Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1477 to 1488 of 5948
Interpol Impersonation Ransomware Targets Small Businesses in 2026
In July 2026, a ransomware campaign targeted small businesses across multiple regions, including the US, Europe, Asia, and the Middle East. Attackers impersonated Interpol officials, sending phishing emails that claimed the recipient's organization was under investigation for suspicious activity. These emails urged recipients to download a password-protected archive from Proton Drive, purportedly containing evidence. Upon opening, the archive delivered a ransomware payload disguised as a video file, encrypting local systems and prompting victims to contact the attackers via the Tox messaging platform to negotiate payment. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/attackers-use-interpol-lure-target-small-businesses?utm_source=openai)) This incident underscores the increasing trend of cybercriminals leveraging social engineering tactics to exploit small businesses, which often lack dedicated cybersecurity resources. The campaign highlights the need for heightened awareness and robust security measures to defend against such deceptive attacks.
2 months ago
Kill Chain
Chinese AI Models Redefine Cybersecurity Landscape
In June 2026, Chinese companies Zhipu AI and 360 Security Technology released advanced AI models—GLM-5.2 and Tulongfeng, respectively—that significantly enhance vulnerability discovery capabilities. GLM-5.2, an open-weight model, demonstrated performance on par with leading U.S. models like Anthropic's Mythos in identifying software vulnerabilities. Tulongfeng, described as China's version of Mythos, reportedly identified over 3,400 vulnerabilities, with 105 acknowledged by the Chinese government. These developments underscore a rapid advancement in AI-driven cybersecurity tools within China, potentially altering the global cybersecurity landscape. ([techradar.com](https://www.techradar.com/pro/security/chinese-cybersecurity-company-360-unveils-chinas-version-of-mythos-and-yitianzhen-to-automate-cyber-defense?utm_source=openai)) The emergence of these models highlights the increasing accessibility of sophisticated AI tools for both defenders and attackers. The open-source nature of GLM-5.2 raises concerns about potential misuse by malicious actors, as it allows for modification and deployment without restrictions. This trend necessitates a reassessment of current cybersecurity strategies to address the evolving threat landscape posed by AI-enhanced capabilities. ([axios.com](https://www.axios.com/2026/06/25/china-glm-52-open-source-hackers?utm_source=openai))
2 months ago
Kill Chain
Iranian Cybercriminal Arrested for $3.4 Billion in Damages
In June 2026, Montenegrin authorities, in collaboration with the FBI, arrested a 39-year-old dual Iranian and Turkish citizen in Kotor. The individual is accused of orchestrating mass cyberattacks since 2013, targeting over 150 U.S. universities and causing damages exceeding $3.4 billion. The stolen data reportedly benefited Iran's Islamic Revolutionary Guard Corps and various Iranian state entities. Extradition proceedings are underway in Montenegro's capital, Podgorica. This arrest underscores the persistent threat posed by state-sponsored cyber activities and highlights the importance of international cooperation in combating cybercrime. Organizations should remain vigilant and enhance their cybersecurity measures to protect against such sophisticated attacks.
2 months ago
Kill Chain
PamStealer: A New Threat to macOS Users in 2026
In July 2026, cybersecurity researchers identified a new macOS malware named PamStealer, which masquerades as the legitimate Maccy clipboard manager. Distributed through fake websites, PamStealer employs a two-stage attack chain: an initial AppleScript lure that bypasses macOS's quarantine protections, followed by a Rust-based payload. This payload validates user credentials via macOS's Pluggable Authentication Modules (PAM) before exfiltrating sensitive data, including browser cookies, clipboard contents, and cryptocurrency wallet information. The malware also establishes persistence by creating login items and disguises itself as system components to evade detection. The emergence of PamStealer underscores a growing trend of sophisticated macOS-targeted malware that leverages native system features to enhance stealth and effectiveness. This development highlights the need for macOS users to exercise caution when downloading software and to remain vigilant against increasingly advanced social engineering tactics.
2 months ago
Kill Chain
European Parliament Member Targeted with Pegasus Spyware During Investigation
In October 2022 and March 2023, former Member of the European Parliament (MEP) Stelios Kouloglou's mobile device was infiltrated with Pegasus spyware while he was serving on the PEGA committee, which was investigating the misuse of such surveillance tools within the European Union. The Citizen Lab's forensic analysis confirmed these infections, indicating that attackers potentially accessed confidential committee documents and deliberations. The specific government or entity responsible for these attacks remains unidentified. ([citizenlab.ca](https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/?utm_source=openai)) This incident underscores the escalating threat of sophisticated spyware targeting high-profile individuals, including those involved in oversight and investigative roles. It highlights the urgent need for robust cybersecurity measures and regulatory frameworks to protect sensitive information and uphold democratic processes. ([theguardian.com](https://www.theguardian.com/world/2026/jul/03/spyware-used-against-mep-investigating-pegasus-abuses-report-finds?utm_source=openai))
2 months ago
Kill Chain
Armored Likho's BusySnake Stealer Targets Government and Energy Sectors
In July 2026, a previously undocumented threat actor known as Armored Likho launched cyber attacks targeting government agencies and the electric power sector in Russia, Brazil, and Kazakhstan. The group employed spear-phishing emails with lures related to official government notices or social programs, distributing RAR archives containing EXE binaries that served as droppers for additional payloads retrieved from a GitHub repository. These payloads included a newly identified Python-based information stealer named BusySnake Stealer, which is capable of stealing browser passwords, cookies, clipboard contents, screenshots, documents, Telegram session data, OTP secrets, and cryptocurrency wallet files. The malware establishes persistence through a combination of VBScript files and scheduled tasks, allowing the attackers to maintain prolonged access to compromised systems. This incident underscores the evolving tactics of cyber espionage groups, highlighting their ability to blend financially motivated campaigns with targeted attacks on critical infrastructure. The use of AI-generated first-stage loaders and obfuscated, modular remote access trojans (RATs) and infostealers specifically engineered to bypass dynamic analysis demonstrates a significant advancement in their capabilities. Organizations must remain vigilant and adapt their cybersecurity measures to counter these sophisticated threats.
2 months ago
Kill Chain
Anthropic's Mythos AI Breach: A Wake-Up Call for AI Security
In April 2026, unauthorized users gained access to Anthropic's restricted AI cybersecurity tool, Mythos, through a third-party vendor environment. Mythos, designed for enterprise security, was considered too powerful for public release due to its potential to identify vulnerabilities and simulate cyberattacks autonomously. The breach raised significant concerns about the security of advanced AI tools and the potential misuse of such technologies. This incident underscores the critical need for robust security measures when handling powerful AI tools, especially those capable of autonomous actions. It highlights the importance of securing third-party vendor environments to prevent unauthorized access to sensitive technologies.
2 months ago
Kill Chain
Pegasus Spyware Targets PEGA Committee Member Amid Investigations
In 2022 and 2023, the European Parliament's PEGA Committee, established to investigate the misuse of surveillance spyware like NSO Group's Pegasus, faced an ironic security breach. Greek journalist and substitute committee member Stelios Kouloglou's phone was infected with Pegasus spyware twice: first around October 2022 and again in March 2023. These infections coincided with critical phases of the committee's work, including the drafting of its final report. The infections were confirmed by the University of Toronto's Citizen Lab, highlighting the persistent threat posed by sophisticated spyware even to those tasked with investigating its misuse. This incident underscores the ongoing challenges in protecting sensitive information from advanced surveillance tools. It also emphasizes the need for robust cybersecurity measures within governmental bodies and the urgency of implementing the PEGA Committee's recommendations to prevent future abuses of spyware technologies.
2 months ago
Kill Chain
Scattered Spider Member Peter Stokes Extradited to US in 2026
In July 2026, Peter Stokes, a 19-year-old dual U.S.-Estonian citizen and alleged member of the cybercriminal group Scattered Spider, was extradited to the United States following his arrest in Finland. Stokes is accused of participating in multiple data theft and extortion attempts, including attacks on a luxury jewelry retailer in May 2025 and a U.S.-based insurance company in June 2025. Scattered Spider, active since 2022, has infiltrated over 100 businesses and extorted more than $100 million globally. ([cyberscoop.com](https://cyberscoop.com/scattered-spider-peter-stokes-cybercrime-extradition/?utm_source=openai)) This incident underscores the persistent threat posed by cybercriminal groups employing sophisticated social engineering tactics to infiltrate organizations. The arrest highlights the importance of robust cybersecurity measures and international cooperation in combating cybercrime.
2 months ago
Kill Chain
Medtronic Data Breach: ShinyHunters Claims 9 Million Records Stolen
In April 2026, Medtronic, a leading global medical device manufacturer, detected unauthorized access to its corporate IT systems. The cybercriminal group ShinyHunters claimed responsibility, alleging the theft of over 9 million records containing personally identifiable information (PII) and internal corporate data. Medtronic confirmed the breach but has not verified the exact number of records compromised. The company assured that the incident did not impact product security, patient safety, or operational systems. Investigations are ongoing to determine the full scope of the data accessed. This incident underscores the persistent threat posed by cyber extortion groups targeting critical infrastructure sectors. The healthcare industry, in particular, remains a prime target due to the sensitive nature of the data it handles. Organizations must continually enhance their cybersecurity measures to protect against such sophisticated attacks.
2 months ago
Kill Chain
Opera's 'Paste Protect' Feature: A New Defense Against 'ClickFix' Attacks
In July 2026, Opera introduced 'Paste Protect,' a security feature designed to combat 'ClickFix' attacks—a social engineering technique where users are deceived into copying and executing malicious commands via their system's command-line interface. These attacks often masquerade as legitimate verification processes or problem-solving instructions, leading to the execution of harmful commands with the user's privileges, potentially resulting in malware installation or data theft. 'Paste Protect' proactively scans clipboard content for patterns associated with malicious scripts across Windows, macOS, and Linux platforms. Upon detecting suspicious content, it blocks the copy operation, alerts the user with a warning, and displays a red security indicator in the browser's address bar. This feature aims to prevent users from inadvertently executing harmful commands, thereby enhancing overall system security. The introduction of 'Paste Protect' underscores the growing prevalence of 'ClickFix' attacks and the necessity for proactive security measures. As threat actors increasingly exploit human behavior through sophisticated social engineering tactics, it becomes imperative for both software developers and users to adopt and maintain robust security practices to mitigate such evolving threats.
2 months ago
Kill Chain
Alleged Scattered Spider Hacker Extradited to the United States
In April 2026, 19-year-old Peter Stokes, a dual U.S.-Estonian citizen, was arrested in Finland and extradited to the United States to face charges of conspiracy, computer intrusion, and fraud. Stokes is alleged to be a member of the Scattered Spider hacking group, implicated in over 100 network intrusions resulting in more than $100 million in ransom payments and significant operational disruptions. Notably, in May 2025, the group targeted a luxury item retailer, demanding an $8 million ransom after stealing 100 gigabytes of data. The company refused to pay but incurred over $2 million in losses due to operational disruptions and remediation efforts. ([justice.gov](https://www.justice.gov/opa/pr/alleged-member-criminal-cyber-hacking-group-scattered-spider-arrested-finland-and-extradited?utm_source=openai)) This incident underscores the persistent threat posed by cybercriminal groups like Scattered Spider, known for sophisticated social engineering tactics and targeting high-profile organizations. The arrest highlights ongoing international efforts to combat cybercrime and the importance of robust cybersecurity measures to protect against such threats.
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
