Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1585 to 1596 of 5957
Mustang Panda's Exploitation of Zoho WorkDrive in Indian Government Cyberattacks
In June 2026, the China-aligned cyber espionage group Mustang Panda launched two concurrent campaigns targeting Indian government entities and the hydropower sector. Utilizing spear-phishing emails with thematic lures, the attackers delivered ZIP archives containing SHARDLOADER, a malicious loader that deployed two new implants: MINIRECON and ZOHOMURK. Notably, ZOHOMURK exploited Zoho WorkDrive, a legitimate cloud storage service, for command-and-control operations, enabling data exfiltration and remote task execution while evading detection by blending with normal network traffic. This incident underscores the evolving tactics of state-sponsored threat actors who increasingly abuse trusted cloud services to conceal malicious activities. Organizations, especially those in critical infrastructure sectors, must enhance their security measures to detect and mitigate such sophisticated threats.
2 months ago
Kill Chain
Malicious Perplexity Chrome Extension Compromises User Data
In June 2026, Microsoft identified a malicious Chrome extension named "Search for perplexity ai" that impersonated the AI search engine Perplexity. This extension intercepted users' search queries and address bar inputs, routing them through an attacker-controlled server before redirecting to legitimate search results. The extension set itself as the default search engine upon installation, capturing every character typed into the address bar and transmitting this data, along with browser headers, IP addresses, and user agents, to the attacker's server. Microsoft reported the extension to Google, leading to its removal from the Chrome Web Store. ([thehackernews.com](https://thehackernews.com/2026/06/malicious-perplexity-chrome-extension.html?utm_source=openai)) This incident underscores a growing trend of malicious browser extensions exploiting the popularity of AI tools to harvest sensitive user data. Similar campaigns have targeted users by masquerading as AI assistants, leading to significant data breaches. Organizations must remain vigilant, implementing strict policies on browser extensions and educating users about the risks associated with unverified add-ons. ([techradar.com](https://www.techradar.com/pro/security/fake-chrome-ai-extensions-targeted-over-300-000-users-to-steal-emails-personal-data-and-more?utm_source=openai))
2 months ago
Kill Chain
AWS Threat Technique Catalog June 2026 Update: Enhancing Your AWS Security Posture
In June 2026, the AWS Customer Incident Response Team (AWS CIRT) updated the Threat Technique Catalog (TTC) to address emerging security challenges in container security, organizational trust, and compute hijacking. The update introduces five new entries: EKS workload modification, exploitation of public-facing applications in EKS, assuming root access into organization member accounts, compute hijacking in EKS, and inviting accounts to unknown organizations. These techniques reflect real-world incidents where threat actors exploit legitimate AWS functionalities to compromise environments, emphasizing the need for robust security measures and vigilant monitoring. This update underscores a trend where attackers leverage standard cloud operations to evade detection, highlighting the importance for organizations to enhance their security postures by implementing controls such as admission controllers, service control policies, and resource quotas, and by actively monitoring for anomalous activities within their AWS environments.
2 months ago
Kill Chain
Critical Vulnerability in Amazon Q Developer's VS Code Extension Exposes Cloud Credentials
In June 2026, a high-severity vulnerability (CVE-2026-12957) was discovered in Amazon Q Developer's Visual Studio Code extension. This flaw allowed attackers to execute arbitrary code and steal cloud credentials by convincing developers to open malicious repositories. The issue stemmed from the extension's handling of Model Context Protocol (MCP) servers, which automatically loaded and executed configurations from workspace files without user approval, leading to potential exposure of sensitive information such as AWS credentials and API keys. AWS addressed the vulnerability by releasing an update to Language Server version 1.65.0. This incident highlights the growing risks associated with AI coding tools and the importance of scrutinizing their integration into development environments. Organizations are urged to treat AI tools with environment access as potential security risks and implement appropriate guardrails to prevent unauthorized access and data exfiltration.
2 months ago
Kill Chain
Hijacked npm and Go Packages Exploit VS Code to Deploy Python Infostealer
In June 2026, cybersecurity researchers identified a sophisticated supply chain attack involving hijacked npm and Go packages designed to deploy a Python-based information stealer across Windows, Linux, and macOS systems. The attackers embedded malicious code within Visual Studio Code (VS Code) tasks, configured to execute automatically when a project folder was opened. This method bypassed traditional npm execution paths, allowing the malware to retrieve encrypted JavaScript from blockchain transactions, establish a backdoor via socket.io, and ultimately deploy the Python infostealer. The compromised npm packages, 'html-to-gutenberg' and 'fetch-page-assets', were uploaded on May 25, 2026, and have since been removed from the registry. This incident underscores a growing trend of attackers exploiting development environments and tools to infiltrate systems, highlighting the need for enhanced security measures within the software supply chain. The use of blockchain as a resilient command-and-control mechanism further complicates detection and mitigation efforts, emphasizing the importance of vigilance and proactive defense strategies among developers and organizations.
2 months ago
Kill Chain
Microsoft Eliminates 119 Malicious Edge Extensions Concealing Malware
In June 2026, Microsoft identified and removed 119 malicious extensions from the Edge Add-ons store, collectively known as 'StegoAd.' These extensions, active since at least 2021, utilized steganography to conceal malware within image and font files. After installation, the malware remained dormant, later activating to steal user credentials and conduct ad fraud. The affected extensions, including ad blockers, VPNs, translators, and video downloaders, amassed up to 2.6 million installations. The exact number of compromised users remains undetermined. This incident underscores the evolving sophistication of cyber threats, particularly in the realm of browser extensions. The use of steganography to evade detection highlights the need for enhanced security measures and vigilant monitoring of third-party add-ons. Organizations must prioritize the implementation of robust security protocols to mitigate such risks.
2 months ago
Kill Chain
Public PoC Released for Critical libssh2 CVE-2026-55200 Client-Side SSH Flaw
In June 2026, a critical vulnerability identified as CVE-2026-55200 was discovered in libssh2 versions up to and including 1.11.1. This flaw resides in the ssh2_transport_read() function, which fails to properly validate the packet_length field in incoming SSH packets. As a result, remote attackers can send specially crafted SSH packets with excessively large packet_length values, leading to heap memory corruption and potential remote code execution without requiring authentication or user interaction. The issue was addressed in commit 7acf3df. The release of a public proof-of-concept (PoC) exploit for this vulnerability has heightened the risk of widespread exploitation. Given libssh2's integration into numerous applications and systems, including curl, Git, PHP, and various backup agents, the potential attack surface is extensive. Organizations are urged to assess their environments for affected versions and apply the necessary patches promptly to mitigate the risk of compromise.
2 months ago
Kill Chain
Gamaredon's 2025 Cyber Offensive: Unveiling New Malware and Tactics
In 2025, the Russian-aligned APT group Gamaredon intensified its cyber operations against Ukrainian governmental and military institutions. ESET observed 35 distinct spear-phishing campaigns, primarily in the latter half of the year, utilizing archive attachments and XHTML files with HTML smuggling to deploy malicious HTA downloaders. These campaigns aimed to exfiltrate sensitive information to support Russian interests in the ongoing conflict. Gamaredon also exploited a WinRAR vulnerability (CVE-2025-8088) to achieve persistence by placing malicious files in the Windows Startup folder. Additionally, the group introduced six new PowerShell tools, including PteroDee and PteroCache, to enhance their malware arsenal. ([thehackernews.com](https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html?utm_source=openai)) The group's reliance on third-party services grew significantly, employing tunnel services and serverless platforms to conceal their infrastructure. This evolution underscores the increasing sophistication of state-sponsored cyber threats and the necessity for robust cybersecurity measures to protect sensitive governmental data. ([thehackernews.com](https://thehackernews.com/2026/06/gamaredon-expands-ukraine-attacks-with.html?utm_source=openai))
2 months ago
Kill Chain
Critical DirtyClone Vulnerability in Linux Kernel (CVE-2026-43503) Exposes Systems to Root Access
In June 2026, a critical vulnerability known as DirtyClone (CVE-2026-43503) was discovered in the Linux kernel, allowing local users to escalate privileges to root by exploiting cloned network packets. This flaw, a variant of the earlier DirtyFrag vulnerability, affects multiple Linux distributions, including Debian, Ubuntu, and Fedora. The vulnerability arises from the kernel's mishandling of shared socket-buffer fragments during network packet processing, enabling attackers to manipulate the Linux page cache and gain unauthorized access. ([thehackernews.com](https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html?utm_source=openai)) The emergence of DirtyClone underscores the persistent challenges in securing the Linux kernel against privilege escalation attacks. With the increasing adoption of multi-tenant cloud environments and containerized workloads, the risk of such vulnerabilities being exploited has escalated, highlighting the need for prompt patching and vigilant system monitoring. ([securityweek.com](https://www.securityweek.com/dirtyclone-linux-kernel-vulnerability-leads-to-root-access/?utm_source=openai))
2 months ago
Kill Chain
The Critical Shift to Post-Quantum Cryptography for Credential Security
In June 2026, cybersecurity experts highlighted the imminent threat posed by quantum computing to current cryptographic systems, particularly those safeguarding credentials. As quantum hardware advances, algorithms like RSA and elliptic curve cryptography, which protect sensitive data, are at risk of being compromised. This vulnerability underscores the urgency for organizations to transition to post-quantum cryptography (PQC) to maintain data confidentiality and integrity. ([thehackernews.com](https://thehackernews.com/2026/06/why-post-quantum-cryptography-starts.html?utm_source=openai)) The relevance of this issue is amplified by the increasing prevalence of 'harvest now, decrypt later' attacks, where adversaries collect encrypted data today, anticipating future quantum capabilities to decrypt it. This trend necessitates immediate action to adopt PQC solutions to safeguard long-term data security. ([thehackernews.com](https://thehackernews.com/2026/06/why-post-quantum-cryptography-starts.html?utm_source=openai))
2 months ago
Kill Chain
Massive Crypto Scam Operation Exploits DCloud Uni-App Framework
In June 2026, cybersecurity firm Infoblox uncovered that over 236,000 websites were utilizing investment scam templates built with the DCloud Uni-App framework. These sites facilitated a range of fraudulent activities, including fake cryptocurrency exchanges, phishing schemes, and crypto wallet drainers. The malicious domains spanned multiple continents and languages, indicating a coordinated effort by various threat actors. Notably, the RainbowEx platform, implicated in a Ponzi scheme affecting thousands in Argentina in late 2024, was among the identified domains. ([thehackernews.com](https://thehackernews.com/2026/06/236000-dcloud-uni-app-sites-used-in.html?utm_source=openai)) The exploitation of legitimate development frameworks like DCloud Uni-App underscores the evolving tactics of cybercriminals. This incident highlights the critical need for organizations to implement robust security measures, including thorough vetting of third-party tools and continuous monitoring for suspicious activities. ([thehackernews.com](https://thehackernews.com/2026/06/236000-dcloud-uni-app-sites-used-in.html?utm_source=openai))
2 months ago
Kill Chain
Russian Intelligence Exploits Fake Support Texts to Breach Messaging Accounts
In June 2026, the Security Service of Ukraine (SSU), in collaboration with the U.S. Federal Bureau of Investigation (FBI), uncovered a prolonged cyber espionage campaign orchestrated by Russian intelligence services. This operation targeted government officials, military personnel, politicians, and activists across Ukraine, Europe, and the United States. The attackers employed social engineering tactics, sending SMS messages that impersonated messaging platform support services to deceive recipients into divulging their account credentials. The primary objective was to access sensitive military, political, and economic information, as well as personal data. ([thehackernews.com](https://thehackernews.com/2026/06/ukraine-says-russian-intelligence-used.html?utm_source=openai)) This incident underscores the escalating sophistication of state-sponsored cyber threats, particularly those leveraging social engineering to exploit human vulnerabilities. Organizations and individuals must remain vigilant, adopting robust security measures such as two-factor authentication and regular monitoring of account activities to mitigate the risks posed by such targeted attacks.
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
