Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 1777 to 1788 of 5957
Crypto Clipper Campaign: A New Era of Cyber Deception
In June 2026, a sophisticated cyber campaign was uncovered wherein an unidentified threat actor utilized multiple platforms to distribute a Rust-based cryptocurrency clipboard hijacker targeting Windows and macOS users. The malware was disseminated through a dedicated WordPress phishing page, GitHub and SourceForge projects promoted by fake accounts, and a YouTube channel featuring AI-generated narrators. Additionally, the actor manipulated reputation systems by posting benign votes and "safe" comments on VirusTotal to misclassify the malicious files as harmless. This campaign highlights the evolving tactics of cybercriminals who exploit trust mechanisms across various platforms to deceive users into downloading malicious software. The use of AI-generated content and coordinated fake reviews underscores the need for heightened vigilance and advanced detection methods to combat such deceptive practices.
3 months ago
Kill Chain
Attacker Exploits Tailscale and OpenSSH for Persistent Access in French Automotive Business Breach
In April 2026, a French-speaking attacker, identified as 'Poisson,' infiltrated a small French automotive business. Utilizing a VBScript stager and PowerShell loader, he deployed the Havoc Demon agent in memory, avoiding disk detection. For persistence, he established scheduled tasks and injected shellcode into Explorer.exe. Notably, before his command-and-control (C2) server went offline, Poisson installed OpenSSH and Tailscale on a compromised machine, creating an independent access route. This allowed him to maintain control even after the C2 server was deactivated, leading to the theft of banking and email credentials. This incident underscores the evolving tactics of cybercriminals who leverage legitimate tools like Tailscale and OpenSSH to establish resilient backdoors. The use of such tools complicates detection and remediation efforts, highlighting the need for organizations to monitor for unauthorized installations and unusual network configurations.
3 months ago
Kill Chain
Cybercriminals Exploit Remote Access Tools in 2026 Attacks
Between January and March 2026, cybercriminals exploited legitimate remote access tools such as LogMeIn and ScreenConnect to gain unauthorized access to victim devices. These attacks, detailed in HP's Threat Insights Report, involved phishing emails that tricked users into installing these tools, allowing attackers to control systems without triggering security alerts. The abuse of trusted software enabled threat actors to blend malicious activities with normal IT operations, complicating detection and response efforts. This incident underscores a growing trend where attackers leverage legitimate remote monitoring and management (RMM) tools to establish persistent access and deploy malware. The increasing sophistication of such tactics highlights the need for organizations to enhance monitoring of software installations, enforce strict privilege controls, and update defenses to detect and prevent misuse of trusted applications.
3 months ago
Kill Chain
Understanding the HTTP/2 Bomb (CVE-2026-49975) Vulnerability
In June 2026, a critical denial-of-service vulnerability, CVE-2026-49975, known as the "HTTP/2 Bomb," was disclosed. This flaw exploits the HPACK compression and flow control features of the HTTP/2 protocol, allowing attackers to send minimal requests that rapidly exhaust server memory. Major web servers, including NGINX, Apache HTTPD, Microsoft IIS, Envoy, and Cloudflare Pingora, are affected in their default configurations. The attack can be executed remotely without authentication, leading to immediate service disruptions. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-49975-http-2-bomb-dos/?utm_source=openai)) The discovery of this vulnerability underscores the evolving threat landscape, where attackers leverage protocol features to amplify attacks. Organizations must prioritize patching affected systems and consider implementing additional security measures, such as Web Application Firewalls (WAFs), to mitigate potential exploits. ([imperva.com](https://www.imperva.com/blog/imperva-customers-protected-against-cve-2026-49975-http-2-bomb-dos/?utm_source=openai))
3 months ago
Kill Chain
Debate Erupts Over U.S. Ban on Anthropic's AI Models
In June 2026, the U.S. government issued an export control order restricting foreign nationals from accessing Anthropic's advanced AI models, Claude Fable 5 and Mythos 5, citing national security concerns. This led Anthropic to suspend the models' use for all customers to ensure compliance. The security community criticized the decision, arguing that it hampers defenders' access to crucial tools while doing little to prevent adversaries from developing similar capabilities. Experts highlighted that such restrictions might inadvertently accelerate the development of decentralized, open-source alternatives, potentially diminishing U.S. leadership in AI security. The incident underscores the delicate balance between national security and technological advancement, emphasizing the need for policies that support innovation while mitigating risks.
3 months ago
Kill Chain
FortiBleed: Unprecedented Credential Harvesting Compromises 30,000+ Fortinet Devices
In June 2026, a large-scale credential harvesting operation, dubbed 'FortiBleed,' targeted Fortinet firewalls and VPN gateways, compromising over 30,000 internet-facing devices across nearly 200 countries. The attackers, suspected to be Russian-speaking threat actors, utilized automated tools to collect and verify login credentials, exploiting weak or default passwords without leveraging any known Fortinet vulnerabilities. This campaign affected various sectors, including government, telecommunications, healthcare, education, financial services, and critical infrastructure, with significant concentrations in India and the United States. The operation underscores the critical importance of robust password policies and the implementation of multi-factor authentication to safeguard network security devices. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices?utm_source=openai))
3 months ago
Kill Chain
Phantom Stealer: The Rise of Fileless Malware Targeting Financial Institutions
In June 2026, a sophisticated phishing campaign targeted banks and high-value organizations, deploying Phantom Stealer—a fileless malware designed to evade traditional endpoint defenses. The attack began with phishing emails containing seemingly legitimate business documents. Upon opening, a heavily obfuscated batch file initiated a multistage infection chain, injecting Phantom Stealer into the Windows Explorer process. Operating entirely in memory, the malware silently exfiltrated browser credentials, session cookies, and financial data through multiple channels, including Telegram, Discord, FTP, and SMTP. This incident underscores the evolving tactics of cybercriminals, highlighting the increasing use of fileless malware and advanced evasion techniques. Organizations must enhance their security posture by adopting behavior-based detection systems and educating employees on recognizing sophisticated phishing attempts to mitigate such threats.
3 months ago
Kill Chain
CISA Adds CVE-2026-48907 to Known Exploited Vulnerabilities Catalog
In June 2026, a critical vulnerability identified as CVE-2026-48907 was discovered in the Joomla Content Editor (JCE) extension, allowing unauthenticated attackers to create new editor profiles and upload arbitrary PHP code, leading to remote code execution. This flaw affects JCE versions prior to 2.9.99.5. The Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 16, 2026, following evidence of active exploitation. Joomla released patches on June 3 and June 6, 2026, to address this issue. ([securityweek.com](https://www.securityweek.com/joomla-litespeed-vulnerabilities-exploited-in-attacks/?utm_source=openai)) The active exploitation of CVE-2026-48907 underscores the persistent threat posed by web application vulnerabilities, particularly in widely used content management systems like Joomla. Organizations are urged to promptly apply the latest security updates to mitigate potential risks associated with this vulnerability.
3 months ago
Kill Chain
CISA Issues Warning on Actively Exploited Joomla JCE Vulnerability
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical vulnerability, CVE-2026-48907, affecting the Joomla Content Editor (JCE) to its Known Exploited Vulnerabilities catalog. This flaw, present in JCE versions 1.0.0 through 2.9.99.4, allows unauthenticated users to create new editor profiles, enabling the upload and execution of arbitrary PHP code on the server. The vulnerability has been actively exploited, with attackers leveraging it to gain unauthorized access and control over affected Joomla installations. The active exploitation of this vulnerability underscores the persistent threat posed by improper access controls in widely used content management systems. Organizations utilizing Joomla with the JCE extension are urged to update to version 2.9.99.5 or later to mitigate this risk. Additionally, administrators should audit their systems for unauthorized editor profiles and monitor server logs for suspicious activity to prevent potential breaches.
3 months ago
Kill Chain
Unveiling the VHDX-Based Remcos RAT Attack: A 2026 Cybersecurity Challenge
In June 2026, a sophisticated malware campaign was identified, utilizing a VHDX disk image within a ZIP archive to deliver the Remcos Remote Access Trojan (RAT). Upon extraction, the VHDX file auto-mounted on Windows systems, revealing an obfuscated JavaScript file named 'Partnerschaft_fur_neue_Angebotsanfrage.js', indicating potential targeting of German-speaking users. This JavaScript initiated a multi-stage infection chain involving PowerShell scripts and .NET loaders, ultimately injecting the Remcos RAT into the 'backgroundTaskHost.exe' process. The malware established communication with a command-and-control server at animal342[.]duckdns[.]org:53552, enabling remote surveillance and data exfiltration. Notably, the campaign employed techniques such as WMI for process execution and Base64 encoding with XOR decryption to evade detection by traditional security measures. This incident underscores the evolving tactics of cybercriminals who leverage legitimate system features and complex obfuscation methods to bypass security controls. The use of VHDX files as malware containers highlights the need for enhanced vigilance and advanced detection mechanisms to counter such sophisticated threats.
3 months ago
Kill Chain
Mastra npm Supply Chain Attack: 144 Packages Compromised
In June 2026, a significant supply chain attack targeted the Mastra npm ecosystem, compromising 144 packages associated with the '@mastra' namespace. The attack was initiated through the hijacking of a former contributor's npm account, 'ehindero'. The attackers introduced a malicious dependency named 'easy-day-js', which masqueraded as the legitimate 'dayjs' library. Initially, 'easy-day-js' appeared benign, but subsequent versions contained obfuscated post-install scripts designed to exfiltrate sensitive information from developers' systems. This incident underscores the vulnerabilities inherent in open-source software supply chains, particularly when trusted contributor accounts are compromised. The Mastra framework, widely used for building AI applications, saw its core components, such as '@mastra/core', affected, amplifying the potential impact on downstream projects and organizations. The attack highlights the critical need for robust security measures in package management and dependency verification processes. The increasing frequency of such supply chain attacks emphasizes the urgency for the developer community to adopt stringent security practices, including regular audits of dependencies, implementation of multi-factor authentication for contributor accounts, and continuous monitoring for anomalous activities within software ecosystems.
3 months ago
Kill Chain
Malicious JetBrains Plugins Compromise AI API Keys in 2026
In June 2026, cybersecurity researchers identified a coordinated malware campaign involving at least 15 malicious plugins on the JetBrains Marketplace. These plugins, masquerading as AI coding assistants built on DeepSeek and other large language models, were designed to exfiltrate artificial intelligence (AI) provider keys. The plugins offered functionalities such as chat, commit messages, code review, bug finding, and unit tests, thereby enticing developers to install them. Once installed, the plugins covertly transmitted sensitive API keys to attacker-controlled servers, potentially compromising the security of AI-driven applications and services. This incident underscores a growing trend where threat actors exploit the trust in developer tools and marketplaces to distribute malicious software. The increasing integration of AI into development workflows makes such platforms attractive targets. Organizations must remain vigilant, ensuring the integrity of the tools they incorporate and regularly auditing their development environments to prevent unauthorized access and data exfiltration.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
