDDR6 memory. This attack exploits bit-flips in GPU memory to corrupt page tables, granting an unprivileged process arbitrary read/write access to GPU memory. By leveraging vulnerabilities in the NVIDIA driver, attackers can escalate privileges to gain full control over the host system, even with IOMMU protections enabled. The implications are severe, particularly for cloud AI infrastructures and multi-tenant GPU deployments, as GPUBreach enables attackers to compromise entire systems without physical access. This development underscores the evolving nature of hardware-based attacks and the necessity for robust security measures in GPU environments. ([thehackernews.com](https://thehackernews.com/2026/04/new-gpubreach-attack-enables-full-cpu.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Operation TrueChaos: Exploiting Trust in Software Updates
Government Administration7 months ago

Operation TrueChaos: Exploiting Trust in Software Updates

In early 2026, a sophisticated cyber espionage campaign, dubbed 'Operation TrueChaos,' exploited a zero-day vulnerability (CVE-2026-3502) in the TrueConf video conferencing software. This flaw allowed attackers to manipulate the software's update mechanism, distributing malicious updates to all connected clients without proper integrity checks. The campaign primarily targeted government entities in Southeast Asia, enabling the execution of arbitrary code across multiple agencies simultaneously. The attackers leveraged this vulnerability to deploy the Havoc command-and-control framework, facilitating reconnaissance, privilege escalation, and persistent access within the compromised networks. The operation is attributed with moderate confidence to a Chinese-nexus threat actor, based on observed tactics, techniques, and infrastructure choices. This incident underscores the critical need for organizations to implement robust validation mechanisms for software updates and to monitor internal systems for signs of compromise, even within trusted environments. The exploitation of trusted update mechanisms highlights a growing trend where attackers target internal trust relationships to achieve widespread access and control.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Security Alert: PX4 Autopilot MAVLink Vulnerability (CVE-2026-1579)
Aviation/Aerospace7 months ago

Critical Security Alert: PX4 Autopilot MAVLink Vulnerability (CVE-2026-1579)

In March 2026, a critical vulnerability (CVE-2026-1579) was identified in the PX4 Autopilot's MAVLink communication protocol. This flaw allows unauthenticated attackers with access to the MAVLink interface to execute arbitrary shell commands, potentially leading to full system compromise. The vulnerability stems from the protocol's default lack of cryptographic authentication, enabling malicious actors to send unauthorized messages, including those granting interactive shell access. ([thehackerwire.com](https://www.thehackerwire.com/vulnerability/CVE-2026-1579/?utm_source=openai)) This incident underscores the importance of implementing robust authentication mechanisms in communication protocols, especially in critical systems like unmanned aerial vehicles. Organizations utilizing PX4 Autopilot are urged to enable MAVLink 2.0 message signing to mitigate this risk and prevent potential exploitation.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical RCE Vulnerability Discovered in PTC Windchill PLM Software
Automotive7 months ago

Critical RCE Vulnerability Discovered in PTC Windchill PLM Software

In March 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-4681, was discovered in PTC's Windchill Product Lifecycle Management (PLM) software. This flaw, stemming from improper deserialization of untrusted data, affects multiple versions of Windchill PDMLink and FlexPLM. Exploitation of this vulnerability could allow attackers to execute arbitrary code remotely, potentially compromising sensitive product data and disrupting manufacturing processes. PTC has acknowledged the issue and is actively developing a fix. In the interim, they have provided specific mitigation steps, including updates to Apache and IIS server configurations, to protect affected systems. Organizations utilizing Windchill are urged to implement these workarounds immediately to safeguard their environments. This incident underscores the persistent threat posed by software vulnerabilities in critical infrastructure sectors. The exploitation of deserialization flaws remains a favored technique among cyber adversaries, highlighting the necessity for continuous vigilance, timely patching, and adherence to secure coding practices to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
L3Harris Insider Breach: Zero-Day Exploits Sold to Russian Broker
Defense/Space8 months ago

L3Harris Insider Breach: Zero-Day Exploits Sold to Russian Broker

In October 2025, Peter Williams, a 39-year-old Australian national and former general manager at L3Harris's Trenchant division, pleaded guilty to stealing and selling eight zero-day exploits to a Russian broker, Operation Zero. Over a three-year period, Williams transferred these sensitive cyber-exploit components, originally intended for U.S. government and allied use, in exchange for approximately $1.3 million in cryptocurrency. This unauthorized sale resulted in significant national security concerns and financial losses exceeding $35 million for L3Harris. ([techcrunch.com](https://techcrunch.com/2025/10/29/former-l3harris-trenchant-boss-pleads-guilty-to-selling-zero-day-exploits-to-russian-broker/?utm_source=openai)) This incident underscores the critical need for stringent internal security measures within defense contractors, especially concerning personnel with high-level access to sensitive information. The case highlights the growing threat posed by insider threats and the importance of robust monitoring and compliance frameworks to prevent unauthorized dissemination of national security assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Siemens Simcenter Femap and Nastran 2026 File Parsing Vulnerabilities
Aviation/Aerospace8 months ago

Siemens Simcenter Femap and Nastran 2026 File Parsing Vulnerabilities

In February 2026, Siemens disclosed multiple vulnerabilities in its Simcenter Femap and Nastran products, specifically affecting versions prior to V2512. These vulnerabilities, identified as CVE-2026-23715 through CVE-2026-23720, involve out-of-bounds read and write errors, as well as heap-based buffer overflows, which can be exploited by attackers through specially crafted NDB and XDB files. Successful exploitation could lead to application crashes or arbitrary code execution within the context of the current process. Siemens has released version V2512 to address these issues and recommends users update to this latest version. ([cert-portal.siemens.com](https://cert-portal.siemens.com/productcert/html/ssa-965753.html?utm_source=openai)) The disclosure of these vulnerabilities underscores the persistent risks associated with file parsing mechanisms in critical engineering software. Organizations utilizing Simcenter Femap and Nastran should prioritize updating to the patched version to mitigate potential exploitation. This incident highlights the importance of regular software updates and vigilance against malicious file-based attacks in industrial environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerability in Avation Light Engine Pro Exposes Systems to Unauthorized Access
Commercial Real Estate9 months ago

Critical Vulnerability in Avation Light Engine Pro Exposes Systems to Unauthorized Access

In February 2026, a critical vulnerability (CVE-2026-1341) was identified in Avation's Light Engine Pro devices, which are widely deployed in commercial facilities worldwide. The flaw involves the exposure of the device's configuration and control interface without any authentication or access control, potentially allowing unauthorized users to gain full control over the device. This vulnerability poses significant risks, including unauthorized access, data manipulation, and potential disruption of operations. ([itsecuritynews.info](https://www.itsecuritynews.info/avation-light-engine-pro/?utm_source=openai)) The absence of authentication mechanisms in critical infrastructure devices underscores the urgent need for robust security measures. Organizations must prioritize the implementation of authentication protocols and access controls to safeguard against such vulnerabilities, especially in devices integral to operational technology environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
North Korea’s Labyrinth Chollima Splits: New Specialized Threat Groups Emerge in 2024
Defense/Space9 months ago

North Korea’s Labyrinth Chollima Splits: New Specialized Threat Groups Emerge in 2024

In early 2024, researchers from CrowdStrike revealed that the long-active North Korean threat group known as Labyrinth Chollima has formally split into three specialized entities: Labyrinth Chollima (espionage), Golden Chollima, and Pressure Chollima (both focused on cryptocurrency theft). This change followed observed divergences in tactics, malware usage, and sector targeting, with Labyrinth Chollima shifting focus to manufacturing, logistics, aerospace, and defense, often leveraging social engineering and sharing infrastructure with its counterparts. Notably, Pressure Chollima was behind the record-breaking $1.46 billion cryptocurrency heist in 2023, illustrating the scale and sophistication of the new operational structure. This realignment signals increasing specialization and growth within North Korea's cyber apparatus, enabling more targeted attacks and efficient monetization strategies. Organizations in critical industries and the crypto sector face heightened risks as these groups adapt rapidly and circumvent international sanctions by fueling cyber operations with illicit gains.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Columbia Weather Systems MicroServer Critical Firmware Exploits Threaten US Critical Infrastructure
Utilities10 months ago

Columbia Weather Systems MicroServer Critical Firmware Exploits Threaten US Critical Infrastructure

In January 2026, multiple severe vulnerabilities were disclosed in the Columbia Weather Systems MicroServer, impacting critical infrastructure sectors in the United States. Attackers could exploit these flaws—improper restriction of communication channels (CVE-2025-61939), cleartext storage of credentials (CVE-2025-64305), and an exposed webshell with unrestricted shell access (CVE-2025-66620)—to redirect secure connections to malicious devices, gain admin-level web access, and establish persistent shell access with rights to modify or exfiltrate sensitive data. The affected firmware versions allowed attackers with network or admin privileges to perform high-impact actions, risking both operational continuity and data confidentiality for organizations relying on these devices. This incident underscores the growing challenge to secure Internet of Things (IoT) and Industrial Control Systems (ICS), especially as attackers increasingly target insecure firmware, lateral movement vectors, and privileged machine access. Regulatory attention and attacker focus on supply-chain and device firmware attacks continue to intensify, heightening the urgency for proactive remediation and layered ICS defenses.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports