Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1705 to 1716 of 5957
Crypto Heist Leveraging Fake Reputation Networks to Distribute Malware
In June 2026, cybercriminals orchestrated a sophisticated campaign to distribute a Rust-based clipboard hijacking malware targeting both Windows and macOS users. The attackers created a comprehensive fake reputation network, utilizing GitHub repositories, SourceForge projects, AI-generated YouTube videos, and manipulated VirusTotal comments to lend credibility to their malicious tools. These tools, masquerading as crypto trading and gambling aids, were designed to steal cryptocurrency by intercepting wallet addresses copied to the clipboard, affecting assets like Bitcoin, Ethereum, Monero, Binance Chain, and Solana. This incident underscores a significant evolution in cybercriminal tactics, highlighting their ability to exploit multiple trusted platforms to build false credibility and deceive users. The campaign's success demonstrates the urgent need for enhanced vigilance and skepticism towards online reputation signals, especially in the cryptocurrency domain, where the allure of quick profits can cloud judgment.
2 months ago
Kill Chain
INTERPOL Highlights Escalating Cyber Threats in Asia-Pacific
INTERPOL's 2025/2026 Asia and South Pacific Cyberthreat Assessment Report highlights a significant surge in cybercrime across the region, driven by rapid digitalization and organized criminal networks. Phishing has emerged as the most prevalent and financially damaging form of cybercrime, with over half of the surveyed countries reporting that cybercrime accounts for more than 30% of all recorded crimes. The report also notes a rise in ransomware attacks, deepfake scams, and AI-driven frauds targeting sectors such as real estate, manufacturing, and financial services. ([interpol.int](https://www.interpol.int/content/download/24327/file/CYBER_ASP%20Cyber%20Threat%20Assessment%20Report_2025_2026_v4.pdf?utm_source=openai)) This escalation underscores the urgent need for enhanced cybersecurity measures and international cooperation to combat the evolving threat landscape. The increasing sophistication of cybercriminal tactics, including the use of AI and ransomware-as-a-service models, poses a substantial risk to both public and private sectors. ([interpol.int](https://www.interpol.int/content/download/24327/file/CYBER_ASP%20Cyber%20Threat%20Assessment%20Report_2025_2026_v4.pdf?utm_source=openai))
2 months ago
Kill Chain
React2Shell (CVE-2025-55182) Exploitation: A December 2025 Cybersecurity Incident
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed, affecting React Server Components versions 19.0.0 through 19.2.0. This flaw allowed unauthenticated remote code execution via improper deserialization in the Flight protocol. Within hours of disclosure, multiple state-sponsored threat groups, including China's Earth Lamia and Jackpot Panda, as well as North Korean actors, began exploiting the vulnerability to deploy malware, establish persistent access, and exfiltrate data. The rapid exploitation led to significant security incidents across various sectors globally. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The React2Shell incident underscores the critical importance of prompt patching and vigilant monitoring. The swift exploitation by sophisticated threat actors highlights the need for organizations to enhance their vulnerability management processes and adopt proactive security measures to mitigate emerging threats effectively.
2 months ago
Kill Chain
AryStinger Malware Hijacks 4,300 Legacy Routers in 2026
In June 2026, security researchers at QiAnXin's XLab identified a new malware strain named AryStinger, which has compromised over 4,300 outdated routers, primarily D-Link models like DIR-850L and DIR-818LW. The malware exploits old vulnerabilities—CVE-2013-3307 and CVE-2016-5681—to transform these devices into a distributed network for reconnaissance and proxying malicious traffic. Unlike typical botnets used for DDoS attacks, AryStinger focuses on pre-intrusion activities such as internet scanning, service fingerprinting, subdomain enumeration, and traffic tunneling, effectively masking the attacker's origin. This incident underscores the critical risks posed by unpatched, legacy hardware in both residential and small office environments. The widespread infection, notably concentrated in South Korea and China, highlights the necessity for regular firmware updates and the decommissioning of unsupported devices to prevent their exploitation in sophisticated cyber operations.
2 months ago
Kill Chain
CSIS's Landmark Operation: Neutralizing Botnet Threats in Canada
In May 2024, the Canadian Security Intelligence Service (CSIS) obtained a Federal Court warrant to neutralize two foreign-operated botnets that had infected servers, home routers, and IoT devices across Canada. This unprecedented legal authorization allowed CSIS to alter, degrade, and destroy malicious data on compromised devices, effectively severing their connection to the botnet networks. The operation targeted a range of devices, including Ring doorbells, security cameras, and Wi-Fi-enabled appliances, to mitigate potential threats to critical infrastructure and national security. This case underscores the evolving landscape of cyber threats and the necessity for intelligence agencies to adopt proactive measures. The legal framework established by this warrant sets a precedent for future cyber defense operations, highlighting the importance of balancing national security interests with individual privacy rights.
2 months ago
Kill Chain
Squidbleed Vulnerability (CVE-2026-47729) Exposes Cleartext HTTP Requests
In June 2026, researchers disclosed 'Squidbleed' (CVE-2026-47729), a critical vulnerability in the Squid web proxy that has existed since 1997. This heap over-read flaw allows an attacker with access to the same proxy to leak another user's cleartext HTTP requests, potentially exposing sensitive information such as credentials or session tokens. The vulnerability stems from improper handling of FTP directory listings, leading to memory disclosure when parsing malformed responses from attacker-controlled FTP servers. Squid's default configuration, which enables FTP support and permits traffic on port 21, exacerbates the risk. The disclosure of Squidbleed underscores the persistent risks associated with legacy code and the importance of regular security audits. Organizations relying on Squid proxies should promptly update to version 7.7 or later, which addresses this vulnerability. Additionally, disabling FTP support can mitigate exposure. This incident highlights the need for vigilant maintenance of network infrastructure to prevent exploitation of longstanding vulnerabilities.
2 months ago
Kill Chain
OXLOADER Exploits Google Ads to Distribute CastleStealer Malware
In June 2026, cybersecurity researchers identified a new malware loader named OXLOADER, which is being used to distribute the CastleStealer infostealer. The campaign begins with malicious Google Ads that redirect users searching for 'lts version of node.js' to a counterfeit website. This site delivers a batch script hosted on Storj, which, when executed, downloads and runs OXLOADER. OXLOADER employs advanced obfuscation techniques and anti-analysis measures to evade detection, ultimately deploying CastleStealer to exfiltrate sensitive information from infected systems. This incident underscores the evolving tactics of threat actors who exploit legitimate services like Google Ads and Storj to distribute malware. The sophisticated obfuscation and anti-analysis methods used by OXLOADER highlight the increasing complexity of malware designed to bypass traditional security measures, posing significant challenges for detection and mitigation.
2 months ago
Kill Chain
AryStinger Botnet Hijacks Over 4,000 D-Link Routers Globally
In June 2026, the AryStinger botnet compromised over 4,000 outdated D-Link routers worldwide, transforming them into proxies for malicious activities. The malware exploited known vulnerabilities, including CVE-2013-3307, CVE-2016-5681, and CVE-2025-11837, primarily targeting D-Link DIR-850L and DIR-818LW models. Infected devices were utilized for scanning, proxying, tunneling, and command execution, with the capability to tamper with DNS settings and monitor network traffic. The majority of infections were reported in South Korea (48.5%), China (31.8%), Sweden (6.4%), Malaysia (3.5%), and Singapore (2.5%). This incident underscores the critical need for organizations to replace end-of-life hardware and apply the latest firmware updates to mitigate risks associated with outdated devices. The AryStinger botnet's exploitation of legacy vulnerabilities highlights the ongoing threat posed by unpatched systems in the cybersecurity landscape.
2 months ago
Kill Chain
Mastra AI Supply Chain Attack: A Wake-Up Call for Software Security
In June 2026, Microsoft identified a significant supply chain attack targeting the Mastra AI ecosystem, attributed to the North Korean state-sponsored group Sapphire Sleet (also known as BlueNoroff). The attackers compromised an npm maintainer account, 'ehindero,' with publishing privileges across the Mastra package environment. They published malicious updates for over 140 packages within the @mastra scope, introducing a malicious dependency named 'easy-day-js,' a typosquat of the legitimate 'dayjs' JavaScript library. Upon installation, this dependency executed a post-install hook deploying a malware dropper on developers' devices, aiming to steal sensitive credentials, API keys, authentication tokens, and cryptocurrency wallets. The second-stage payload was a cross-platform information stealer designed to target Windows, Linux, and macOS systems, collecting host information, browser histories, installed applications, running processes, and checking for 166 cryptocurrency wallet browser extensions, including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, and TronLink. The malware employed different persistence methods depending on the operating system, such as Windows Registry Run keys, macOS LaunchAgents, and Linux systemd services. Microsoft observed that systems communicating with the attackers' command-and-control servers exhibited follow-on activity consistent with Sapphire Sleet's previous campaigns, including the deployment of a PowerShell backdoor, additional persistence mechanisms, Microsoft Defender exclusions, and a malicious Windows service granting SYSTEM privileges. This incident underscores the evolving tactics of North Korean threat actors in targeting the software supply chain to facilitate credential theft and cryptocurrency asset exfiltration. Organizations are urged to enhance their supply chain security measures and remain vigilant against such sophisticated attacks.
2 months ago
Kill Chain
Prinz Eugen Ransomware: A New Threat Targeting Recent Files
In June 2026, the Prinz Eugen ransomware group launched attacks targeting organizations in the United Kingdom, France, and South Africa. The group gained initial access through stolen RDP credentials, utilizing legitimate remote monitoring and management tools to establish persistence. Their Go-based malware prioritized encrypting recently modified files, aiming to disrupt critical business operations. Notably, the ransomware did not leave a ransom note, complicating detection and response efforts. This incident underscores the evolving tactics of ransomware groups, emphasizing the need for organizations to enhance their cybersecurity measures. The use of legitimate tools for malicious purposes highlights the importance of monitoring for anomalous behavior and implementing robust access controls to mitigate such threats.
2 months ago
Kill Chain
Critical Vulnerability in Gravity SMTP Plugin Exposes API Keys
In June 2026, a significant security vulnerability (CVE-2026-4020) was discovered in the Gravity SMTP WordPress plugin, affecting approximately 100,000 websites. This flaw allowed unauthenticated attackers to access sensitive information, including API keys and configuration data, through an improperly secured REST API endpoint. Exploitation of this vulnerability enabled threat actors to harvest credentials and gain insights into the site's software stack, potentially facilitating further attacks. The incident underscores the critical importance of promptly updating plugins and securing REST API endpoints to prevent unauthorized data exposure. It also highlights the need for website administrators to regularly audit and monitor their systems for vulnerabilities to mitigate the risk of exploitation.
2 months ago
Kill Chain
FortiBleed 2026: A Wake-Up Call for Credential Security
In June 2026, a large-scale credential theft campaign, dubbed "FortiBleed," targeted Fortinet devices, compromising approximately 75,000 firewalls and VPNs globally. Attackers employed password spraying techniques using curated lists from previous breaches to gain unauthorized access. Once inside, they extracted configuration files and credentials, enabling further exploitation and persistence within affected networks. Notably, major corporations such as Chevron, Samsung, and Toyota were impacted, with some organizations experiencing full network infiltration and data exfiltration. This incident underscores the escalating threat of credential-based attacks and highlights the critical need for robust security measures. Organizations must prioritize implementing multi-factor authentication, regularly updating credentials, and monitoring for unauthorized access to mitigate such risks.
2 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
