Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Think Tanks

Breach intelligence, attack campaigns, and threat reports targeting the Think Tanks sector.

18 threat reports
Page 1 of 2
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Think Tanks Threat Reports

Showing 1–12 / 18 reports
APT29's DarkSword Watering-Hole Campaign: How Russia's SVR Turned Analytics Scripts Into Mobile Spy Tools
APT29's DarkSword Watering-Hole Campaign: How Russia's SVR Turned Analytics Scripts Into Mobile Spy Tools
Government Administration1 day ago

APT29's DarkSword Watering-Hole Campaign: How Russia's SVR Turned Analytics Scripts Into Mobile Spy Tools

In 2026, Russia's APT29 (Cozy Bear / Midnight Blizzard) executed a multi-vector watering-hole campaign that compromised legitimate websites—including a Ukrainian analytics provider (Plerdy), a US chemical-industry trade association, and a Bulgarian military site—as well as lookalike domains impersonating high-profile brands. Malicious JavaScript fingerprinted visiting iOS and Android devices, then delivered tailored exploit chains exploiting CVE-2025-43529, CVE-2024-27834, and the multi-stage DarkSword kit to harvest SMS, credentials, messaging-app data, and authentication tokens from thousands of unpatched mobile devices across Ukraine, Europe, and the United States. The campaign signals a structural shift in nation-state tradecraft: packaged n-day mobile exploit kits sourced from commercial surveillance vendors are lowering the barrier to mass mobile espionage. As APT29 moves beyond traditional endpoint and cloud targets toward supply-chain injection into widely used analytics scripts, organizations must treat third-party JavaScript dependencies and unmanaged mobile endpoints as first-class attack surfaces.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Storm-0940 and ARTEX: How China's AI-Powered Agents Hijacked ConnectWise and 2,250 Microsoft 365 Tenants
Storm-0940 and ARTEX: How China's AI-Powered Agents Hijacked ConnectWise and 2,250 Microsoft 365 Tenants
Information Technology/IT2 weeks ago

Storm-0940 and ARTEX: How China's AI-Powered Agents Hijacked ConnectWise and 2,250 Microsoft 365 Tenants

In October 2026, Microsoft attributed a sophisticated supply-chain attack against ConnectWise's Cloud Backup service to Storm-0940, a China-state aligned threat actor active since 2021. The group leveraged ARTEX, an open-source agentic AI penetration testing framework, to automate password-spraying at 2,900 sign-in attempts per minute, ultimately targeting more than 2,250 Microsoft 365 tenants across eight organizations. AI agents autonomously progressed from initial authentication through reconnaissance, OAuth abuse, credential modification, and privilege escalation with minimal human interaction. ConnectWise temporarily shut down services following the attack, and Microsoft confirmed evidence of follow-on persistence activity in multiple customer environments. This incident marks a critical inflection point in nation-state tradecraft: the weaponization of agentic AI frameworks enables adversaries to compress attack timelines from days to minutes, outpacing human defenders. The combination of supply-chain entry, AI-driven automation, and OAuth abuse signals a new era of high-velocity, low-visibility intrusions that demand equally automated defensive countermeasures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Russian and Iranian Actors Weaponize OpenAI's ChatGPT for Sophisticated Influence Operations
Russian and Iranian Actors Weaponize OpenAI's ChatGPT for Sophisticated Influence Operations
Newspapers/Journalism1 month ago

Russian and Iranian Actors Weaponize OpenAI's ChatGPT for Sophisticated Influence Operations

In 2024, OpenAI identified and disrupted two sophisticated AI-powered influence operations conducted by Russian and Iranian threat actors who used ChatGPT to create fake journalist personas and fraudulent think tanks. The Russian campaign, dubbed 'Dark Clark,' successfully established the Social Research Center as a front organization, employing unwitting Latin American staff to spread anti-Ukraine propaganda and interfere in regional politics through fabricated audio clips and disinformation. The Iranian operation created seven fake journalist identities that placed nearly 100 articles across legitimate international media outlets, focusing on U.S.-Iran tensions and Middle Eastern geopolitics. This incident represents a critical evolution in information warfare, demonstrating how nation-state actors are leveraging generative AI to scale and legitimize disinformation campaigns. The successful infiltration of mainstream media through AI-generated content highlights an emerging threat vector that traditional security controls are not designed to detect or prevent.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
TA419 Espionage: Chinese Hackers Impersonate US Officials to Target AI Policy Experts
TA419 Espionage: Chinese Hackers Impersonate US Officials to Target AI Policy Experts
Think Tanks1 month ago

TA419 Espionage: Chinese Hackers Impersonate US Officials to Target AI Policy Experts

In July 2026, Chinese threat actor TA419 conducted sophisticated cyber espionage operations targeting AI policy experts at US think tanks, universities, and legal organizations. The attackers impersonated high-profile US officials including former White House Office of Science and Technology Policy leadership and prominent economists to establish credibility with targets. They used social engineering tactics to invite victims to fictitious AI policy committees before deploying adversary-in-the-middle (AiTM) phishing attacks through fake OneDrive pages, successfully capturing credentials and authenticated sessions even when multifactor authentication was enabled. This incident represents a significant escalation in state-sponsored targeting of AI governance and policy development, occurring amid intensifying US-China strategic competition over artificial intelligence capabilities and export controls. The attack demonstrates how threat actors are adapting traditional espionage methods to exploit the growing importance of AI policy in national security frameworks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How China's TA419 Exploited Trust to Target U.S. AI Policy Leadership
How China's TA419 Exploited Trust to Target U.S. AI Policy Leadership
Think Tanks1 month ago

How China's TA419 Exploited Trust to Target U.S. AI Policy Leadership

In 2026, China-aligned threat actor TA419 conducted sophisticated credential phishing campaigns targeting U.S. AI policy experts at think tanks, universities, and legal organizations. The attacks used adversary-in-the-middle (AitM) techniques, impersonating prominent economists, AI policymakers, and Anthropic employees to establish trust before deploying frameless browser-in-the-browser attacks through OneDrive phishing pages. The campaigns successfully captured Microsoft credentials and session cookies while maintaining the appearance of legitimate sign-ins, supporting Chinese intelligence objectives to understand U.S. AI policy developments amid strategic competition and export controls. This incident highlights the escalating cyber espionage targeting AI governance as nation-states recognize artificial intelligence as a critical strategic domain, with threat actors adapting sophisticated social engineering and evasive phishing techniques to penetrate policy circles.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
China-Nexus UAT-11587 Weaponizes Microsoft 365 in Multi-Nation Government Espionage Campaign
China-Nexus UAT-11587 Weaponizes Microsoft 365 in Multi-Nation Government Espionage Campaign
Government Administration1 month ago

China-Nexus UAT-11587 Weaponizes Microsoft 365 in Multi-Nation Government Espionage Campaign

Government and policy organizations across eight Asian countries including Taiwan, India, Philippines, Cambodia, Pakistan, Thailand, Myanmar, and Syria became targets of a sophisticated China-nexus espionage campaign orchestrated by threat actor UAT-11587 between September 2025 and June 2026. The attackers deployed a previously undocumented Rust-compiled backdoor called Antino, which uniquely leverages Microsoft 365 services including Outlook and OneDrive as command-and-control infrastructure instead of traditional C2 servers. The campaign utilized highly targeted spear-phishing emails with spoofed sender identities and fake Gmail attachment widgets to deliver multi-stage payloads, ultimately enabling host reconnaissance, shell execution, file transfer, and persistent access to compromised government systems. This incident demonstrates the evolving sophistication of nation-state actors who are increasingly abusing legitimate cloud services to blend malicious traffic with normal business communications, making detection significantly more challenging for traditional security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
China-Linked TA419 Targets AI Policy Experts in Sophisticated Phishing Campaign
China-Linked TA419 Targets AI Policy Experts in Sophisticated Phishing Campaign
Think Tanks1 month ago

China-Linked TA419 Targets AI Policy Experts in Sophisticated Phishing Campaign

China-aligned cyber espionage group TA419 conducted sophisticated phishing campaigns targeting U.S. AI policy experts, researchers, and think tank analysts from February through July 2025. The threat actors impersonated high-profile officials including former White House OSTP deputy director Lynne Parker, economist Heidi Crebo-Rediker, and senior Anthropic employees to establish trust with targets. Using adversary-in-the-middle techniques and modified Frameless BitB tools, attackers created fake Microsoft OneDrive sign-in pages to harvest credentials and active browser sessions from victims at universities, law firms, and defense contractors. This campaign represents a strategic shift toward targeting AI policy development and export control discussions amid escalating U.S.-China technological competition. The attacks demonstrate increasing sophistication in social engineering, leveraging current geopolitical tensions around AI governance, military applications, and semiconductor supply chains to make their impersonation attempts more credible and urgent.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns
Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns
Government Administration1 month ago

Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns

In September 2026, Microsoft researchers identified a new malware delivery technique called 'RedFlick' being used by the Russian state-sponsored threat actor Star Blizzard (also known as COLDRIVER). This campaign represents a significant evolution in the group's tactics, streamlining their malware delivery process through automated scheduled tasks that deploy the CosmicPulse backdoor with minimal victim interaction. The attacks begin with phishing emails containing password-protected archives that house VHDX virtual disks with malicious LNK files disguised as PDFs. Microsoft observed at least 13 large-scale campaigns since early 2026, impacting over 100 organizations primarily in the US and UK, with particular focus on Ukrainian institutions and international organizations supporting Ukraine. This incident highlights the ongoing sophistication of state-sponsored cyber operations and the continuous evolution of attack methodologies. As geopolitical tensions remain high, organizations must prepare for increasingly automated and evasive attack chains that bypass traditional security controls through legitimate system utilities and scheduled task abuse.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Star Blizzard's RedFlick Evolution: How Russian APT Streamlined Phishing Attacks in 2026
Star Blizzard's RedFlick Evolution: How Russian APT Streamlined Phishing Attacks in 2026
Civic/Social Organization1 month ago

Star Blizzard's RedFlick Evolution: How Russian APT Streamlined Phishing Attacks in 2026

Russia's Star Blizzard APT group has evolved its phishing tactics in 2026, abandoning the multi-step ClickFix technique for a streamlined approach called RedFlick. Since January 2026, the FSB-linked threat actor has conducted 13 large-scale phishing campaigns targeting Ukrainian-linked NGOs, think tanks, and journalists worldwide. RedFlick reduces victim interaction to a single click while deploying the CosmicPulse backdoor through scheduled tasks and legitimate Windows utilities, significantly increasing the success rate of initial compromise attempts. This incident highlights the accelerating evolution of state-sponsored phishing operations, where APT groups are prioritizing operational efficiency over surgical precision. As geopolitical tensions persist, organizations supporting Ukraine or conducting Russia-related research face increasingly sophisticated and scalable attack vectors that require enhanced email security and user awareness programs.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Star Blizzard Scales Espionage Operations with RedFlick Malware Campaign
Star Blizzard Scales Espionage Operations with RedFlick Malware Campaign
Government Administration1 month ago

Star Blizzard Scales Espionage Operations with RedFlick Malware Campaign

In 2026, Russian FSB-affiliated threat group Star Blizzard significantly expanded their espionage operations, shifting from targeted spear-phishing to large-scale automated phishing campaigns using novel RedFlick malware. The group launched at least 13 distinct campaigns targeting over 100 organizations primarily in the US and UK, including Ukrainian entities, NGOs, think tanks, and government organizations supporting Ukraine. RedFlick's streamlined infection flow requires only a single user interaction and deploys the CosmicPulse backdoor through scheduled tasks to evade detection. This tactical evolution demonstrates how state-sponsored actors are adapting to increase operational scale and success rates while maintaining stealth capabilities for long-term intelligence collection against geopolitically significant targets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
FBI: North Korean 'Quishing' Campaign Exploits QR Codes to Breach US Organizations (2025)
Think Tanks10 months ago

FBI: North Korean 'Quishing' Campaign Exploits QR Codes to Breach US Organizations (2025)

In May and June 2025, North Korean state-backed group Kimsuky (also known as APT43) launched a wave of spear-phishing attacks leveraging malicious QR codes—known as "quishing"—against U.S. and foreign think tanks, academic institutions, and government entities. Attackers embedded QR codes in spoofed emails designed to bypass enterprise security controls by luring recipients into scanning codes with unmanaged mobile devices. These malicious codes redirected victims to attacker-controlled infrastructure for credential harvesting, cloud account takeover, and the deployment of Android malware such as DocSwap. The campaign enabled threat actors to steal session tokens, circumvent multi-factor authentication, and maintain persistence in organizational environments via compromised identities and secondary phishing from breached mailboxes. This incident underscores a significant shift toward MFA-resilient, mobile-driven spear-phishing tactics that exploit overlooked security gaps at the intersection of email and mobile authentication. The campaign represents a new wave of targeted attacks exploiting trust in QR codes and mobile workflows as adversaries adapt to improved enterprise email defenses.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
APT28 Targets Energy and Policy Sectors With Sophisticated Credential Phishing (2025)
Oil/Energy/Solar/Greentech10 months ago

APT28 Targets Energy and Policy Sectors With Sophisticated Credential Phishing (2025)

Between February and September 2025, Russian state-sponsored APT28 (aka BlueDelta, linked to the GRU) launched highly targeted credential-harvesting attacks against individuals in Turkish energy and nuclear agencies, a European think tank, and organizations in North Macedonia and Uzbekistan. The campaign relied on phishing emails with region-specific lures and fake login pages imitating Microsoft OWA, Google, and Sophos VPN portals. Stolen credentials were exfiltrated via disposable internet services, and victims were seamlessly redirected to legitimate sites to avoid suspicion, evading typical detection methods. Notably, attackers leveraged legitimate PDF documents themed around high-profile geopolitical events as decoy content. These incidents underscore the increasing sophistication and operational focus of nation-state phishing campaigns, with attackers rapidly exploiting current geopolitical tensions to credibly target sensitive sectors. Repeated use of trusted public infrastructure for data exfiltration further complicates defense and detection efforts.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports