Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1609 to 1620 of 5957
Cybersecurity Firms Deceived by Fraudulent OpenAI Organization Invitations
In June 2026, cybersecurity firms were targeted by a sophisticated social engineering campaign dubbed 'Poisoned Tenant.' Threat actors created fraudulent OpenAI ChatGPT organizations impersonating legitimate companies and sent authentic-looking invitations to employees, urging them to join these fake tenants. Upon acceptance, employees were granted administrative privileges, potentially exposing sensitive company information. The attackers utilized OpenAI's legitimate notification system, making the invitations appear credible and bypassing standard email security measures. This incident underscores the evolving tactics of cyber adversaries who exploit trusted platforms to execute social engineering attacks. The use of legitimate services to deliver malicious content highlights the need for organizations to enhance their security awareness training and implement robust verification processes for unsolicited invitations, even when they appear to originate from trusted sources.
2 months ago
Kill Chain
Urgent Patching Required for Exploited Cisco and PTC Vulnerabilities
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to urgently patch two critical vulnerabilities: CVE-2026-20230 in Cisco Unified Communications Manager (Unified CM) and CVE-2026-12569 in PTC's Windchill and FlexPLM products. CVE-2026-20230 is a server-side request forgery (SSRF) flaw that allows unauthenticated remote attackers to write files to the operating system, potentially leading to root privilege escalation. CVE-2026-12569 is a remote code execution (RCE) vulnerability arising from the deserialization of untrusted data, affecting multiple versions of Windchill and FlexPLM. Both vulnerabilities were actively exploited, prompting CISA to set a remediation deadline of June 28, 2026. The urgency of these patches underscores the increasing sophistication and frequency of cyberattacks targeting critical infrastructure. Organizations must prioritize timely vulnerability management and adopt proactive security measures to mitigate risks associated with such exploits.
2 months ago
Kill Chain
Polymarket Supply-Chain Attack Results in $3 Million Theft
In June 2026, Polymarket, a leading cryptocurrency-based prediction market platform, suffered a supply-chain attack resulting in the theft of approximately $3 million from its customers. Attackers compromised a third-party vendor, injecting malicious JavaScript into Polymarket's frontend. This script deceived users into approving fraudulent transactions, leading to unauthorized fund transfers. The platform's backend infrastructure remained unaffected, and Polymarket has committed to fully reimbursing the impacted users. This incident underscores the escalating threat of supply-chain attacks targeting financial platforms. As cybercriminals increasingly exploit third-party dependencies to infiltrate systems, organizations must enhance their security measures and conduct thorough audits of their supply chains to mitigate such risks.
- Computer Software/Engineering
- Investment Management/Hedge Fund/Private Equity
- Computer/Network Security
2 months ago
Kill Chain
FBI Issues Alert on Russian Hackers Targeting Signal Backup Recovery Keys
In June 2026, the FBI and CISA issued a warning about a sophisticated phishing campaign by Russian intelligence services targeting Signal users. The attackers impersonated Signal support teams, sending messages that prompted users to enable backups and share their 64-character recovery keys. With these keys, the attackers could decrypt victims' entire message histories, compromising sensitive communications. The campaign primarily targeted individuals of high intelligence value, including government officials, military personnel, political figures, journalists, and key officials in Ukraine. This incident underscores the evolving tactics of state-sponsored cyber actors and highlights the critical importance of user vigilance against social engineering attacks. The exploitation of backup recovery keys represents a significant escalation in phishing techniques, emphasizing the need for robust security practices and user education to prevent unauthorized access to encrypted communications.
2 months ago
Kill Chain
Chinese APT CL-STA-1062's Deployment of TinyRCT Backdoor in Southeast Asia
In 2025, the Chinese-speaking advanced persistent threat (APT) group CL-STA-1062 targeted government entities and critical infrastructure in Southeast Asia, focusing on state-owned enterprises in the energy and government sectors. The attackers employed a hybrid toolkit, including common open-source tools like SoftEther VPN and Mimikatz, alongside a newly developed backdoor named TinyRCT. This backdoor facilitated arbitrary command execution, file exfiltration, screen capture, and included a self-destruct mechanism to erase forensic evidence. The campaign involved initial access through web application exploitation, deployment of ASPX web shells, and subsequent reconnaissance and lateral movement within the compromised networks. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/?utm_source=openai)) This incident underscores the evolving sophistication of APT groups in developing custom malware to infiltrate critical infrastructure. The use of TinyRCT highlights the need for organizations to enhance their detection capabilities and implement robust security measures to defend against such advanced threats.
2 months ago
Kill Chain
FBI Issues Warning on Russian Hackers Exploiting Signal Backup Recovery Keys
In June 2026, the FBI and CISA issued an updated warning regarding Russian intelligence phishing campaigns targeting Signal users. Attackers impersonated Signal support, sending messages that prompted users to share their Backup Recovery Keys under the guise of preventing data loss. Once obtained, these keys allowed attackers to restore backups, access private messages, and take over accounts. The campaign primarily targeted individuals of high intelligence value, including government officials, military personnel, political figures, journalists, and Ukrainian officials. This incident underscores the evolving tactics of nation-state actors in exploiting legitimate features of secure messaging apps through social engineering. The focus on high-profile individuals highlights the strategic nature of the campaign, emphasizing the need for heightened vigilance and robust security practices among potential targets.
2 months ago
Kill Chain
StrikeShark Campaign Unleashes SharkLoader to Deploy Cobalt Strike Beacons
In June 2026, a cyber attack campaign named StrikeShark was identified, deploying a new malware loader called SharkLoader to deliver Cobalt Strike Beacons on compromised systems. The campaign targeted a diverse range of entities, including diplomatic organizations in Indonesia, government bodies in Taiwan, and software development companies across multiple countries. Attackers exploited known vulnerabilities in Microsoft Exchange Server (CVE-2021-26855), Openfire (CVE-2023-32315), and GeoServer (CVE-2024-36401) to gain initial access, subsequently establishing persistence through web shells and DLL side-loading techniques. The use of open-source post-compromise tools like FScan and Pillager suggests potential involvement of Chinese-speaking threat actors. This incident underscores the persistent threat posed by sophisticated malware loaders and the exploitation of known vulnerabilities. Organizations must prioritize timely patching and employ robust detection mechanisms to mitigate such risks. The broad geographic reach and diverse target set of this campaign highlight the evolving tactics of threat actors in the current cyber threat landscape.
2 months ago
Kill Chain
Persistent Cyber Scam Centers in Asia Despite Crackdowns
In June 2026, reports from INTERPOL and Amnesty International highlighted the persistent and escalating issue of cyber scam centers across Asia, particularly in Cambodia, Myanmar, Laos, and the Philippines. Despite high-profile crackdowns and arrests, these operations continue to thrive, generating an estimated $40 billion annually through schemes like romance fraud and investment scams. The resilience of these criminal enterprises is largely attributed to local corruption and collusion with law enforcement, which undermine efforts to dismantle them. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/New-INTERPOL-report-highlights-escalating-cyber-threats-across-Asia-and-South-Pacific?utm_source=openai)) This situation underscores the urgent need for enhanced international cooperation and robust anti-corruption measures. The continued operation of these scam centers not only results in significant financial losses globally but also involves severe human rights abuses, including human trafficking and forced labor. Addressing this issue is critical to protecting vulnerable populations and maintaining global cybersecurity. ([amnesty.org](https://www.amnesty.org/en/latest/news/2026/06/cambodia-evidence-suggests-scamming-compounds-bypassed-despite-high-profile-crackdown/?utm_source=openai))
2 months ago
Kill Chain
Instructure's Canvas LMS Breached Twice by ShinyHunters in 2026
In early May 2026, Instructure's Canvas learning management system (LMS) suffered two significant cyberattacks orchestrated by the ShinyHunters group. The initial breach on April 29 led to the exfiltration of personal data from approximately 275 million users across nearly 9,000 educational institutions. Compromised information included names, email addresses, student ID numbers, and private messages. Despite Instructure's remediation efforts, ShinyHunters executed a second attack on May 7, defacing Canvas login pages to pressure the company into paying a ransom. In response, Instructure reached an agreement with the attackers, resulting in the return and purported destruction of the stolen data. ([techcrunch.com](https://techcrunch.com/2026/05/12/instructure-strikes-deal-with-hackers-who-breached-it-twice/?utm_source=openai)) This incident underscores a growing trend where cybercriminals target educational technology vendors to exploit vulnerabilities and access vast amounts of sensitive data. The attacks on Instructure highlight the critical need for robust cybersecurity measures within the edtech sector to protect against such large-scale breaches.
2 months ago
Kill Chain
Gamaredon's 2025 Spearphishing Escalation: A Wake-Up Call for Cybersecurity
In 2025, the Russian state-sponsored APT group Gamaredon intensified its cyber espionage activities against Ukrainian governmental institutions. The group launched numerous spearphishing campaigns, introducing six new malware tools leveraging PowerShell and VBScript to enhance stealth, persistence, and lateral movement. Notably, Gamaredon concealed its command-and-control infrastructure behind Cloudflare tunnels and utilized third-party services like Telegram and Dropbox to obfuscate its operations. ([eset.com](https://www.eset.com/uk/about/newsroom/press-releases/eset-research-russias-gamaredon-apt-group-unleashed-spearphishing-campaigns-against-ukraine-with-an-evolved-toolset-uk/?utm_source=openai)) This escalation underscores the evolving threat landscape, highlighting the need for organizations to adopt advanced detection and response strategies to counter sophisticated state-sponsored cyber threats.
2 months ago
Kill Chain
Operation Endgame: A Landmark Blow to Cybercriminal Networks in 2026
In June 2026, Europol, in collaboration with international law enforcement agencies and private sector partners, executed Operation Endgame, a coordinated effort targeting the infrastructure supporting the SocGholish, Amadey, and StealC malware networks. This operation led to the dismantling of 326 servers and 142 domains, the recovery of 27 million stolen login credentials, and the seizure of over €41 million in cryptocurrency assets. The SocGholish malware, linked to the Russian cybercriminal group Evil Corp, had compromised nearly 15,000 legitimate websites to distribute malicious software. Amadey and StealC were utilized to gain initial access to systems and exfiltrate sensitive data, respectively. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai)) This operation signifies a strategic shift in combating cybercrime by disrupting entire malware ecosystems rather than focusing on individual threats. The success of Operation Endgame underscores the effectiveness of international cooperation and public-private partnerships in addressing large-scale cyber threats. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/global-cyber-strike-disrupts-socgholish-amadey-and-stealc-malware-networks?utm_source=openai))
2 months ago
Kill Chain
Turla's STOCKSTAY Backdoor: A New Cyber Espionage Threat
In June 2026, Google's Threat Intelligence Group identified a new .NET backdoor named STOCKSTAY, attributed to the Russian state-sponsored group Turla. This malware has been deployed against government and military organizations in Ukraine and entities interested in Italian foreign policy. STOCKSTAY, developed since at least December 2022, shares significant code and functional overlaps with Turla's previous implant, Kazuar. The backdoor comprises multiple components that communicate via inter-process communication channels and utilize secure WebSocket connections for command-and-control communication. It supports various commands, including file manipulation, system information gathering, and screen capture. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/stockstay-turla-intelligence-gathering/?utm_source=openai)) The discovery of STOCKSTAY underscores the evolving sophistication of state-sponsored cyber espionage tools. Its deployment highlights the persistent threat posed by advanced persistent threats (APTs) like Turla, emphasizing the need for robust cybersecurity measures and continuous monitoring to protect sensitive governmental and military information.
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
