Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1513 to 1524 of 5948
ChocoPoC Malware: A New Threat Targeting Cybersecurity Researchers
In July 2026, cybersecurity researchers identified a campaign distributing a Python-based remote access trojan (RAT) named ChocoPoC through trojanized proof-of-concept (PoC) exploits on GitHub. Unlike previous incidents where malware was embedded directly in exploit files, this campaign introduced malicious Python packages into the PoC's dependency list. When victims cloned these repositories, a trojanized package named 'frint' was automatically installed, which subsequently fetched another malicious package, 'skytext.' This package contained a compiled Python extension that decrypted and executed additional code, ultimately downloading the ChocoPoC RAT from a Mapbox dataset. The RAT possessed capabilities such as executing arbitrary commands, uploading files, and collecting sensitive data, including browser credentials and network configurations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/?utm_source=openai)) This incident underscores a growing trend where threat actors exploit trusted platforms like GitHub to distribute malware, targeting professionals who frequently utilize PoC exploits for research and testing. The sophisticated method of embedding malicious code within dependency packages highlights the need for heightened vigilance when sourcing code from public repositories. As attackers continue to refine their techniques, the cybersecurity community must adapt by implementing stricter code verification processes and promoting awareness about the risks associated with unverified code. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/?utm_source=openai))
2 months ago
Kill Chain
Kubota Data Breach 2026: A Wake-Up Call for Industrial Cybersecurity
In early 2026, Kubota North America Corporation experienced a significant data breach where unauthorized actors accessed its network systems from March 16 to April 20. The intrusion led to the exposure of sensitive personal information belonging to employees and their dependents, including full names, Social Security numbers, dates of birth, taxpayer IDs, driver's license numbers, direct deposit bank account details, corporate payment card information, and benefits enrollment data. Kubota has since notified affected individuals and offered identity protection services to mitigate potential risks. This incident underscores the escalating threat landscape targeting industrial manufacturers, emphasizing the critical need for robust cybersecurity measures. The breach highlights the importance of proactive security protocols and continuous monitoring to safeguard sensitive employee data against unauthorized access and potential misuse.
2 months ago
Kill Chain
ScreenConnect Exploited in Global AsyncRAT Campaign - 2026
In early 2026, a sophisticated cyber campaign exploited legitimate remote access tools to deploy AsyncRAT malware. Attackers created fraudulent websites mimicking popular software like OBS Studio and DNS Jumper, leveraging search engine optimization to rank these sites highly. Unsuspecting users downloaded trojanized installers containing a legitimate Microsoft-signed binary and a malicious DLL, which installed ScreenConnect for remote access. This access was used to execute scripts that disabled security features and deployed AsyncRAT, enabling data theft and system control. The campaign's extensive infrastructure spanned over 90 domains in multiple languages, indicating a global reach. This incident underscores the evolving tactics of cybercriminals who exploit trusted tools and SEO techniques to infiltrate systems. Organizations must remain vigilant, ensuring software is downloaded from verified sources and implementing robust security measures to detect and prevent such sophisticated attacks.
2 months ago
Kill Chain
ClawHavoc: Unveiling the OpenClaw Supply Chain Attack
In early 2026, the OpenClaw AI assistant ecosystem faced a significant supply chain attack known as 'ClawHavoc.' Threat actors uploaded over 1,100 malicious 'skills' to ClawHub, OpenClaw's official marketplace, disguising them as legitimate productivity tools. These malicious skills, once installed, deployed various malware, including the Atomic macOS Stealer (AMOS), compromising user credentials, cryptocurrency wallets, and sensitive documents. The attack exploited the trust users placed in ClawHub's skill repository, leading to widespread data breaches and system compromises. This incident underscores the evolving threat landscape targeting AI agent ecosystems. The ease of creating and distributing malicious skills highlights the urgent need for robust security measures, including stringent code audits, supply chain verification practices, and user education on the risks associated with third-party extensions.
2 months ago
Kill Chain
VEIL#DROP Malware Exploits Blogger to Deliver PureLogs Stealer
In July 2026, cybersecurity researchers identified a sophisticated malware delivery framework named VEIL#DROP, which exploits Google's Blogger platform to disseminate the PureLogs information stealer. The attack initiates with a deceptive JavaScript file, often named to resemble a document (e.g., transcript.pdf.js), that executes via Windows Script Host. This script launches PowerShell commands to retrieve additional payloads from Blogger-hosted URLs, effectively bypassing traditional security defenses by leveraging trusted infrastructure. The infection chain culminates in the deployment of PureLogs, a .NET-based infostealer capable of harvesting a wide array of sensitive data from compromised systems. The VEIL#DROP framework employs advanced evasion techniques, including dynamic URL generation, runtime script mutation, and fileless execution, making detection and mitigation challenging. Additionally, it utilizes trusted Microsoft-signed binaries to execute malicious code, further enhancing its stealth and persistence within targeted environments. The emergence of VEIL#DROP underscores a growing trend among threat actors to abuse legitimate platforms and services to distribute malware, complicating detection efforts. This incident highlights the critical need for organizations to implement robust security measures, including advanced threat detection systems and comprehensive user education, to defend against increasingly sophisticated attack vectors.
2 months ago
Kill Chain
Cybercriminals Exploit SEO and Legitimate Tools to Deploy AsyncRAT
In July 2026, cybersecurity researchers uncovered a large-scale campaign where threat actors utilized SEO poisoning to distribute malicious installer archives via spoofed websites. These installers, masquerading as popular software like OBS Studio and Bandicam, bundled a legitimate Microsoft install.exe binary with a rogue DLL, leading to the deployment of the ScreenConnect remote access tool. This tool facilitated the execution of AsyncRAT, enabling attackers to maintain control over compromised systems, steal sensitive data, and monitor user activity. The campaign spanned over 90 domain names across 10 languages, indicating a highly coordinated effort. ([thehackernews.com](https://thehackernews.com/2026/07/seo-poisoned-software-sites-abuse.html?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who exploit legitimate tools and SEO techniques to enhance the reach and effectiveness of their attacks. The use of trusted software as a delivery mechanism for malware highlights the need for heightened vigilance and robust security measures to detect and prevent such sophisticated threats.
2 months ago
Kill Chain
Critical Unpatched Vulnerability in Argo CD Repo-Server Threatens Kubernetes Clusters
In July 2026, a critical vulnerability was disclosed in Argo CD's repo-server component, a widely used tool for deploying software to Kubernetes. The flaw allows unauthenticated attackers to execute arbitrary code by sending crafted requests to the repo-server's internal gRPC service, which lacks authentication. This vulnerability can lead to full cluster takeovers if the repo-server is accessible within the network. Despite being reported to Argo CD's maintainers in January 2025, the issue remains unpatched as of July 2026. This incident underscores the importance of securing internal services and implementing robust network policies. Organizations using Argo CD should immediately apply network isolation measures to prevent unauthorized access to the repo-server component and mitigate potential exploitation.
2 months ago
Kill Chain
19-Year-Old Scattered Spider Member Extradited to U.S. for Hacking Charges
On July 1, 2026, the U.S. Department of Justice announced the extradition of Peter Stokes, a 19-year-old dual U.S. and Estonian citizen, from Finland to the United States. Stokes, identified by the online handle "Bouquet," faces charges of conspiracy, computer intrusion, and fraud for his alleged involvement with the cybercriminal group Scattered Spider. This group has been linked to over 100 network intrusions, resulting in more than $100 million in ransom payments. Stokes appeared in a Chicago federal court on June 30, where he was ordered to remain in custody. The arrest underscores the persistent threat posed by Scattered Spider, known for targeting sectors such as casinos, retailers, and airlines through sophisticated social engineering tactics. Despite recent law enforcement actions, the group's methods continue to evolve, highlighting the need for organizations to bolster their cybersecurity defenses against such adaptive threats.
2 months ago
Kill Chain
Iran-Nexus TAG-182 Deploys MarkiRAT Malware in Surveillance Campaign
In early 2026, the Iranian-linked threat group TAG-182 initiated a cyber espionage campaign deploying MarkiRAT malware via counterfeit Android applications, including fake VPNs and media tools, to surveil Iranian citizens domestically and abroad. This operation aligns with Iran's intensified digital surveillance efforts following the partial restoration of internet access on May 26, 2026, targeting perceived dissidents and foreign collaborators. The MarkiRAT samples exhibit tradecraft overlaps with previous variants used by Ferocious Kitten, suggesting a potential operational connection, though further evidence is required to confirm organizational links. ([staging.hawk-eye.io](https://staging.hawk-eye.io/iran-apt-threat-advisory/?utm_source=openai)) The resurgence of TAG-182's activities underscores the persistent threat posed by Iranian state-sponsored cyber operations, particularly in the realm of surveillance and intelligence gathering. Organizations and individuals, especially those involved in human rights advocacy or opposition activities, should remain vigilant against sophisticated social engineering tactics and ensure robust cybersecurity measures are in place to mitigate the risks associated with such targeted campaigns.
2 months ago
Kill Chain
Persistent Phishing Threats in the Hospitality Industry: A 2026 Case Study
In April 2026, a sophisticated phishing campaign targeted hospitality organizations across Europe and Asia. Attackers impersonated guests, sending emails with malicious ZIP files disguised as photo attachments. These emails exploited trusted services like Calendly and Google redirects to bypass email authentication checks. Upon opening the ZIP files, victims inadvertently executed a PowerShell script that installed a persistent Node.js-based malware implant, granting attackers long-term access to compromised systems. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs?utm_source=openai)) This incident underscores a growing trend of cybercriminals leveraging social engineering and trusted platforms to infiltrate organizations. The use of advanced techniques, such as 'authentication laundering' and blockchain-based command-and-control mechanisms, highlights the evolving nature of cyber threats in the hospitality sector. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/phishers-persistence-eu-asia-hospitality-orgs?utm_source=openai))
2 months ago
Kill Chain
Securing AI Endpoints: Lessons from Recent Exploits
Between March and May 2026, Zenity researchers identified three distinct campaigns where threat actors exploited exposed AI inference endpoints, such as those of Ollama and LiteLLM, to conduct offensive operations. These attacks did not require full system compromises; attackers merely needed knowledge of the exposed endpoints to leverage them for activities like autonomous penetration testing and web reverse-engineering. The incidents underscore the critical need for securing AI infrastructure against unauthorized access. This trend highlights a growing tactic among cyber adversaries: exploiting misconfigured or exposed AI endpoints to amplify their offensive capabilities. As organizations increasingly integrate AI into their operations, ensuring the security of these systems becomes paramount to prevent their misuse in cyberattacks.
2 months ago
Kill Chain
Agentjacking: The Emerging Threat to AI Coding Agents
In June 2026, Tenet Security unveiled a novel attack method termed 'agentjacking,' wherein attackers exploit AI coding agents by injecting malicious code through fabricated error reports in public bug tracking services. This technique enables unauthorized code execution on developers' machines, potentially leading to the theft of sensitive credentials and compromise of development environments. The attack leverages the AI agents' inability to distinguish between genuine content and embedded instructions, allowing adversaries to manipulate these agents into executing harmful commands. The significance of this discovery lies in the escalating integration of AI coding agents into software development workflows. As these agents become more prevalent, understanding and mitigating their vulnerabilities is crucial to prevent similar exploitation methods. Organizations must reassess their security protocols to address the unique risks posed by AI-driven development tools.
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
