Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1573 to 1584 of 5957
GuardFall: Exposing Shell Injection Vulnerabilities in AI Coding Agents
In June 2026, Adversa AI disclosed a vulnerability named 'GuardFall' affecting ten out of eleven popular open-source AI coding agents. This flaw allows attackers to bypass safety checks using decades-old shell injection techniques, enabling the execution of malicious commands that can delete files or exfiltrate sensitive data such as SSH keys and cloud credentials. The vulnerability arises because these agents rely on blocklists that fail to account for how the Bash shell processes commands, leading to discrepancies between filtered and executed commands. ([thehackernews.com](https://thehackernews.com/2026/06/guardfall-exposes-open-source-ai-coding.html?utm_source=openai)) This incident underscores the persistent risks associated with AI coding agents, especially as they become more integrated into development workflows. The exploitation of longstanding shell injection methods highlights the need for robust security measures and continuous vigilance in the deployment of AI tools to prevent potential supply chain attacks.
2 months ago
Kill Chain
Silent Swap Crypto Clipper: A New Threat to Cryptocurrency Security
In June 2026, cybersecurity researchers identified a malicious campaign named 'Silent Swap,' which targets cryptocurrency users through a fake 'Google Notes' browser extension. Delivered via unsigned .NET and Golang installers, this extension infiltrates Chromium-based browsers by modifying their settings to install itself without user consent. Once active, it monitors the system clipboard for cryptocurrency wallet addresses and replaces them with attacker-controlled addresses, leading to unauthorized fund transfers. The campaign employs advanced techniques like 'EtherHiding,' utilizing blockchain technology to dynamically update command-and-control servers, enhancing its resilience and evasion capabilities. This incident underscores a growing trend of sophisticated attacks leveraging trusted platforms and applications to distribute malware. The use of blockchain for command-and-control infrastructure highlights the evolving tactics of threat actors, making detection and mitigation more challenging. Organizations and individuals must remain vigilant, ensuring that browser extensions are sourced from reputable developers and regularly reviewing installed extensions for unauthorized additions.
2 months ago
Kill Chain
Apple's June 2026 Security Updates: Over 25 Vulnerabilities Patched
In June 2026, Apple released security updates for iOS/iPadOS 26.5.2, macOS Tahoe 26.5.2, and Safari 26.5.2, addressing over 25 vulnerabilities. The majority of these issues were found in WebKit and related web technologies, potentially leading to crashes, memory corruption, or data disclosure. Additionally, vulnerabilities in the kernel and IOGPUFamily were patched. Notably, Apple expedited these updates in response to concerns about AI-assisted hacking tools, aiming to reduce the window between vulnerability disclosure and patch deployment. ([macrumors.com](https://www.macrumors.com/2026/06/29/apple-ios-26-5-2-early-release/?utm_source=openai)) This proactive approach underscores the growing threat posed by AI-enhanced cyberattacks, highlighting the necessity for organizations to adopt agile security practices and promptly apply software updates to mitigate emerging risks.
2 months ago
Kill Chain
Malicious Chromium Extension Exploits AI Branding for Search Hijacking
In June 2026, a malicious Chromium-based browser extension impersonating the AI-powered search engine Perplexity AI was discovered. This extension intercepted user search queries and real-time suggestions, routing them through attacker-controlled infrastructure before redirecting to legitimate search providers. The primary objective appeared to be data collection for potential misuse, such as profiling or targeted advertising. Microsoft Threat Intelligence reported the extension to Google, leading to its removal from the Chrome Web Store. This incident underscores the evolving tactics of threat actors leveraging AI-related branding to enhance the credibility of their malicious tools. The use of legitimate APIs and advanced permissions highlights the need for heightened vigilance and robust security measures to protect against sophisticated browser-based threats.
2 months ago
Kill Chain
GitHub Advisory Database Overwhelmed by Record Vulnerability Reports
In May 2026, the GitHub Advisory Database published 1,560 reviewed advisories, marking a fivefold increase over its typical monthly output and the highest in its history. This surge reflects a structural change in the vulnerability disclosure ecosystem, with private vulnerability reports escalating from approximately 550 per week in January to over 3,000 per week by May. Repository advisories and CVE requests have similarly increased, leading to extended review times and a backlog in processing new advisories. ([github.blog](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/?utm_source=openai)) The unprecedented volume of vulnerability reports underscores the need for enhanced coordination among researchers, maintainers, and security teams. It also highlights the importance of submitting complete and accurate vulnerability data to expedite the review process. As the ecosystem adapts to this new scale, stakeholders must collaborate to maintain the quality and timeliness of advisory publications. ([github.blog](https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records/?utm_source=openai))
2 months ago
Kill Chain
Discovery of 'Short-Sleeve' RSA Keys Poses Significant Security Risk
In June 2026, researchers from Trail of Bits and the badkeys project identified a critical vulnerability in RSA keys characterized by patterns of zeros, termed "short-sleeve" RSA keys. These keys, found in public sources like Certificate Transparency logs and SSH hosts, were associated with major organizations such as Yahoo and Verizon, as well as devices running NetApp software and CompleteFTP software from EnterpriseDT. The vulnerability, stemming from improper key generation processes, allows attackers to factor the public modulus and derive private keys, compromising encrypted communications and data integrity. ([blog.trailofbits.com](https://blog.trailofbits.com/2026/06/12/factoring-short-sleeve-rsa-keys-with-polynomials/?utm_source=openai)) This discovery underscores the persistent risks associated with flawed cryptographic implementations. Organizations must prioritize regular audits of cryptographic keys and ensure adherence to secure key generation practices to mitigate potential breaches.
2 months ago
Kill Chain
Black Basta Ransomware Group: A Comprehensive Analysis of Its Rise and Fall
Black Basta, a ransomware-as-a-service (RaaS) group, emerged in April 2022 and rapidly became a significant threat by employing double extortion tactics—encrypting victims' data and exfiltrating sensitive information to pressure organizations into paying ransoms. The group targeted over 500 organizations worldwide across various critical infrastructure sectors, including healthcare, finance, and manufacturing. Their operations involved sophisticated social engineering techniques, exploitation of known vulnerabilities, and partnerships with malware distributors like QakBot to gain initial access. In 2025, internal conflicts and law enforcement actions led to a decline in Black Basta's activities, culminating in the group's shutdown. ([techrepublic.com](https://www.techrepublic.com/article/black-basta-ransomware-attack/?utm_source=openai)) The Black Basta case underscores the evolving nature of ransomware threats, highlighting the importance of robust cybersecurity measures and proactive threat intelligence to defend against sophisticated cybercriminal operations. The group's rapid rise and eventual downfall illustrate the dynamic landscape of cyber threats and the necessity for organizations to remain vigilant and adaptable.
2 months ago
Kill Chain
KDDI Data Breach Exposes 14.2 Million Email Logins Across Six ISPs
In June 2026, KDDI Corporation, a major Japanese telecommunications operator, disclosed a data breach affecting its email systems used by six internet service providers (ISPs). The breach, discovered on June 17, resulted from attackers exploiting a vulnerability in third-party software, potentially exposing up to 14.2 million email addresses and passwords. The affected ISPs include STNet, JCOM, Chubu Telecommunications, NIFTY, BIGLOBE, and KDDI Web Communications. KDDI promptly blocked the attacker and implemented defensive measures upon detection. This incident underscores the critical importance of securing third-party software components within shared infrastructure environments. As cyber threats continue to evolve, organizations must rigorously assess and monitor the security of all integrated software solutions to prevent similar breaches.
2 months ago
Kill Chain
Urgent Alert: Oracle E-Business Suite Vulnerability Under Active Exploitation
In late June 2026, threat intelligence firm Defused reported active exploitation of a critical vulnerability (CVE-2026-46817) in Oracle E-Business Suite's Payments component. This flaw, present in versions 12.2.3 through 12.2.15, allows unauthenticated attackers with HTTP access to execute remote code, potentially leading to full system compromise. Oracle had addressed this issue in their May 2026 Critical Security Patch Update, urging immediate patching. Despite this, numerous unpatched systems remain exposed, with over 450 Oracle EBS instances accessible online, nearly 200 of which are in the United States and Europe. The active exploitation of CVE-2026-46817 underscores the critical importance of timely patch management. Organizations using Oracle E-Business Suite must prioritize applying the latest security updates to mitigate this severe risk. Additionally, this incident highlights the broader trend of attackers targeting unpatched enterprise applications, emphasizing the need for robust vulnerability management practices.
2 months ago
Kill Chain
U.S. Offers $10 Million Reward for Information on Russian Hackers Targeting Encrypted Messaging Apps
In June 2026, the U.S. Department of State announced a reward of up to $10 million for information leading to the identification or location of members of the Russian-linked cyber groups UNC5792 and UNC4221. These groups have been implicated in extensive phishing campaigns targeting Signal and WhatsApp accounts of U.S. government officials, military leaders, and allied personnel. The attackers employed social engineering tactics, impersonating support agents to deceive users into revealing their backup recovery keys, thereby gaining access to their encrypted communications. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/us-offers-10-million-for-hackers-targeting-whatsapp-signal-users/?utm_source=openai)) This incident underscores the evolving nature of cyber threats, particularly the sophisticated use of social engineering to bypass encryption safeguards. It highlights the critical need for heightened vigilance and robust security protocols to protect sensitive communications, especially for individuals in positions of authority or influence.
2 months ago
Kill Chain
Nissan Employee Data Breach Exposes Sensitive Information via Oracle PeopleSoft Exploit
In June 2026, Nissan disclosed a data breach affecting current and former employees across the United States, Canada, Mexico, and Brazil. The breach occurred between May 27 and June 9, 2026, when threat actors exploited a zero-day vulnerability (CVE-2026-35273) in Oracle's PeopleSoft software, which Nissan uses to manage employee information. The attackers, identified as the ShinyHunters extortion group, accessed sensitive personal data, including contact details, banking information, Social Security numbers, and tax information. Nissan promptly activated its incident response plan, engaged external cybersecurity experts, secured affected systems, and is collaborating with Oracle to address the issue. The company is offering free credit and dark web monitoring services to affected individuals and has implemented additional security measures to prevent further unauthorized access. This incident underscores the critical importance of promptly addressing software vulnerabilities and implementing robust security measures to protect sensitive employee data. The exploitation of a zero-day vulnerability by a known threat actor highlights the evolving tactics of cybercriminals and the necessity for organizations to remain vigilant and proactive in their cybersecurity efforts.
2 months ago
Kill Chain
NAIC's 2026 Data Breach: A ShinyHunters Exploit of Oracle PeopleSoft
In June 2026, the National Association of Insurance Commissioners (NAIC) experienced a cyberattack by the ShinyHunters group, who exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft servers. The attackers claimed to have stolen 3.1 TB of data, including insurer regulatory filings and AWS infrastructure configurations. NAIC's investigation indicated that only publicly available data, outdated logs, and configuration files were accessed, with no evidence of personal or financial data exposure. The breach led to operational disruptions, such as temporary suspension of data feeds by credit rating agencies and a pause in NAIC's investment designation work. This incident underscores the critical importance of promptly addressing zero-day vulnerabilities and implementing robust security measures to protect sensitive data. Organizations must remain vigilant against sophisticated threat actors like ShinyHunters, who continue to exploit unpatched systems, emphasizing the need for proactive cybersecurity strategies and timely software updates.
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
