Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1717 to 1728 of 5957
FortiBleed: Unprecedented Exposure of Fortinet Credentials in 2026
In June 2026, a significant cybersecurity incident known as 'FortiBleed' was uncovered, exposing nearly 74,000 Fortinet firewall and VPN credentials. Security researcher Volodymyr 'Bob' Diachenko discovered a server containing valid Fortinet VPN credentials, including usernames, email addresses, and plaintext passwords for 73,932 firewall URLs worldwide. The exposed data also included organizational details such as industry, revenue, and employee count, suggesting the information was compiled to facilitate future attacks. Threat intelligence company Hudson Rock described this as one of the largest known collections of compromised Fortinet credentials, spanning 21,632 unique domains across 194 countries. The 'FortiBleed' incident underscores the critical importance of securing network devices against credential-based attacks. Organizations are urged to implement robust password policies, enable multifactor authentication, and regularly monitor for unauthorized access to mitigate such threats.
3 months ago
Kill Chain
CISA Confirms Active Exploitation of Splunk Enterprise Vulnerability CVE-2026-20253
In June 2026, a critical vulnerability (CVE-2026-20253) was identified in Splunk Enterprise versions 10.2.0 to 10.2.3 and 10.0.0 to 10.0.6, allowing unauthenticated remote attackers to create or truncate arbitrary files via a PostgreSQL sidecar service endpoint lacking authentication controls. This flaw enables potential remote code execution, posing significant risks to affected systems. ([advisory.splunk.com](https://advisory.splunk.com/advisories/SVD-2026-0603?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of this vulnerability and has mandated federal agencies to patch their systems by June 22, 2026.
3 months ago
Kill Chain
Understanding Device Code Phishing: The New Frontier in MFA Bypass
In early 2026, cybersecurity researchers identified a surge in phishing campaigns exploiting the OAuth 2.0 Device Authorization Grant flow to bypass multi-factor authentication (MFA). Attackers trick users into entering device codes on legitimate Microsoft authentication pages, granting unauthorized access to services like Outlook, OneDrive, and Teams without stealing credentials. This method allows persistent access, even after password resets, posing significant risks to organizations relying on traditional MFA for security. The proliferation of Phishing-as-a-Service platforms, such as Kali365, has lowered the technical barrier for cybercriminals, enabling large-scale exploitation of this technique. The FBI and Microsoft have issued warnings, emphasizing the need for organizations to implement conditional access policies, disable device code authentication where unnecessary, and adopt phishing-resistant MFA solutions to mitigate these evolving threats.
3 months ago
Kill Chain
Texas Parks and Wildlife Department Data Breach Exposes Over 3 Million Records
In June 2026, the Texas Parks and Wildlife Department (TPWD) disclosed a significant data breach involving its license system vendor, exposing personal information of over 3 million individuals. The compromised data includes driver's license information, passport numbers, email addresses, phone numbers, and residential addresses. Notably, Social Security numbers, dates of birth, and financial information were not affected. The breach was detected by the Texas Cyber Command, prompting an immediate investigation and the implementation of enhanced security measures. ([tpwd.texas.gov](https://tpwd.texas.gov/about/notification-of-data-security-incident/?utm_source=openai)) This incident underscores the escalating risks associated with third-party vendors in data security. Organizations are increasingly vulnerable to breaches through external partners, highlighting the necessity for stringent vendor management and comprehensive security protocols to safeguard sensitive information.
3 months ago
Kill Chain
Klue OAuth Breach 2026: Lessons in Third-Party Integration Security
In June 2026, Klue, a market intelligence platform, experienced a security breach where attackers exploited a compromised legacy credential to access Klue's integration infrastructure. This allowed them to steal OAuth tokens used to connect Klue with third-party platforms, notably Salesforce. Utilizing these tokens, the attackers accessed and exfiltrated data from multiple customer Salesforce environments. The incident was publicly claimed by the 'Icarus' extortion group, which pressured affected organizations to contact them to prevent the leaking of stolen data. This breach underscores the critical vulnerabilities associated with third-party integrations and the OAuth protocol. It highlights the necessity for organizations to rigorously monitor and manage third-party access, regularly audit integration credentials, and implement robust security measures to prevent unauthorized access through supply chain vectors.
3 months ago
Kill Chain
Critical Vulnerability in Gravity SMTP Plugin: CVE-2026-4020 Exploited
In June 2026, an unauthenticated information disclosure vulnerability (CVE-2026-4020) was discovered in the Gravity SMTP WordPress plugin, affecting versions up to 2.1.4. This flaw exposed sensitive data, including API keys, email service credentials, and system configuration details, to unauthenticated users via an improperly secured REST API endpoint. Exploitation of this vulnerability could lead to unauthorized access and control over affected websites. The incident underscores the critical importance of promptly updating plugins and implementing robust security measures to protect against emerging threats. Organizations must remain vigilant, as attackers continue to exploit such vulnerabilities to gain unauthorized access and compromise sensitive information.
3 months ago
Kill Chain
AutoJack Attack: A Wake-Up Call for AI Agent Security
In June 2026, Microsoft researchers disclosed a critical vulnerability named 'AutoJack' that allows a single web page to hijack AI browsing agents, leading to remote code execution on the host machine. By directing an AI agent to load a malicious web page, attackers can exploit JavaScript to interact with privileged local services, spawning unauthorized processes without requiring user credentials or further interaction. This exploit underscores the significant risks associated with AI agents' integration with web content and their elevated system privileges. The AutoJack attack highlights the growing trend of adversaries targeting AI development tools and agents. Similar incidents, such as the 'Agentjacking' attack, have demonstrated how AI coding agents can be manipulated into executing malicious code through crafted error reports. These developments emphasize the urgent need for robust security measures in AI agent design and deployment to prevent exploitation through prompt injections and other novel attack vectors.
3 months ago
Kill Chain
The Gentlemen RaaS Unleashes GentleKiller: A New EDR Evasion Framework
In June 2026, The Gentlemen ransomware-as-a-service (RaaS) operation was identified as actively developing and distributing a suite of endpoint detection and response (EDR) termination tools, collectively known as the GentleKiller framework. This framework targets approximately 400 processes associated with 48 distinct security programs, effectively disabling system defenses prior to deploying ransomware payloads. The Gentlemen group has demonstrated rapid operationalization of newly disclosed proof-of-concept exploits, often integrating them within days of public release. The Gentlemen's ability to swiftly adapt and enhance their EDR evasion techniques underscores a significant evolution in ransomware tactics, emphasizing the need for organizations to implement robust, multi-layered security measures. The group's extensive use of the bring your own vulnerable driver (BYOVD) technique highlights the importance of monitoring and controlling driver installations to prevent such attacks.
3 months ago
Kill Chain
Unpatchable 'usbliter8' Exploit Compromises Apple A12 and A13 SecureROM
In June 2026, security researchers at Paradigm Shift disclosed 'usbliter8,' an unpatchable BootROM exploit affecting Apple's A12 and A13 chips. This vulnerability allows arbitrary code execution within the SecureROM, a critical component of the device's boot process. Due to its hardware nature, the flaw cannot be remedied through software updates, leaving devices such as the iPhone XS, XR, and 11 series permanently susceptible. Exploitation requires physical access to the device in DFU mode and a USB connection to a specialized microcontroller, enabling the execution of unsigned code and potential bypassing of Apple's secure boot chain. ([macrumors.com](https://www.macrumors.com/2026/06/18/a12-and-a13-chips-facing-exploit/?utm_source=openai)) The disclosure of 'usbliter8' underscores the persistent challenges in hardware security, particularly with vulnerabilities that cannot be mitigated post-manufacture. This incident highlights the importance of robust hardware design and the need for continuous vigilance in identifying and addressing security flaws that could be exploited through physical access.
3 months ago
Kill Chain
FortiBleed Campaign: A Wake-Up Call for Credential Security
In June 2026, the 'FortiBleed' campaign was uncovered, revealing that cybercriminals had compromised approximately 73,932 Fortinet FortiGate firewalls across 194 countries. The attackers, identified as Russian-speaking, executed over 1.1 billion credential attempts against FortiGate VPN instances and 2.1 billion against Microsoft SQL Server systems. They exploited weak or default credentials and intercepted SSL VPN authentication hashes, which were cracked using a 45-GPU cluster managed through Hashtopolis. This led to unauthorized access to internal Active Directory environments, affecting sectors such as government, telecommunications, financial services, healthcare, manufacturing, and critical infrastructure. Notably, a Turkish NATO defense contractor reportedly lost classified documents due to this breach. This incident underscores the critical importance of robust credential management and the implementation of multi-factor authentication (MFA). The scale and sophistication of the FortiBleed campaign highlight the evolving tactics of threat actors and the necessity for organizations to proactively secure their network devices and monitor for unauthorized access.
3 months ago
Kill Chain
Apple Releases Critical Firmware Update for Beats Studio Buds
In June 2026, Apple released firmware update 1B211 for its Beats Studio Buds to address a critical vulnerability (CVE-2025-20701) that allowed attackers within Bluetooth range to eavesdrop through the device's microphone during the pairing process. This flaw, stemming from incorrect authorization in the Airoha Bluetooth audio SDK, enabled unauthorized pairing without user consent, potentially compromising user privacy. ([macrumors.com](https://www.macrumors.com/2026/06/16/beats-studio-buds-bluetooth-vulnerability/?utm_source=openai)) This incident underscores the importance of promptly addressing vulnerabilities in widely used consumer devices, especially those involving open-source components. It highlights the need for continuous vigilance and timely updates to protect user privacy and maintain trust in wireless technologies.
3 months ago
Kill Chain
FBI and Google Dismantle 'Outsider Enterprise' Phishing Operation
In June 2026, the FBI, in collaboration with Google and Lumen Technologies, dismantled 'Outsider Enterprise,' a China-based phishing-as-a-service (PhaaS) operation. Active since 2023, this network utilized AI-driven phishing kits to impersonate trusted brands, distributing over 2.5 million fraudulent SMS messages to Android users within a two-week period. The operation led to the theft of approximately 3.8 million credit card records, resulting in an estimated $1.9 billion in financial losses. Authorities seized multiple administrative servers, a Shopify storefront, a Telegram bot containing customer data, and approximately $100,000 in cryptocurrency. Google also filed a civil lawsuit against the infrastructure operators and coordinated with major U.S. telecommunications carriers to block the fraudulent messages before they reached targeted users. This takedown underscores the escalating threat posed by AI-enhanced phishing campaigns and the necessity for robust, collaborative cybersecurity measures to protect sensitive information and financial assets.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
