Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2149 to 2160 of 5957
Exploitation of FortiClient EMS Vulnerability Leads to Credential Theft
In May 2026, threat actors exploited a critical vulnerability (CVE-2026-35616) in Fortinet's FortiClient Endpoint Management Server (EMS) to deploy credential-stealing malware across managed endpoints. By abusing the trusted endpoint management infrastructure, attackers disguised the malicious payload as a legitimate Fortinet update, executing it via PowerShell. This allowed them to harvest sensitive data, including passwords and autofill details from web browsers, and exfiltrate the information to attacker-controlled servers. The exploitation of this vulnerability underscores the risks associated with unpatched management systems and the potential for widespread compromise through centralized infrastructure. Organizations are urged to apply the latest patches and review endpoint management configurations to mitigate such threats.
3 months ago
Kill Chain
Critical Gogs RCE Vulnerability Discovered in 2026
In May 2026, a critical remote code execution (RCE) vulnerability was identified in Gogs, an open-source self-hosted Git service. This flaw allows authenticated users to execute arbitrary code on the server by creating a pull request with a malicious branch name that injects the --exec flag into git rebase during the 'Rebase before merging' operation. The vulnerability, rated 9.4 on the CVSS scale, does not require administrative privileges or interaction with other users, making exploitation straightforward for any registered user. ([thehackernews.com](https://thehackernews.com/2026/05/critical-gogs-rce-vulnerability-lets.html?utm_source=openai)) The discovery of this vulnerability underscores the ongoing risks associated with self-hosted development tools. Organizations relying on Gogs should promptly implement recommended mitigations, such as restricting user registration and repository creation, to prevent potential exploitation. ([thehackernews.com](https://thehackernews.com/2026/05/critical-gogs-rce-vulnerability-lets.html?utm_source=openai))
3 months ago
Kill Chain
Silent Ransom Group's In-Person Data Theft Tactics Target Law Firms
In May 2026, the FBI issued a warning about the Silent Ransom Group (SRG), a Russia-linked extortion gang targeting U.S. law firms. SRG employs sophisticated social engineering tactics, including impersonating IT support staff via phone calls and phishing emails to gain remote access. When these methods fail, they escalate to in-person visits, where operatives physically infiltrate offices, connect external storage devices to computers, and exfiltrate sensitive client data. This data is then used to extort firms, with threats to publish or sell the information if ransoms are not paid. ([techtimes.com](https://www.techtimes.com/articles/317293/20260527/silent-ransom-group-sends-operatives-law-firm-offices-38-firms-already-leaked.htm?utm_source=openai)) This incident underscores a concerning evolution in cybercriminal tactics, blending traditional cyber attacks with physical intrusion. The legal sector's sensitive data makes it a prime target, highlighting the urgent need for robust security protocols, employee training, and vigilance against both digital and physical social engineering threats.
3 months ago
Kill Chain
BTMOB RAT: A New Android Malware-as-a-Service Threat
In May 2026, cybersecurity researchers identified BTMOB, an Android Remote Access Trojan (RAT), actively targeting users in Brazil and Latin America. Distributed through phishing campaigns that mimic legitimate services, BTMOB is sold as a malware-as-a-service (MaaS), allowing attackers to create malicious apps without coding expertise. Once installed, it exploits Android's Accessibility Services to gain elevated permissions, enabling data exfiltration, screen capture, and full remote control of infected devices. This comprehensive access poses significant risks, including financial theft and privacy breaches. The emergence of BTMOB underscores a growing trend in the commoditization of sophisticated malware, lowering the barrier for cybercriminals and expanding the threat landscape. Its MaaS model facilitates rapid adaptation and distribution, making it a formidable challenge for cybersecurity defenses worldwide.
3 months ago
Kill Chain
JINX-0164's Sophisticated Attack on Cryptocurrency Firms
In mid-2025, a previously unidentified threat actor, JINX-0164, initiated a campaign targeting cryptocurrency organizations. Utilizing sophisticated social engineering tactics, the attackers posed as recruiters on LinkedIn, inviting victims to virtual meetings on counterfeit domains resembling legitimate teleconference services. During these meetings, victims were deceived into downloading a malicious file disguised as a meeting client, leading to the installation of a Python-based macOS malware named AUDIOFIX. This malware harvested sensitive data, including credentials from password managers, web browsers, and cryptocurrency wallet extensions, and facilitated lateral movement within the organizations' development infrastructure. ([thehackernews.com](https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html?utm_source=openai)) The campaign's relevance persists due to the increasing sophistication of social engineering attacks targeting the cryptocurrency sector. The use of custom macOS malware and the focus on compromising development pipelines underscore the evolving tactics of financially motivated threat actors. Organizations must remain vigilant against such multifaceted attacks to safeguard their digital assets. ([thehackernews.com](https://thehackernews.com/2026/05/jinx-0164-targets-cryptocurrency-firms.html?utm_source=openai))
3 months ago
Kill Chain
Microsoft Addresses Risks of Uncoordinated Zero-Day Disclosures
In May 2026, security researcher Chaotic Eclipse publicly disclosed multiple zero-day vulnerabilities affecting Windows components such as Defender and BitLocker. These disclosures were made without prior notification to Microsoft, leading to active exploitation of vulnerabilities like BlueHammer (CVE-2026-33825), RedSun (CVE-2026-41091), and UnDefend (CVE-2026-45498). Microsoft criticized this uncoordinated approach, emphasizing the risks posed to customers and advocating for Coordinated Vulnerability Disclosure (CVD) to allow vendors time to address issues before public release. This incident underscores the ongoing tension between independent security researchers and software vendors regarding disclosure practices. The rapid exploitation of these vulnerabilities highlights the critical need for timely and coordinated communication to mitigate risks and protect end-users effectively.
3 months ago
Kill Chain
Akira Ransomware 2026 Attack: Lessons for Mid-Sized Organizations
In May 2026, a mid-sized organization fell victim to an Akira ransomware attack. The intrusion began with the exploitation of a forgotten local VPN account lacking multi-factor authentication, allowing attackers to gain initial access. Subsequently, they conducted network reconnaissance, escalated privileges, and moved laterally across systems. The attackers exfiltrated sensitive data before deploying ransomware to encrypt files, culminating in a ransom demand. This incident underscores the critical need for robust access controls and vigilant monitoring of network activities to prevent such breaches. The Akira ransomware group has demonstrated a rapid escalation in attack sophistication and frequency, particularly targeting organizations with vulnerable VPN configurations. Their ability to swiftly transition from initial access to full data encryption within hours highlights the urgency for organizations to implement comprehensive cybersecurity measures, including timely patching, multi-factor authentication, and continuous network monitoring.
3 months ago
Kill Chain
Anodot Data Breach 2026: A Case Study in Supply Chain Vulnerabilities
In April 2026, Anodot, a business monitoring software provider, experienced a significant data breach when attackers exploited authentication tokens to access customer cloud data. The cybercriminal group ShinyHunters claimed responsibility, leading to data theft from at least a dozen companies, including Rockstar Games. This incident underscores the vulnerabilities in third-party service providers and the cascading risks to their clients. The breach highlights a growing trend where threat actors target software vendors to gain access to multiple organizations simultaneously. Such supply chain attacks necessitate enhanced security measures and vigilance among businesses relying on external service providers.
3 months ago
Kill Chain
Zapier Vulnerabilities Exposed: Potential Account Takeover Risks
In May 2026, security researchers from Token Security identified a chain of five vulnerabilities within Zapier, a widely-used workflow automation service. Exploiting these flaws required only a free Zapier account and could have allowed attackers to impersonate any signed-in user, potentially accessing millions of user accounts and their connected applications. The attack vector involved manipulating user-generated code, retrieving discarded login credentials, and accessing internal storage systems containing private software images. One such image included a publishing key for code running in every logged-in user's browser, enabling attackers to create or alter automations and interact with connected services as legitimate users. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai)) This incident underscores the critical importance of securing automation platforms, especially as they gain increased authority to act on behalf of users across multiple services. The vulnerabilities were promptly reported and patched, with no evidence of exploitation. However, organizations are advised to review their automation logs for unauthorized activities and reauthorize connections to sensitive systems to mitigate potential risks. ([cyberscoop.com](https://cyberscoop.com/zapier-bug-chain-account-takeover-patched/?utm_source=openai))
3 months ago
Kill Chain
FBI Issues Warning on Silent Ransom Group's In-Person Data Theft Tactics
In May 2026, the FBI issued a warning about the Silent Ransom Group (SRG), a Russia-linked data extortion gang targeting U.S. law firms. SRG employs a combination of social engineering tactics, including phone calls and phishing emails, to impersonate IT support staff. If these remote attempts fail, the group escalates to in-person visits, where operatives physically access computers to steal sensitive data using external storage devices. This method has led to the compromise of over 100 law firms, with data from more than 38 firms publicly leaked. The group's focus on law firms is strategic, exploiting the highly sensitive nature of legal data to exert pressure for ransom payments. SRG's unique approach, combining remote social engineering with physical intrusion, underscores the evolving threat landscape and the need for robust security measures in the legal sector.
3 months ago
Kill Chain
CISA Mandates Urgent Patching of LiteSpeed cPanel Plugin Vulnerability CVE-2026-48172
In May 2026, a critical privilege escalation vulnerability, CVE-2026-48172, was discovered in the LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4. This flaw allows unauthenticated remote attackers to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function, which mishandles Redis enable/disable features. The vulnerability has been actively exploited in the wild, leading to full system compromises on affected servers. LiteSpeed released urgent security updates to address the issue, urging users to update to version 2.4.5 or later. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-48172/?utm_source=openai)) The exploitation of CVE-2026-48172 underscores the critical importance of timely patch management and the need for robust privilege assignment mechanisms in web hosting environments. The incident highlights the potential risks associated with shared hosting platforms, where a single compromised account can lead to server-wide breaches. Organizations are advised to prioritize the implementation of security patches and to conduct thorough audits of their systems to prevent similar vulnerabilities from being exploited.
3 months ago
Kill Chain
AFC Ajax Data Breach: Lessons in Cybersecurity
In early 2026, AFC Ajax, a prominent Dutch football club, experienced multiple unauthorized intrusions into its IT systems. A 35-year-old man from Buren exploited vulnerabilities to access personal data of several hundred individuals, modify stadium bans for fewer than 20 people, and transfer purchased tickets. The same security flaw allowed broad access to fan data via APIs and shared keys, enabling manipulation of 538 supporter stadium bans, 42,000 season tickets, and viewing details on more than 300,000 accounts. Ajax has since patched the exploited vulnerabilities and notified relevant authorities, including the Dutch Data Protection Authority and police. This incident underscores the critical importance of robust cybersecurity measures in protecting sensitive personal data. Organizations must proactively identify and remediate vulnerabilities to prevent unauthorized access and potential misuse of information. The arrest of the suspect highlights the necessity for continuous monitoring and swift response to security breaches to safeguard stakeholder trust and comply with data protection regulations.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
