Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2125 to 2136 of 5957
Critical XSS Vulnerability in CP Plus NVRs: CVE-2026-6824
In May 2026, a critical stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-6824, was discovered in CP Plus 8 Channel Network Video Recorders (NVRs). This flaw allows attackers to inject malicious scripts into the device's web interface, which execute in the browsers of authenticated users or administrators upon access. Exploitation can lead to session hijacking, unauthorized actions, data exposure, and compromise of system integrity. The affected versions include CP-UNR-108F1 Hardware V1.0, Web V3.2.7.128806, and System V4.001.00AT009.0.R. ([socdefenders.ai](https://www.socdefenders.ai/item/a70ca9af-a0bb-4b2f-9cf8-a89beb76b2b9?utm_source=openai)) This incident underscores the persistent threat posed by web-based vulnerabilities in critical infrastructure devices. As attackers increasingly target such systems, organizations must prioritize regular security assessments, timely patching, and adherence to best practices to mitigate risks associated with similar vulnerabilities.
3 months ago
Kill Chain
Critical BLE Vulnerability Discovered in Fourth Frontier's Frontier X2 Devices
In May 2026, a critical vulnerability (CVE-2026-5768) was identified in Fourth Frontier's Frontier X2 wearable device and its associated mobile applications. This flaw allows unauthenticated Bluetooth Low Energy (BLE) access, enabling attackers within proximity to manipulate device functions and inject fabricated health telemetry data. Affected versions include the Frontier X Android application prior to version 15.0.0, the iOS application before version 25.0.0, and all versions of the Frontier X2 device firmware. The vulnerability has been assigned a CVSS score of 8.8, indicating high severity. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-frontier-x2-ble-auth-flaw-can-spoof-ecg-and-health-readings.420539/?utm_source=openai)) The exploitation of this vulnerability could lead to unauthorized control over device functions, such as starting or stopping activities and triggering vibrations, potentially resulting in patient harm. Additionally, attackers can impersonate legitimate devices, injecting false health data like heart rate and breathing rate into the mobile application, compromising the integrity of health monitoring. ([windowsforum.com](https://windowsforum.com/threads/cisa-warns-frontier-x2-ble-auth-flaw-can-spoof-ecg-and-health-readings.420539/?utm_source=openai))
3 months ago
Kill Chain
Kimsuky's Advanced Cyber Attacks: A New Era of AI-Driven Threats
In March and April 2026, the North Korean state-sponsored threat actor Kimsuky launched sophisticated cyber attacks targeting South Korean military and corporate entities. Utilizing advanced social engineering tactics, they spoofed security software installation pages and crafted fake Webex meeting pages to distribute malware. These campaigns delivered variants of the HTTPSpy remote access trojan, enabling extensive control over compromised systems, including command execution, file manipulation, and data exfiltration. Notably, Kimsuky employed legitimate tools like Visual Studio Code's remote tunneling feature and DWAgent for post-exploitation activities, enhancing their ability to evade detection. The increasing integration of artificial intelligence in cyber attack methodologies, as demonstrated by Kimsuky's use of large language models to develop malware like HelloDoor, signifies a significant evolution in threat actor capabilities. This trend underscores the urgent need for organizations to adopt advanced, behavior-based detection systems and regularly update threat intelligence to effectively counter these sophisticated and rapidly evolving cyber threats.
3 months ago
Kill Chain
Critical Vulnerability in ABB's Busch-Welcome 2 Wire Door Opener Actuator (CVE-2025-7705)
In July 2025, ABB disclosed a vulnerability (CVE-2025-7705) in its Busch-Welcome 2 Wire Door Opener Actuator, specifically affecting all versions of the Switch Actuator 4 DU (model 83330) and Switch Actuator, door/light 4 DU (model 83330-500). The issue arises from the devices operating in compatibility mode by default, which could allow an attacker with physical access to bypass authentication mechanisms and gain unauthorized entry to buildings where these devices are installed. The vulnerability has been assigned a CVSS v3.1 base score of 6.8, indicating medium severity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/cve-2025-7705?utm_source=openai)) This incident underscores the critical importance of securing physical access control systems, especially in commercial facilities. As IoT devices become increasingly integrated into building management, ensuring their security configurations are properly set and regularly updated is paramount to prevent unauthorized access and potential security breaches.
3 months ago
Kill Chain
Critical Security Flaw in Jinan USR IOT's USR-W610 Converter Exposes Networks to Attack
In May 2026, a critical vulnerability (CVE-2026-7786) was identified in Jinan USR IOT Technology Limited's USR-W610 RS232/485 to Wi-Fi/Ethernet Converter, firmware version 7.03T.07. The device contains hard-coded plaintext administrative credentials embedded within the firmware, which can be extracted and used by attackers to gain full administrator access. This flaw poses significant risks, including unauthorized control over the device and potential network intrusion. The vendor has not responded to coordination attempts, leaving users without an official patch or remediation guidance. This incident underscores the persistent issue of hard-coded credentials in IoT devices, a vulnerability that has been exploited in various sectors, leading to unauthorized access and control. The lack of vendor response highlights the challenges in securing IoT devices, emphasizing the need for proactive security measures and regular vulnerability assessments to mitigate such risks.
3 months ago
Kill Chain
The Hidden Dangers of AI-Generated Applications: A 2026 Security Analysis
In May 2026, cybersecurity firm RedAccess identified over 380,000 publicly accessible web assets created using AI-driven development platforms, commonly referred to as 'vibe coding' tools. Among these, approximately 5,000 assets appeared to be corporate-related, with more than 2,000 containing sensitive corporate, operational, or personal data. These applications were often deployed without basic access controls, granting administrative access to anyone who accessed the URL. This widespread exposure underscores the significant security risks associated with the rapid adoption of AI-generated code without proper oversight. The incident highlights the urgent need for organizations to implement robust security measures and governance frameworks to manage the risks posed by unauthorized AI-generated applications. As AI-driven development becomes more prevalent, ensuring the security and integrity of these applications is paramount to prevent data breaches and maintain compliance with regulatory standards.
3 months ago
Kill Chain
Malicious Sicoob NuGet Package Compromises Banking Credentials
In May 2026, cybersecurity researchers discovered a malicious NuGet package named 'Sicoob.Sdk' that impersonated a C# software development kit for Sicoob, one of Brazil's largest cooperative financial systems. Versions 2.0.0 through 2.0.4 of this package were found to exfiltrate sensitive information, including client IDs and PFX certificates, which are crucial for secure communications. This incident underscores the growing trend of supply chain attacks targeting software development ecosystems to steal sensitive data. The discovery of 'Sicoob.Sdk' aligns with a series of recent supply chain attacks where malicious packages infiltrate trusted repositories. For instance, the 'TrapDoor' campaign targeted npm, PyPI, and Crates.io ecosystems to distribute credential-stealing malware. These incidents highlight the urgent need for enhanced vigilance and security measures within software supply chains to protect against such threats.
3 months ago
Kill Chain
Schneider Electric's EcoStruxure Machine Expert HVAC Vulnerability: CVE-2026-6332
In May 2026, Schneider Electric disclosed a vulnerability (CVE-2026-6332) in its EcoStruxure Machine Expert HVAC software versions prior to 1.10.0. This flaw involves the cleartext storage of sensitive information, potentially exposing protected source code when accessed by authorized users for editing or compiling. Such exposure could lead to a loss of confidentiality and unauthorized disclosure of proprietary logic and operational details. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-6332?utm_source=openai)) This incident underscores the critical importance of securing engineering workstations and programming environments in industrial settings. As industrial control systems become increasingly interconnected, ensuring the confidentiality and integrity of source code is paramount to prevent potential reconnaissance and exploitation by malicious actors.
3 months ago
Kill Chain
Critical Vulnerability in ABB EIBPORT Devices Disclosed
In May 2026, ABB disclosed a critical vulnerability in its EIBPORT V3 KNX and KNX GSM devices, versions prior to 3.9.2. The flaw, identified as CVE-2021-22291, is a cross-site scripting (XSS) vulnerability that could allow attackers to access sensitive information and alter device configurations. ABB has released firmware updates to address this issue and recommends immediate application to mitigate potential risks. This incident underscores the persistent threat of web-based vulnerabilities in industrial control systems, emphasizing the need for continuous monitoring and timely patch management to protect critical infrastructure from evolving cyber threats.
3 months ago
Kill Chain
AI Agents Exploit Marimo Vulnerability CVE-2026-39987
In May 2026, an unidentified threat actor exploited a critical vulnerability (CVE-2026-39987) in Marimo, an open-source Python notebook platform, to gain unauthorized access to a publicly accessible Marimo instance. Utilizing a large language model (LLM) agent, the attacker extracted cloud credentials, retrieved an SSH private key from AWS Secrets Manager, and conducted multiple SSH sessions to exfiltrate the schema and full contents of an internal PostgreSQL database within a short timeframe. This incident underscores the rapid weaponization of AI-driven tools in cyberattacks, enabling sophisticated post-exploitation activities with minimal prior knowledge of the target environment. Organizations must prioritize patching known vulnerabilities and enhance monitoring to detect and mitigate such advanced threats promptly.
3 months ago
Kill Chain
GREYVIBE's AI-Powered Cyberattacks on Ukraine: A 2025 Case Study
In August 2025, a previously undocumented threat actor named GREYVIBE initiated a series of cyberattacks targeting Ukrainian military, government, civilian, and business entities. Operating from the Russian time zone and aligning with Kremlin state interests, GREYVIBE employed multiple attack vectors, including spear-phishing emails, fake CAPTCHA pages, and fraudulent websites, to deliver custom-developed malware such as PhantomRelay and LegionRelay. Notably, the group leveraged generative artificial intelligence (GenAI) and large language models (LLMs) to enhance their operations, facilitating rapid development of obfuscators, loaders, and malware. ([thehackernews.com](https://thehackernews.com/2026/05/new-russian-linked-greyvibe-targets.html?utm_source=openai)) The integration of AI technologies in cyberattacks signifies a concerning evolution in threat actor capabilities, enabling even low-to-moderately sophisticated groups to execute complex operations. This trend underscores the urgent need for organizations to adopt advanced cybersecurity measures to detect and mitigate AI-assisted threats. ([t.co](https://t.co/WAHU7GJnZC?utm_source=openai))
3 months ago
Kill Chain
Typosquatted npm Packages Lead to Cloud and CI/CD Credential Theft
In May 2026, a threat actor using the alias 'vpmdhaj' published 14 malicious npm packages that mimicked popular OpenSearch and ElasticSearch libraries. These packages, once installed, executed scripts to harvest sensitive credentials, including AWS keys, HashiCorp Vault tokens, and CI/CD pipeline secrets, from the host environment. The attack leveraged typosquatting and spoofed metadata to appear legitimate, facilitating unauthorized access and potential lateral movement within cloud infrastructures. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. Organizations must remain vigilant, as such attacks can lead to significant data breaches and operational disruptions. Implementing stringent package validation processes and monitoring for anomalous activities are crucial to mitigating these risks.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
