Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 181 to 192 of 5919
N-able N-central CVE-2026-86218: When RMM Platforms Become Attack Vectors
N-able released an emergency hotfix for CVE-2026-86218, a maximum-severity remote code execution vulnerability in its N-central remote monitoring and management platform used by IT departments and MSPs. The flaw allows unprivileged attackers to execute malicious code on exposed N-central instances through low-complexity attacks. With nearly 1,500 N-central servers exposed online and evidence of active exploitation flagged by Huntress cybersecurity, the company urged immediate patching to N-central 2026.3 Hotfix 4. This incident highlights the persistent targeting of remote management platforms that provide privileged access to client networks and infrastructure. RMM platforms continue to be attractive targets as they offer attackers potential access to multiple downstream organizations through a single compromise, making them critical components in supply chain attack scenarios.
1 week ago
Kill Chain
ConnectWise Issues Emergency Alert for Unpatched ScreenConnect Vulnerability
In September 2026, ConnectWise disclosed a critical file transfer vulnerability in ScreenConnect Remote Access that affects both cloud and on-premises deployments. The flaw, which has not yet received a CVE identifier, impacts file transfer behavior in ScreenConnect support and access sessions. ConnectWise released temporary mitigation measures requiring administrators to disable TransferFiles permissions while a permanent patch is developed. With nearly 6,000 ScreenConnect instances exposed online according to Shadowserver, this vulnerability poses significant risk to managed service providers and IT departments. This incident highlights the ongoing targeting of remote access tools by threat actors, particularly as organizations increasingly rely on cloud-hosted management platforms. ScreenConnect has been repeatedly exploited by ransomware groups and state-sponsored attackers, making this unpatched vulnerability a critical concern for enterprise security teams.
1 week ago
Kill Chain
Mathspace Breach Exposes 1M+ Records: How ShinyHunters Weaponized Metabase Vulnerabilities
On August 10, 2026, threat actors exploited a critical SQL injection vulnerability in Mathspace's self-hosted Metabase instance, gaining administrator access and stealing personal data from over 1 million students, staff, and parents across Australia and New Zealand. The attack was executed by the ShinyHunters extortion gang, who downloaded the data on August 27 before the breach was confirmed on September 3. This incident was part of a broader campaign targeting multiple organizations' Metabase installations worldwide, affecting companies including Trezor, Framework, and Tally. This breach highlights the critical importance of securing internal reporting systems and data analytics platforms, as threat actors increasingly target business intelligence tools that often have broad database access. The incident demonstrates how zero-day vulnerabilities in widely-used SaaS tools can be weaponized at scale, creating cascading impacts across multiple organizations simultaneously.
1 week ago
Kill Chain
Trezor Breach Exposes 81,000 Customers: Third-Party Risk Management Failures
In August 2026, cryptocurrency hardware wallet maker Trezor disclosed a significant data breach at its third-party shipping provider ShipMonk, initially affecting 14,000 customers across multiple countries. The breach expanded dramatically when it was revealed that ShipMonk had failed to delete historical customer data as contractually required, ultimately exposing personal information of 81,000 customers including names, addresses, email addresses, and phone numbers. The attack exploited a critical SQL injection zero-day vulnerability in the Metabase analytics platform, with the ShinyHunters extortion gang later claiming responsibility and sending extortion demands to ShipMonk. This incident highlights the persistent vulnerability of third-party supply chains and the critical importance of data retention policies in an era where cryptocurrency adoption is accelerating and regulatory scrutiny is intensifying. The breach demonstrates how a single compromised analytics platform can cascade across multiple organizations, affecting everything from hardware manufacturers to online service providers.
1 week ago
Kill Chain
How BigBear Phishing Service Defeated MFA at 258 Organizations
In September 2026, the BigBear 2.0 phishing-as-a-service platform successfully compromised 258 organizations by bypassing multi-factor authentication on Microsoft 365 accounts. Using an Evilginx2-based adversary-in-the-middle framework across 42 VPS nodes, the operation captured over 5,000 credentials including 474 complete MFA bypasses, 1,032 plaintext passwords, and 4,148 session cookies. The service employed custom JavaScript to disable FIDO2/WebAuthn authentication and used geo-matched residential proxies across 69 countries to evade detection by Microsoft's security systems. This incident highlights the evolving sophistication of phishing-as-a-service platforms that can defeat traditional MFA implementations, demonstrating the urgent need for phishing-resistant authentication methods and comprehensive identity security strategies as threat actors increasingly commercialize advanced bypass techniques.
1 week ago
Kill Chain
PEEP Malware Transforms Chrome and Edge Into Persistent Backdoors
In September 2026, cybersecurity researchers disclosed PEEP, a sophisticated post-exploitation toolkit that transforms Chrome and Edge browsers into persistent backdoors. The malware, derived from the open-source RedExt framework, masquerades as a Smart Bookmarks extension and bypasses browser security by manipulating Chromium's Secure Preferences integrity values. Once deployed on compromised systems, PEEP establishes command-and-control communications via plaintext HTTP, exfiltrates browsing data and credentials, and enables remote command execution through a native messaging host. The toolkit demonstrates advanced persistence techniques and represents a significant evolution in browser-based post-compromise frameworks. This incident highlights the growing sophistication of browser-based attack vectors as threat actors increasingly leverage trusted applications to maintain persistence and evade detection in enterprise environments.
1 week ago
Kill Chain
StyleSmuggler Zero-Day: How Advanced Backdoors Bypass E-Commerce Security
On September 4, 2026, threat actors began exploiting a zero-day vulnerability dubbed 'StyleSmuggler' affecting all versions of Magento and Adobe Commerce platforms. The attackers leveraged PHP code injection through Magento's template system to generate fake payment failure emails, triggering code execution that deployed a sophisticated Rust-based Linux backdoor. The malware disguises itself as legitimate system processes and establishes persistent command-and-control communication using NTP traffic mimicry to evade detection. With over 160,000 Magento installations worldwide, including 14,000 high-traffic sites, this incident represents a significant supply chain risk. This attack highlights the growing trend of threat actors targeting e-commerce platforms through zero-day exploits, coinciding with increased regulatory scrutiny on supply chain security and the rising sophistication of malware that mimics legitimate network protocols to bypass traditional security controls.
1 week ago
Kill Chain
JSCeal Malware: Advanced Session Hijacking Bypasses Google Authentication
JSCeal, a sophisticated compiled V8 JavaScript malware, has been actively targeting cryptocurrency traders since late 2024 through malvertising campaigns on Facebook and Google. The malware uses fake TradingView installers distributed via counterfeit trading sites to harvest credentials, steal browser data, and conduct session replay attacks that bypass Google authentication using stolen cookies. Check Point Research revealed that JSCeal employs advanced obfuscation techniques including RC4-protected strings and control-flow flattening, while maintaining surveillance capabilities through keylogging and screenshot capture. The threat actors behind JSCeal, linked to WEEVILPROXY and MeadowLocust clusters, have expanded their operations across 12 countries in 25 languages, primarily targeting Asia Pacific and Latin America regions. This incident highlights the growing sophistication of browser-based malware campaigns that exploit legitimate advertising platforms to distribute advanced credential harvesting tools, representing a significant escalation in session hijacking techniques that can bypass modern authentication mechanisms.
1 week ago
Kill Chain
N-able Issues Critical Fourth Hotfix: CVE-2026-86218 RCE Vulnerability Exposes MSP Infrastructure
N-able released its fourth critical hotfix in five weeks for the N-central remote monitoring and management platform, addressing CVE-2026-86218, a maximum-severity unauthenticated remote code execution vulnerability with a CVSS 4.0 score of 10.0. The flaw affects all on-premises N-central builds before 2026.3.1.14, with conflicting reports from N-able regarding whether the vulnerability has been exploited in the wild. This incident follows a pattern of critical vulnerabilities in the platform, including previous authentication bypasses that enabled attackers to gain administrative access and pivot to managed endpoints through Cloudflare tunnels. The vulnerability has prompted immediate patching requirements for all on-premises customers and demonstrates the ongoing targeting of managed service provider infrastructure by threat actors seeking to compromise multiple organizations through a single entry point.
1 week ago
Kill Chain
Telerik UI Padding Oracle Exploit: CVE-2026-13181 RCE Chain Puts Web Apps at Risk
In July 2026, Progress Software patched a critical vulnerability chain in Telerik UI for ASP.NET AJAX (CVE-2026-13181) that allows unauthenticated remote code execution. Security firm TantoSec released a working exploit in September 2026, demonstrating how attackers can chain a padding oracle vulnerability with unguarded type resolution to achieve code execution on vulnerable web applications. The attack requires specific non-default configurations including custom encryption keys, affecting versions 2010.1.309 through 2026.2.519. While no confirmed exploitation has been reported for these specific CVEs, the Telerik component has a history of being targeted by ransomware groups and nation-state actors through previous vulnerabilities. This incident highlights the persistent risks in web application components and the importance of timely patching, especially given Telerik's history as a favored target for sophisticated threat actors seeking initial access to enterprise networks.
1 week ago
Kill Chain
ScreenConnect Worm: How Four-Stage VBScript Chains Are Spreading Through Remote Access Tools
In August 2026, cybersecurity researchers at Huntress disclosed a sophisticated worm-like malware campaign that exploited ConnectWise ScreenConnect remote access software to distribute malicious VBScript payloads. The attack utilized three distinct initial access vectors: Quick Assist tech support scams, phishing-delivered MSI installers, and fake Geek Squad refund forms. Once deployed, rogue ScreenConnect clients executed a four-stage VBScript chain (1.vbs through 4.vbs) that performed system reconnaissance, downloaded encrypted payloads from Dropbox, and deployed various malicious tools including additional backdoors, privilege escalation utilities, and cryptocurrency miners. This incident highlights the ongoing evolution of remote access tool abuse as a primary attack vector, particularly relevant as organizations continue to rely heavily on remote support solutions post-pandemic. The worm-like propagation mechanism represents a concerning advancement in malware distribution techniques, automatically infecting new systems that connect to compromised ScreenConnect instances.
1 week ago
Kill Chain
PREY-0058: How Vishing Attacks Are Bypassing Microsoft 365 Security
Arctic Wolf identified PREY-0058, a widespread data theft and extortion campaign targeting Microsoft 365 and SaaS platforms through sophisticated vishing attacks. The threat actors impersonate IT help desk personnel, directing executives to fraudulent authentication pages that harvest credentials and MFA tokens via adversary-in-the-middle techniques. Using residential proxy infrastructure like NodeMaven, attackers perform session replay attacks to access SharePoint, OneDrive, Exchange, and Box for mass data exfiltration before issuing extortion demands. The campaign primarily targets directors and executives across construction, healthcare, finance, and professional services sectors. This incident highlights the growing sophistication of identity-based attacks that bypass traditional security controls. As organizations increasingly rely on cloud services and remote access, vishing campaigns exploiting human factors and legitimate authentication flows represent a critical threat vector requiring enhanced user education and phishing-resistant authentication measures.
1 week ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
