Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2113 to 2124 of 5957
The Rise of DDoS-as-a-Service: Implications for Cybersecurity
In May 2026, cybersecurity researchers highlighted the rapid evolution of the DDoS-as-a-Service market, where Distributed Denial-of-Service (DDoS) attacks are commoditized and sold as services. This transformation has led to a significant increase in the scale and sophistication of DDoS attacks, exemplified by Cloudflare's mitigation of a record-breaking 31.4 Tbps attack in late 2025. The Aisuru-Kimwolf botnet, comprising millions of compromised devices, was identified as a primary source of these hyper-volumetric attacks, targeting various industries and critical infrastructure. ([blog.cloudflare.com](https://blog.cloudflare.com/ddos-threat-report-2025-q4?utm_source=openai)) The commodification of DDoS services has lowered the barrier to entry for cybercriminals, enabling even those with limited technical expertise to launch large-scale attacks. This trend underscores the urgent need for organizations to enhance their cybersecurity defenses and adopt proactive measures to mitigate the growing threat posed by DDoS-as-a-Service platforms.
3 months ago
Kill Chain
Exploitation of ChatGPT Share Links for Malware Distribution
In May 2026, threat actors exploited ChatGPT's content-sharing feature to distribute malware. They created fake outage messages on legitimate ChatGPT URLs, prompting users to download a malicious desktop application. This campaign, known as 'LLMShare,' utilized Google ads to direct users to these deceptive pages, leveraging the trust associated with OpenAI's domain. Upon clicking the download link, users were redirected to a counterfeit OpenAI download portal, delivering malware for both Windows and macOS systems. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chatgpt-share-links-abused-to-host-fake-outage-pages-to-deliver-malware/?utm_source=openai)) This incident underscores a growing trend where attackers abuse trusted AI platforms to disseminate malware. The use of legitimate domains and sophisticated social engineering tactics highlights the need for heightened vigilance and user education to prevent such deceptive attacks.
3 months ago
Kill Chain
ChatGPhish: Unveiling the New Phishing Threat in AI Systems
In May 2026, cybersecurity researchers at Permiso Security identified a vulnerability in OpenAI's ChatGPT, termed 'ChatGPhish'. This flaw exploits ChatGPT's handling of Markdown links and images within web summaries, allowing attackers to inject malicious content. By embedding harmful payloads in web pages that users prompt ChatGPT to summarize, adversaries can cause the AI to render phishing links, deceptive system alerts, and QR codes directly within its trusted interface. This method can lead to unauthorized data exposure, including users' IP addresses and browser details, and potentially trick users into engaging with malicious content. The ChatGPhish vulnerability underscores the evolving threat landscape where AI tools become vectors for sophisticated phishing attacks. As organizations increasingly rely on AI for information processing, this incident highlights the critical need for robust security measures in AI systems to prevent exploitation through indirect prompt injections and ensure user trust.
3 months ago
Kill Chain
California Attorney General Sues 23andMe Over 2023 Data Breach
In October 2023, genetic testing company 23andMe experienced a significant data breach affecting approximately 6.9 million users, including 855,541 Californians. Attackers exploited reused passwords through a credential-stuffing attack, initially compromising around 14,000 accounts. Due to the interconnected nature of 23andMe's 'DNA Relatives' feature, the breach expanded, exposing sensitive genetic and personal information such as ancestry reports, health predispositions, and DNA matches. The company faced multiple lawsuits and regulatory fines, ultimately filing for bankruptcy in March 2025. In May 2026, California Attorney General Rob Bonta filed a lawsuit against 23andMe, now known as Chrome Holding Co., alleging failure to implement reasonable safeguards against credential-stuffing attacks and misleading public statements regarding the breach. This incident underscores the critical importance of robust cybersecurity measures, especially in handling sensitive genetic data. The rise in credential-stuffing attacks highlights the need for organizations to enforce strong password policies and multi-factor authentication to protect user information.
3 months ago
Kill Chain
Silent Ransom Group's In-Person Data Extortion Tactics Target U.S. Law Firms
In May 2026, the Silent Ransom Group (SRG), also known as Luna Moth or Chatty Spider, escalated their cyber extortion tactics by physically infiltrating U.S. law firms. Posing as IT support personnel, SRG operatives gained unauthorized access to sensitive data by inserting malicious devices into firm computers. This method allowed them to exfiltrate confidential information without deploying traditional ransomware, subsequently threatening to publish the stolen data unless ransoms were paid. The FBI has confirmed that SRG has already leaked data from over 38 law firms on their public site, with total attacks exceeding 100 since early 2026. ([techtimes.com](https://www.techtimes.com/articles/317293/20260527/silent-ransom-group-sends-operatives-law-firm-offices-38-firms-already-leaked.htm?utm_source=openai)) This incident underscores a significant shift in cybercriminal strategies, combining social engineering with physical intrusion to bypass digital defenses. The legal sector, handling highly sensitive client information, is particularly vulnerable to such attacks. Organizations must enhance both digital and physical security measures to mitigate these evolving threats.
3 months ago
Kill Chain
Dutch Authorities' Raid on Russian Bulletproof Host Fails to Disrupt Cyber Activities
In May 2026, Dutch authorities seized over 800 servers and arrested two individuals associated with THE.Hosting, a bulletproof hosting service linked to Russian cybercriminal activities. Despite these efforts, the network's malicious operations, including broad scanning and botnet-building, continued largely unaffected due to the resilience of its infrastructure and the retention of its core IP address space. ([darkreading.com](https://www.darkreading.com/cyber-risk/dutch-raid-russian-bulletproof-host?utm_source=openai)) This incident underscores the challenges law enforcement faces in disrupting sophisticated cybercriminal networks that can rapidly adapt and reconstitute their operations, highlighting the need for coordinated international efforts and more comprehensive strategies to effectively combat such threats.
3 months ago
Kill Chain
The Com's 2026 Cyberattacks: A Wake-Up Call for Cloud Security
In May 2026, the cybercriminal collective known as 'The Com' orchestrated a series of sophisticated cyberattacks targeting cloud environments and SaaS platforms of major organizations. These breaches resulted in significant data exfiltration and operational disruptions. The Com, comprising subgroups like Scattered Lapsus$ Hunters, utilized advanced social engineering tactics, including vishing campaigns, to infiltrate IT helpdesks and gain unauthorized access to sensitive systems. The financial gains from these cybercrimes were reportedly funneled into supporting violent activities and the exploitation of minors, highlighting the broader societal impact of such security breaches. This incident underscores the evolving threat landscape where cybercriminal groups are increasingly targeting cloud infrastructures and leveraging social engineering to bypass traditional security measures. Organizations must enhance their security protocols, particularly around identity verification and access controls, to mitigate the risks posed by such sophisticated threat actors.
3 months ago
Kill Chain
Zapier Exploit Chain Reveals Critical Cloud Security Vulnerabilities
In May 2026, researchers from Token Security identified a critical vulnerability in Zapier's platform, demonstrating how a series of misconfigurations and over-permissioned roles could lead to a full platform takeover. The exploit chain began with the ability to execute code within Zapier's 'Code by Zapier' feature, allowing attackers to perform sandbox reconnaissance and extract credentials from memory. This access enabled lateral movement to Zapier's private repositories, where a high-privilege NPM token was discovered, potentially allowing the publication of malicious code to all authenticated users. Zapier promptly addressed the issue by revoking the leaked token and tightening IAM roles, with full remediation confirmed by March 2026. This incident underscores the critical importance of securing cloud integrations and managing permissions effectively. As cloud services become increasingly complex, even minor misconfigurations can be exploited to orchestrate significant breaches, highlighting the need for continuous security assessments and robust access controls.
3 months ago
Kill Chain
MacGregor VDR G4e Vulnerabilities Highlight Maritime Cybersecurity Challenges
In May 2026, multiple critical vulnerabilities were identified in the MacGregor Voyage Data Recorder (VDR) G4e, a maritime device essential for recording navigational and operational data. These vulnerabilities, including the use of default and hard-coded credentials, insufficiently protected passwords, and improper access controls, could allow unauthorized attackers to gain administrator access to the device. Such exploitation poses significant risks, including unauthorized data access, manipulation, or deletion, potentially compromising maritime safety and incident investigations. This incident underscores the pressing need for enhanced cybersecurity measures in maritime systems. As vessels increasingly integrate networked technologies, the attack surface expands, making it imperative to address security flaws promptly. The vulnerabilities in the VDR G4e highlight the broader challenge of securing critical infrastructure against evolving cyber threats.
3 months ago
Kill Chain
Critical Vulnerability in KMW CCTV Security Cameras (CVE-2026-5386)
In May 2026, a critical vulnerability (CVE-2026-5386) was identified in KMW CCTV Security Cameras, specifically models KM-IP521 and KM-IP421. This flaw allows unauthenticated attackers to remotely reset the administrator password to a known value, granting full access to camera feeds and settings. The vulnerability poses significant risks to critical infrastructure sectors, including commercial facilities, government services, and financial services. KMW has released firmware updates to address this issue and recommends users apply these updates promptly. ([windowsforum.com](https://windowsforum.com/threads/cisa-icsa-26-148-06-kmw-cctv-critical-password-reset-flaw.420548/?utm_source=openai)) This incident underscores the growing security challenges associated with IoT devices in critical infrastructure. The ease of exploitation and potential impact highlight the necessity for robust security measures, including regular firmware updates and network segmentation, to protect against unauthorized access and potential breaches.
3 months ago
Kill Chain
Major Supply Chain Attacks Target Nx Console and GitHub Repositories in 2026
In May 2026, two significant supply chain attacks targeted the developer ecosystem. The first involved a compromised version of the Nx Console Visual Studio Code extension (v18.95.0), which was live for approximately 18 minutes on May 18, 2026. This malicious extension exfiltrated credentials from developer machines, leading to unauthorized access and exfiltration of approximately 3,800 internal GitHub repositories. The second attack, dubbed 'Megalodon,' occurred on the same day and compromised over 5,500 GitHub repositories by injecting malicious GitHub Actions workflows designed to harvest CI/CD secrets and cloud credentials. These incidents underscore the escalating threat landscape targeting software development pipelines and the critical need for robust security measures in CI/CD environments. The rapid execution and widespread impact of these attacks highlight the urgency for organizations to implement stringent supply chain security practices and continuous monitoring to detect and mitigate such threats promptly.
3 months ago
Kill Chain
Critical Security Flaws Discovered in XCharge C6 EV Chargers
In May 2026, multiple critical vulnerabilities were identified in XCharge's C6 electric vehicle charging controllers, including CVE-2026-9037, CVE-2026-9038, and CVE-2026-9039. These flaws could allow attackers to gain administrative rights or execute unauthorized code on affected devices. The vulnerabilities encompass issues such as unverified firmware updates, stack-based buffer overflows, and insecure default configurations. Exploitation of these vulnerabilities could lead to significant control over critical infrastructure in transportation systems worldwide. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-xcharge-c6-ev-chargers-have-3-critical-flaws-cvss-9-8.420545/?utm_source=openai)) The increasing integration of IoT devices in critical infrastructure highlights the urgency of addressing such vulnerabilities. Ensuring robust security measures and timely updates is essential to prevent potential disruptions and maintain the integrity of essential services.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
