Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Think Tanks

Breach intelligence, attack campaigns, and threat reports targeting the Think Tanks sector.

18 threat reports
Page 2 of 2
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Think Tanks Threat Reports

Showing 13–18 / 18 reports
Kimsuky Leverages QR Code Phishing to Target U.S. Strategic Organizations in 2025
Think Tanks10 months ago

Kimsuky Leverages QR Code Phishing to Target U.S. Strategic Organizations in 2025

In June 2025, the FBI identified a sophisticated spearphishing campaign by North Korean state-backed group Kimsuky (APT43) targeting U.S. organizations involved in North Korea-related policy, research, and strategic consultancy. Attackers used emails containing malicious QR codes—an attack known as 'quishing'—to lure victims from think tanks, government agencies, and academic institutions into scanning codes with mobile devices. Scanned QR codes redirected victims to convincing phishing pages impersonating Microsoft 365, Okta, and other login portals, harvesting credentials and cloud session tokens to circumvent multi-factor authentication measures. The attacks bypassed traditional email security by exploiting unmanaged mobile endpoints and compromised inboxes, posing significant risks to identity security and ongoing policy work. This incident highlights an escalating trend of QR code phishing, enabling attackers to sidestep conventional defenses while targeting sensitive organizations. The campaign underscores the growing threat posed by identity-driven attacks, advanced social engineering, and multi-factor authentication bypass techniques, prompting urgent calls for improved mobile device security postures and enhanced employee awareness programs.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
GRU’s BlueDelta Targets Energy and Research: Advanced Credential Phishing in 2025
Oil/Energy/Solar/Greentech10 months ago

GRU’s BlueDelta Targets Energy and Research: Advanced Credential Phishing in 2025

Between February and September 2025, the Russian state-sponsored threat group BlueDelta (APT28/GRU) conducted a series of targeted credential-harvesting attacks, focusing on organizations in Türkiye, Europe, North Macedonia, and Uzbekistan. The attackers deployed sophisticated phishing lures themed as Microsoft Outlook Web Access, Google, and Sophos VPN portals, abusing free hosting and tunneling services such as Webhook.site and ngrok to capture credentials and exfiltrate data. Victims were redirected through multi-stage phishing chains, and legitimate PDF documents were used to enhance believability and evade detection, ultimately supporting Russian intelligence collection. This incident underlines the evolution of state-sponsored phishing techniques, including automation for credential exfiltration and the increasing abuse of legitimate internet infrastructure. The campaign’s focus on energy and defense sectors reflects heightened geopolitical interest and reinforces the urgent need for robust email and identity security practices across sensitive organizations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft 365 Under Siege: OAuth Device Code Phishing Attacks Surge in 2025
Government Administration10 months ago

Microsoft 365 Under Siege: OAuth Device Code Phishing Attacks Surge in 2025

In late 2025, Microsoft 365 accounts across multiple sectors were targeted in a sophisticated phishing campaign leveraging OAuth device code authorization. Threat actors, including financially motivated group TA2723 and a Russia-aligned group tracked as UNK_AcademicFlare, deceived victims into entering attacker-provided device codes on legitimate Microsoft login portals. This granted attacker-controlled applications elevated access to organizational email and data, bypassing credentials and even multi-factor authentication protections. Attackers utilized phishing kits such as SquarePhish and Graphish, and orchestrated lures mimicking document sharing or salary bonus notifications to maximize engagement and scale. Notably, state-aligned campaigns exploited compromised government accounts to build rapport, targeting U.S. and European government, academic, and transportation sectors. These OAuth-based phishing attacks mark a significant escalation in adversary techniques focusing on authorization abuse rather than credential theft. The surge in such activity since September 2025 demonstrates the growing adaptation of sophisticated phishing kits and highlights a strategic shift toward targeting identity and cloud permissions, reflecting evolving attack surfaces and regulatory scrutiny in cloud security.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
SmudgedSerpent 2025: Espionage Hits Policy Experts Amid Iran-Israel Tensions
Government Administration10 months ago

SmudgedSerpent 2025: Espionage Hits Policy Experts Amid Iran-Israel Tensions

Between June and August 2025, an advanced threat group dubbed UNK_SmudgedSerpent orchestrated a series of targeted cyber espionage campaigns against U.S.-based academics and foreign policy experts. Leveraging spear-phishing and sophisticated social engineering, the attackers exploited topical Iranian political themes to deliver customized malware, enabling data exfiltration and continuous monitoring of sensitive research communications. The campaign coincided with heightened Iran–Israel tensions, harnessing unauthorized east-west network movement and encrypted C2 channels to bypass traditional security controls, resulting in significant exposure of policy research, analysis drafts, and privileged communications. This intrusion highlights the evolving tactics of nation-state-aligned actors who exploit contextual geopolitical unrest to target civilian research and policy infrastructure. The incident underscores the escalating risk to sectors handling sensitive knowledge, while accelerating demands for retroactive compliance audits and robust zero trust segmentation as espionage techniques continue to proliferate.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Iranian APTs Target US Policy Influencers in Sophisticated 2024 Phishing Campaign
Government Administration10 months ago

Iranian APTs Target US Policy Influencers in Sophisticated 2024 Phishing Campaign

In mid-2024, Iranian state-aligned advanced persistent threat (APT) actors launched a sophisticated spear-phishing campaign targeting prominent US foreign policy influencers, think tank members, and government advisors. The attackers employed socially engineered emails and credential harvesting tactics, using well-crafted phishing lures to compromise email accounts and exfiltrate sensitive conversations. While attribution remains uncertain among Iranian groups, the campaign utilized advanced operational security measures, making detection difficult and demonstrating high levels of persistence. As a result, sensitive policy information and strategic communications were potentially exposed, raising concerns about foreign influence and espionage risks. This campaign is especially relevant as it highlights a broader surge in highly personalized phishing attacks by nation-state actors against geopolitical targets. It underscores the need for advanced identity protection, more robust security around internal communications, and ongoing vigilance among organizations operating in the policy and government sectors.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Chinese TA415 Breaches US Economic Policy Experts Using VS Code Remote Tunnels
Government Administration10 months ago

Chinese TA415 Breaches US Economic Policy Experts Using VS Code Remote Tunnels

In mid-2025, the China-aligned threat actor TA415 launched a sophisticated spear-phishing campaign targeting U.S. government agencies, economic policy think tanks, and academic organizations. The attackers leveraged social engineering tactics, masquerading as high-profile U.S. officials, and delivered phishing emails containing malicious links. Through these lures, TA415 exploited Visual Studio Code Remote Tunnels—a legitimate feature used for remote development—to establish persistent, covert remote access within target environments. This allowed them to conduct extended espionage operations, exfiltrate sensitive economic policy data, and evade traditional endpoint and network defenses. The attack highlights the convergence of advanced phishing techniques with legitimate remote access tools, underscoring a shift toward stealthy, “living off the land” tactics by nation-state adversaries. Organizations are urged to address internal monitoring, east-west security, and robust detection of unauthorized remote connectivity, as similar techniques are expected to proliferate across sectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports