Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Defense/Space

Breach intelligence, attack campaigns, and threat reports targeting the Defense/Space sector.

476 threat reports
Page 37 of 40
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Defense/Space Threat Reports

Showing 433–444 / 476 reports
NSA’s Multi-Tool Cyber Assault on Beijing’s National Time Service Center: Lessons for Critical Infrastructure
Government Administration10 months ago

NSA’s Multi-Tool Cyber Assault on Beijing’s National Time Service Center: Lessons for Critical Infrastructure

In October 2025, China's Ministry of State Security (MSS) accused the U.S. National Security Agency (NSA) of orchestrating a sophisticated, multi-stage cyberattack against the National Time Service Center (NTSC) in Beijing. The MSS claims that the NSA deployed at least 42 distinct cyber tools to penetrate critical national infrastructure, leveraging advanced techniques such as encrypted and east-west traffic manipulation, zero trust segmentation circumvention, and covert remote access. The compromise included strategic lateral movement and evasion of detection, reportedly leaving a significant impact on the operational integrity of NTSC, which serves as a reference point for the nation’s official timekeeping and scientific endeavors. This incident marks an escalation in cyber power projection between nation-states and spotlights the increasing use of multi-tool modular attack frameworks by advanced persistent threats (APTs). The breach underscores the urgency for critical infrastructure operators worldwide to reevaluate network segmentation, encrypted communications, and visibility gaps in light of evolving nation-state tactics.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Google Uncovers Rapidly Evolving COLDRIVER Malware Campaigns in 2025
Government Administration10 months ago

Google Uncovers Rapidly Evolving COLDRIVER Malware Campaigns in 2025

In May 2025, Google’s Threat Intelligence Group (GTIG) identified a surge in new malware developed by the Russian state-sponsored hacking group COLDRIVER (also known as Callisto or SEABORGIUM). In rapid succession, three new malware families were discovered, each demonstrating increased sophistication and frequent code variations. The attackers leveraged targeted spear-phishing campaigns to compromise government, defense, and policy sector targets across Europe and North America. The swift adaptation and deployment of these malware strains highlight COLDRIVER’s evolving tradecraft and acceleration of offensive cyber operations, posing heightened risks to sensitive data and infrastructure. This campaign signals a broader trend of rapidly evolving Russian cyber-espionage efforts against Western entities. The increased pace, tooling variation, and focus on intelligence collection underline the critical need for organizations to upgrade monitoring, segmentation, and encryption controls across hybrid cloud and on-prem networks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Windows Smart Card Authentication Breakdowns After 2025 Security Update
Financial Services10 months ago

Microsoft Windows Smart Card Authentication Breakdowns After 2025 Security Update

In October 2025, Microsoft released security updates to address a cryptographic vulnerability (CVE-2024-30098) in Windows platforms, triggering widespread smart card authentication failures. The update, which altered default behavior from using CSP to KSP for RSA-based smart card certificates, disrupted authentication services across Windows 10, Windows 11, and Windows Server systems. Affected organizations reported issues such as failed logins, inability to sign documents, and critical service interruptions in workflows dependent on certificate-based authentication. The root cause was traced to a registry change designed to mitigate a feature bypass risk, inadvertently impacting legacy compatibility and 32-bit applications. This incident highlights how routine security hardening can introduce substantial operational risk, particularly for enterprises relying on legacy authentication methods. As businesses continue their path to zero trust and increase dependency on certificate-based systems, compatibility breakdowns following security improvements are becoming more prominent, amplifying pressures for comprehensive testing and rapid response strategies.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Startling Satellite Breach: How $600 Unlocked a Global Data Leak in 2025
Telecommunications10 months ago

Startling Satellite Breach: How $600 Unlocked a Global Data Leak in 2025

In early 2025, researchers from the University of Maryland and UC San Diego revealed widespread leakage of sensitive and private data—including military and telecom communications—through unencrypted transmissions sent over geostationary (GEO) satellites. By using only $600 in commercially available equipment, the team passively intercepted vast amounts of plaintext data from major organizations, government entities, and telecom users around the globe. The incident highlighted fundamental lapses in network-layer encryption practices, allowing phone calls, SMS messages, internal application data, and even military vessel information to leak with no authentication or protection. The research further demonstrated that even technically unsophisticated actors could compromise critical satellite backhaul links using minimal resources. This event underscores the urgent need for end-to-end encryption and robust monitoring of satellite communications as reliance on these channels increases and barriers to interception continue to fall. Government and industry must now address the rapidly evolving risk landscape, especially as critical infrastructure becomes more dependent on satellite connectivity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Flax Typhoon Turns ArcGIS Features Into Espionage Backdoor: 2024 Breach Analysis
Government Administration10 months ago

Flax Typhoon Turns ArcGIS Features Into Espionage Backdoor: 2024 Breach Analysis

In early 2024, security researchers revealed that Chinese state-backed group Flax Typhoon covertly infiltrated ArcGIS server environments, maintaining backdoor access for over a year by exploiting legitimate software features. By compromising a backend administrator account, attackers deployed a malicious Server Object Extension (SOE) that blended with normal operations, enabling a persistent webshell and establishing a hidden workspace inaccessible to others. Critically, the attackers embedded their access into system backups, ensuring reinfection even after potential forensics or restoration activities. This sophisticated campaign allowed Flax Typhoon to spy on entities across the U.S., Europe, and Taiwan with minimal use of detectable malware. The incident demonstrates a significant shift towards using trusted enterprise software as an attack vector and reveals how recovery mechanisms like backups become liabilities if not properly verified. Similar living-off-the-land techniques are rising in frequency, challenging traditional security monitoring and incident response strategies.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
AI-Powered PRISONBREAK Influence Operation Targets Iran Amid Heightened Tensions
Government Administration10 months ago

AI-Powered PRISONBREAK Influence Operation Targets Iran Amid Heightened Tensions

In early 2025, a coordinated AI-enabled information operation named 'PRISONBREAK' targeted Iranian audiences via over 50 inauthentic X (formerly Twitter) profiles. Likely conducted by an Israeli government agency or contracted group, the operation deliberately synchronized its messaging with Israeli military action against Iran in June 2025. These automated profiles aimed to incite unrest and dissent within Iran, leveraging artificial intelligence to amplify and seed anti-government narratives to large public communities, at times with paid promotion. While organic engagement was limited, several posts garnered tens of thousands of views, representing a sophisticated example of nation-state influence using AI and social media. The operation highlights the new scale and efficiency with which AI can power information warfare, especially when paired with state-level coordination. As similar AI-driven campaigns grow globally, organizations and governments must re-examine detection strategies, policy enforcement, and regulatory frameworks for safeguarding against synthetic and manipulative online content.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
RedNovember: Chinese State-Sponsored Espionage Campaign Hits Global Defense and Tech Sectors
Government Administration10 months ago

RedNovember: Chinese State-Sponsored Espionage Campaign Hits Global Defense and Tech Sectors

Between June 2024 and July 2025, the Chinese state-sponsored threat group RedNovember (overlapping with Storm-2077 and formerly tagged as TAG-100) orchestrated a far-reaching cyber-espionage campaign targeting government, defense, and technology organizations globally. Leveraging weaponized perimeter device exploits and open-source tools like Pantegana and Cobalt Strike, the group gained initial access via widely used firewalls and VPNs, including SonicWall, Fortinet, Palo Alto, and Ivanti Connect Secure. Victims included ministries, intergovernmental bodies, US defense contractors, European manufacturers, and space organizations. The campaign’s impact highlights persistent perimeter vulnerabilities and demonstrated operational scale and stealth through commodity tooling and strategic timing near geopolitical events. This incident underscores the shift toward exploiting edge devices and open-source frameworks for stealth, scalable compromise by advanced actors. The trend signals urgent challenges for organizations relying on perimeter appliances and highlights the need to strengthen monitoring, zero trust segmentation, and compliance-driven security controls across hybrid and multicloud environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Brazilian Military Breach: Zimbra Zero-Day Exploited via Libyan Navy Impersonation
Defense/Space10 months ago

Brazilian Military Breach: Zimbra Zero-Day Exploited via Libyan Navy Impersonation

In early 2024, cyber attackers posing as representatives of the Libyan Navy’s Office of Protocol targeted the Brazilian military using a sophisticated spear-phishing campaign. By leveraging a previously unknown zero-day vulnerability in Zimbra Collaboration Suite and delivering malicious emails through compromised inter-country secure communications channels (ICS), the threat actors successfully bypassed traditional perimeter defenses. The attackers' advanced persistent techniques enabled them to gain unauthorized access, exploit sensitive data, and risk critical communications infrastructure for the Brazilian defense sector, with potential exposure of mission-critical information. This incident highlights the escalating risks posed by zero-day vulnerabilities and state-linked or impersonation-driven threat actors, particularly against government and defense organizations. The unusual attack vector via ICS demonstrates evolving tactics beyond routine phishing, reinforcing the necessity for layered security, real-time threat detection, and robust segmentation controls.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Red Hat Breach 2025: ShinyHunters Escalate GitLab Data Extortion
Computer Software/Engineering10 months ago

Red Hat Breach 2025: ShinyHunters Escalate GitLab Data Extortion

In October 2025, Red Hat suffered a significant data breach after threat actor group Crimson Collective compromised its internal GitLab repositories, exfiltrating nearly 570GB of data including around 800 Customer Engagement Reports (CERs). These reports contained sensitive details about customers’ networks and infrastructure. Following unsuccessful ransom negotiations, Crimson Collective partnered with Scattered Lapsus$ Hunters and ShinyHunters to escalate extortion attempts, publicly posting data samples and demanding payment before a hard deadline. High-profile organizations such as Walmart, HSBC, Bank of Canada, and the US Department of Defense were among affected clients named in the leak. The collaboration between multiple threat actors and the rise of Extortion-as-a-Service operations like ShinyHunters highlight a new era of corporate extortion risk, with increasing pressure on organizations to proactively secure code repositories and sensitive customer communications against rapidly-evolving, multi-actor cyber threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
How a Zimbra Zero-Day Breach Exposed the Brazilian Military: Lessons for Secure Collaboration
Defense/Space10 months ago

How a Zimbra Zero-Day Breach Exposed the Brazilian Military: Lessons for Secure Collaboration

In early 2025, a zero-day vulnerability in Zimbra Collaboration (CVE-2025-27915), a widely used email and collaboration platform, was exploited to target the Brazilian military. Attackers used malicious ICS calendar files containing unsanitized HTML and JavaScript to trigger stored cross-site scripting (XSS) within Zimbra's Classic Web Client. This entry vector effectively bypassed standard security controls and provided attackers the ability to execute malicious code in users' browsers, potentially enabling credential theft, session hijacking, and further movement inside the organization before the vulnerability was patched. The campaign underscores how attackers are increasingly leveraging vulnerabilities in collaborative and communication tools to gain a foothold in targeted organizations and critical infrastructure. This breach is particularly relevant today given the ongoing surge in zero-day exploits against widely deployed business applications, especially in sectors such as government and defense. The rapid weaponization of collaboration-tool vulnerabilities highlights the need for timely patch management, robust segmentation, and vigilant threat detection to combat sophisticated phishing and XSS-based initial access.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
BIETA & CIII Unmasked: China’s MSS Deploys Espionage Through Research Firms in 2025
Government Administration10 months ago

BIETA & CIII Unmasked: China’s MSS Deploys Espionage Through Research Firms in 2025

In October 2025, a detailed investigation revealed that Chinese research firms BIETA (Beijing Institute of Electronics Technology and Application) and CIII were directly implicated in cyber operations orchestrated by China’s Ministry of State Security (MSS). The report, based on personnel link analysis and institutional relationships, highlights how BIETA coordinated with MSS operatives and academic partners to conduct covert cyber-espionage campaigns targeting international entities. These campaigns leveraged advanced tactics, including exploitation of internal network flows and the use of encrypted traffic, to exfiltrate sensitive data undetected. The exposure underscores the persistent and sophisticated nature of state-sponsored cyber threats, as well as risks posed by non-traditional actors collaborating with government intelligence agencies. This incident reflects a broader escalation in state-driven cyber espionage, demonstrating that commercial and academic organizations may serve as active operational arms for nation-state threat actors. As attribution capabilities improve, organizations must reassess third-party relationships and reinforce east-west and encrypted traffic controls to mitigate lateral movement and exfiltration risks.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
How Chinese Front Organizations Exploited Western Research to Advance State Cyber Capabilities
Defense/Space10 months ago

How Chinese Front Organizations Exploited Western Research to Advance State Cyber Capabilities

In early 2024, coordinated investigations revealed that Chinese government-linked academic and research institutions were covertly collaborating with Western organizations and researchers. Operating under seemingly neutral fronts, these entities facilitated the transfer of advanced cyber technologies and expertise, ultimately benefitting the intelligence apparatus of the People’s Republic of China (PRC). The campaign included joint projects, academic exchanges, and technology partnerships that enabled the PRC to sidestep export controls and gain access to cutting-edge cyber defense and offensive capabilities. The outcome potentially undermines intellectual property protections and heightens risks to network and national security within targeted Western sectors. This incident underscores a marked escalation in supply chain and technology transfer tactics used by nation-state actors. As the global competition for cyber advantage intensifies, regulators and organizations must heighten vigilance around academic, research, and cross-border tech collaborations to mitigate risks of inadvertent technology leakage.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports