Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1525 to 1536 of 5948
China-Linked Group Targets Southeast Asia Critical Systems
In mid-2025, the Chinese-speaking advanced persistent threat (APT) group CL-STA-1062 initiated a cyber espionage campaign targeting government entities and critical infrastructure in Southeast Asia. The group compromised at least 10 organizations, including state-owned enterprises in the energy and government sectors, deploying a custom backdoor named TinyRCT. This backdoor facilitated unauthorized access, data exfiltration, and system control, posing significant risks to national security and operational stability. ([thehackernews.com](https://thehackernews.com/2026/06/chinese-speaking-apt-deploys-new.html?utm_source=openai)) The emergence of TinyRCT underscores the evolving sophistication of state-sponsored cyber threats in the region. Organizations must enhance their cybersecurity measures to detect and mitigate such advanced persistent threats, ensuring the resilience of critical infrastructure against future attacks. ([thehackernews.com](https://thehackernews.com/2026/06/chinese-speaking-apt-deploys-new.html?utm_source=openai))
2 months ago
Kill Chain
Phantom Squatting: Unveiling the New AI-Driven Cyber Threat
In July 2026, cybersecurity researchers identified a new threat vector termed 'phantom squatting,' where attackers exploit AI-generated, non-existent domains associated with legitimate brands. By registering these hallucinated domains, cybercriminals can intercept traffic directed by AI systems, leading to phishing attacks and malware distribution. This method leverages the tendency of large language models (LLMs) to generate plausible yet fictitious web addresses, creating a novel supply chain vulnerability. The emergence of phantom squatting underscores the evolving landscape of AI-driven cyber threats. As organizations increasingly integrate AI assistants into their operations, the risk of such AI-induced vulnerabilities grows, necessitating proactive measures to monitor and secure potential phantom domains before they are weaponized by adversaries.
2 months ago
Kill Chain
Critical Vulnerabilities in Delta Electronics DVP12SE PLCs: CVE-2026-12819 and CVE-2026-12818
In June 2026, critical vulnerabilities were identified in Delta Electronics DVP12SE Programmable Logic Controllers (PLCs), specifically CVE-2026-12819 and CVE-2026-12818. These flaws allow remote attackers to issue commands, modify operational values, and interfere with control logic without authentication. The vulnerabilities affect all versions of the DVP12SE PLC, potentially enabling unauthorized access to sensitive control functions and causing resource exhaustion through flooding attacks. The discovery of these vulnerabilities underscores the increasing risks associated with industrial control systems (ICS) and the necessity for robust security measures. Organizations utilizing Delta Electronics DVP12SE PLCs should implement recommended mitigations, such as enabling IP filtering, setting up password protection, and ensuring network isolation, to safeguard against potential exploitation.
2 months ago
Kill Chain
Unveiling the Evolution of ClickFix: API-Driven Malware Delivery Exposed
In July 2026, security researcher Bert-Jan Pals analyzed approximately 3,000 live ClickFix payloads, uncovering a significant evolution in the malware delivery mechanism. ClickFix, a social engineering technique that deceives users into executing malicious commands, has transitioned to using API-driven servers. These servers dynamically generate unique, obfuscated commands for each visitor, effectively disguising the same underlying malware. Additionally, a new delivery method was identified that bypasses Windows' script scanning by downloading a file to the user's system and executing it through a seemingly innocuous command, thereby evading traditional detection mechanisms. This development underscores the increasing sophistication of social engineering attacks and the continuous adaptation of threat actors to circumvent security measures. Organizations must remain vigilant, updating their security protocols and educating users about emerging threats to mitigate the risks associated with such advanced attack vectors.
2 months ago
Kill Chain
Critical XZ Utils Vulnerability Affects B&R Products (CVE-2025-31115)
In June 2026, B&R Industrial Automation GmbH disclosed a critical vulnerability (CVE-2025-31115) in their products due to a flaw in XZ Utils versions 5.3.3alpha to 5.8.0. This race condition within the multithreaded .xz decoder in liblzma could allow attackers to crash the system or corrupt memory data. Affected products include PPC3100, C50, C80, FT50, MT50, T30, T80, and T50, with specific versions listed in the advisory. The vulnerability has a CVSS v3 base score of 7.5, indicating high severity. ([cisa.gov](https://www.cisa.gov/sites/default/files/publications/web-metrics/CISA.gov-Apr-2024-Web-Metrics-508.pdf?utm_source=openai)) This incident underscores the importance of promptly addressing vulnerabilities in widely used open-source libraries. Organizations are advised to update to XZ Utils version 5.8.1 or apply the provided patches to mitigate potential risks. ([cisa.gov](https://www.cisa.gov/sites/default/files/publications/web-metrics/CISA.gov-Apr-2024-Web-Metrics-508.pdf?utm_source=openai))
2 months ago
Kill Chain
Massive Azure CLI Password Spray Attack Compromises 78 Microsoft Accounts
Between June 12 and June 26, 2026, a massive, automated password spray attack targeted Microsoft's Azure command-line interface (CLI), resulting in over 81 million login attempts and the compromise of at least 78 Microsoft accounts across 64 organizations. The attackers exploited a deprecated OAuth 2.0 grant type known as Resource Owner Password Credentials (ROPC) to bypass Conditional Access Policies (CAP) and multi-factor authentication (MFA) in environments where MFA was not enforced for all cloud applications. The attack originated from an IPv6 address range controlled by internet infrastructure provider LSHIY LLC (AS32167). ([thehackernews.com](https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html?utm_source=openai)) This incident underscores the critical need for organizations to review and properly configure their Conditional Access Policies to enforce MFA across all applications and user groups. The exploitation of legacy authentication methods like ROPC highlights the importance of disabling deprecated protocols and ensuring that security measures are comprehensive and up-to-date. ([thehackernews.com](https://thehackernews.com/2026/07/azure-cli-password-spray-hits-at-least.html?utm_source=openai))
2 months ago
Kill Chain
Critical Authentication Bypass in Frangoteam FUXA SCADA/HMI Software (CVE-2026-13207)
In June 2026, a critical authentication bypass vulnerability (CVE-2026-13207) was identified in Frangoteam's FUXA SCADA/HMI software versions 1.3.1 and earlier. This flaw allows unauthenticated remote attackers to access sensitive user and role data by exploiting improper path normalization in the REST API. By manipulating URL paths with dot-segment sequences, attackers can bypass authentication checks and retrieve confidential information without credentials. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-13207?utm_source=openai)) This incident underscores the persistent risks associated with authentication bypass vulnerabilities in industrial control systems. As SCADA environments increasingly integrate web-based interfaces, ensuring robust authentication mechanisms becomes paramount to prevent unauthorized access and potential operational disruptions.
2 months ago
Kill Chain
Phantom Squatting: Exploiting AI-Generated Domains for Cyber Attacks
In July 2026, Palo Alto Networks' Unit 42 identified a new cyberattack technique termed 'phantom squatting,' where attackers exploit AI-generated, non-existent domains to conduct phishing and malware distribution. By prompting large language models (LLMs) with queries about official websites, attackers collect these hallucinated domains, register them, and create malicious sites that appear legitimate to users and AI tools alike. This method leverages the trust users place in AI-generated content, leading to increased risks of credential theft and malware infections. The emergence of phantom squatting underscores the evolving landscape of cyber threats, particularly as AI tools become more integrated into daily operations. Organizations must recognize the potential for AI-generated misinformation to be weaponized and implement proactive measures to monitor and secure domains that could be exploited through such techniques.
2 months ago
Kill Chain
Critical Vulnerability in Schneider Electric's EcoStruxure IT Data Center Expert: CVE-2026-8045
In June 2026, Schneider Electric disclosed a vulnerability (CVE-2026-8045) in its EcoStruxure IT Data Center Expert software, versions 9.1.1 and prior. This flaw, identified as an Improper Restriction of XML External Entity Reference (CWE-611), allows authenticated users to submit crafted XML payloads to SOAP service endpoints, potentially leading to unauthorized access and disclosure of sensitive server-side files. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-8045?utm_source=openai)) The vulnerability underscores the critical need for robust input validation and secure XML processing in software applications. Organizations utilizing affected versions should promptly apply the vendor-provided patch to mitigate potential risks associated with this security flaw.
2 months ago
Kill Chain
Critical Vulnerabilities Discovered in Mitsubishi Electric's MELSOFT Update Manager
In June 2026, Mitsubishi Electric disclosed multiple vulnerabilities in its MELSOFT Update Manager SW1DND-UDM-M software, specifically versions 1.000A through 1.014Q. These vulnerabilities, identified as CVE-2025-53816, CVE-2025-53817, CVE-2025-55188, and CVE-2025-11001, stem from issues within the bundled 7-Zip component. Exploitation could allow local attackers to execute arbitrary code, cause denial-of-service conditions, or tamper with information by convincing users to decompress specially crafted archive files. The affected software is widely used in critical manufacturing sectors globally. ([knutmichael.com](https://knutmichael.com/radar/2026-06-30-mitsubishi-electric-melsoft-update-manager-sw1dnd-udm-m?utm_source=openai)) The disclosure underscores the persistent risks associated with third-party components in industrial control systems. Organizations are urged to promptly update to version 1.015R or later and implement recommended security measures to mitigate potential threats. ([knutmichael.com](https://knutmichael.com/radar/2026-06-30-mitsubishi-electric-melsoft-update-manager-sw1dnd-udm-m?utm_source=openai))
2 months ago
Kill Chain
Protecting AI Agents from MCP Tool Poisoning Attacks
In June 2026, Microsoft Incident Response detailed a sophisticated attack pattern targeting enterprise AI agents utilizing the Model Context Protocol (MCP). The attack involved malicious modifications to MCP tool descriptions, leading AI agents to execute unauthorized actions, such as exfiltrating sensitive financial data. This exploitation underscores the vulnerabilities inherent in AI agents that transition from passive content reading to active task execution. The incident highlights the critical need for robust security measures as AI agents become more autonomous and integrated into enterprise workflows. With the projected growth of AI agents in enterprises, securing these systems against such sophisticated attacks is paramount to prevent potential data breaches and operational disruptions.
2 months ago
Kill Chain
Urgent: CVE-2026-8037 Vulnerability in Progress Kemp LoadMaster Under Active Exploitation
In June 2026, a critical security vulnerability identified as CVE-2026-8037 was discovered in Progress Kemp LoadMaster, an application delivery controller widely used in enterprise environments. This OS command injection flaw allows unauthenticated attackers to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple API command endpoints. The vulnerability affects LoadMaster versions GA v7.2.63.1 and earlier, as well as LTSF v7.2.54.17 and earlier. Exploitation attempts were first observed on June 29, 2026, originating from specific IP addresses, though initial attempts were unsuccessful. ([thehackernews.com](https://thehackernews.com/2026/07/latest-progress-kemp-loadmaster-pre.html?utm_source=openai)) The availability of a proof-of-concept exploit and detailed technical analyses has heightened the risk of successful attacks. Organizations using affected LoadMaster versions are urged to apply the patches released by Progress Kemp immediately and restrict API access to trusted networks to mitigate potential exploitation. ([qpulse.quasarcybertech.com](https://qpulse.quasarcybertech.com/news/4414/critical-unauthenticated-rce-vulnerability-in-progress-kemp-loadmaster-cve-2026-8037?utm_source=openai))
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
