Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2197 to 2208 of 5957
Microsoft Releases Critical Patch for SharePoint RCE Vulnerability CVE-2026-45659
In May 2026, Microsoft addressed a critical remote code execution vulnerability, CVE-2026-45659, in SharePoint Server versions 2016, 2019, and Subscription Edition. This flaw arises from the deserialization of untrusted data, allowing authenticated attackers with minimal permissions to execute arbitrary code remotely without user interaction. The vulnerability has a CVSS score of 8.8, indicating high severity. ([thehackernews.com](https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html?utm_source=openai)) The prompt release of patches underscores the importance of timely updates, especially given SharePoint's role in storing sensitive corporate data. Organizations are urged to apply these updates promptly to mitigate potential exploitation risks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/?utm_source=openai))
3 months ago
Kill Chain
Cybercriminals Exploit Claude AI Popularity to Distribute Malware
In early 2026, cybercriminals launched a sophisticated campaign targeting users seeking to download Anthropic's Claude AI tool. By creating fraudulent websites that closely mimicked the official Claude download pages, attackers distributed trojanized installers. These malicious installers appeared legitimate but secretly deployed malware, such as PlugX and ACR Stealer, granting attackers remote access to victims' systems and enabling the theft of sensitive information, including credentials and financial data. The campaign exploited users' trust in search engine results and official-looking websites, leading to widespread infections across both Windows and macOS platforms. This incident underscores a growing trend where threat actors leverage the popularity of AI tools to execute social engineering attacks. The use of fake installation guides and malicious advertisements highlights the need for heightened vigilance among users and organizations. As AI tools become more integrated into daily operations, ensuring the authenticity of download sources and implementing robust cybersecurity measures are imperative to prevent similar attacks.
3 months ago
Kill Chain
Anthropic's Claude Mythos: Revolutionizing Cybersecurity with AI
In April 2026, Anthropic introduced 'Claude Mythos,' an advanced AI model with exceptional capabilities in identifying and exploiting software vulnerabilities. The model demonstrated the ability to autonomously develop sophisticated cyberattacks, raising significant concerns about its potential misuse. To mitigate these risks, Anthropic restricted public access to Mythos, collaborating with select partners through Project Glasswing to enhance cybersecurity defenses. ([euronews.com](https://www.euronews.com/next/2026/04/08/why-anthropics-most-powerful-ai-model-mythos-preview-is-too-dangerous-for-public-release?utm_source=openai)) The emergence of AI models like Claude Mythos signifies a paradigm shift in cybersecurity, where AI can both uncover and exploit vulnerabilities at unprecedented speeds. This development underscores the urgent need for robust security measures and proactive strategies to address the dual-use nature of such technologies. ([cfr.org](https://www.cfr.org/articles/six-reasons-claude-mythos-is-an-inflection-point-for-ai-and-global-security?utm_source=openai))
3 months ago
Kill Chain
FBI Issues Warning on Kali365 Phishing Service Exploiting Microsoft 365 Accounts
In April 2026, the FBI identified 'Kali365,' a Phishing-as-a-Service (PhaaS) platform distributed via Telegram, enabling cybercriminals to hijack Microsoft 365 accounts. By exploiting Microsoft's OAuth 2.0 Device Authorization grant flow, attackers trick users into entering device codes on legitimate Microsoft pages, granting unauthorized access to services like Outlook, Teams, and OneDrive. This method bypasses multi-factor authentication (MFA) and does not require stealing user credentials. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/?utm_source=openai)) The emergence of Kali365 underscores a significant shift in cyber threats, where sophisticated phishing tools are now accessible to less-skilled attackers. This trend highlights the urgent need for organizations to reassess and strengthen their authentication protocols and user education to mitigate evolving phishing tactics. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai))
3 months ago
Kill Chain
Dutch Authorities Dismantle Cyberattack Infrastructure Linked to Russian Operations
In May 2026, Dutch authorities arrested two individuals, aged 57 and 39, for allegedly providing IT infrastructure used by Russian entities to conduct cyberattacks and disinformation campaigns within the European Union. The arrests followed investigations into Stark Industries Solutions, a hosting provider sanctioned by the EU in 2025 for facilitating Russian cyber operations. The suspects, associated with MIRhosting and WorkTitans BV, were charged with violating sanctions laws by making economic resources available to sanctioned entities. During the operation, over 800 servers were seized from data centers in Dronten and Schiphol-Rijk. ([krebsonsecurity.com](https://krebsonsecurity.com/2026/05/netherlands-seizes-800-servers-arrests-2-for-aiding-cyberattacks/?utm_source=openai)) This incident underscores the persistent challenges in enforcing sanctions against entities that support state-sponsored cyber activities. Despite previous sanctions, the rebranding and asset transfers by Stark Industries highlight the adaptability of such organizations in evading regulatory measures. The case emphasizes the need for continuous monitoring and robust enforcement mechanisms to prevent the circumvention of international sanctions.
3 months ago
Kill Chain
TrapDoor Supply Chain Attack Compromises npm, PyPI, and Crates.io Ecosystems
In May 2026, a coordinated supply chain attack named 'TrapDoor' targeted the npm, PyPI, and Crates.io ecosystems, distributing credential-stealing malware through over 34 malicious packages across more than 384 versions. The campaign began on May 22, 2026, with attackers publishing these packages in rapid succession. The malware specifically aimed at developers in the cryptocurrency, DeFi, Solana, and AI sectors, seeking to exfiltrate sensitive information such as crypto wallets, SSH keys, cloud credentials, browser data, and environment variables. The attack employed various methods, including postinstall hooks, remote JavaScript payloads executed during package imports, and malicious build.rs scripts, to infiltrate developer environments and establish persistence. ([thehackernews.com](https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within open-source ecosystems, highlighting the need for enhanced vigilance and security measures among developers and organizations. The sophisticated techniques used in the TrapDoor campaign reflect a broader trend of attackers exploiting trusted software repositories to distribute malware, emphasizing the importance of robust supply chain security practices.
3 months ago
Kill Chain
Lazarus Group's RemotePE: A New Memory-Only Threat to Financial Institutions
In May 2026, cybersecurity researchers uncovered a sophisticated attack campaign by the North Korean state-sponsored Lazarus Group targeting financial and cryptocurrency organizations. The group deployed a cross-platform, memory-only Remote Access Trojan (RAT) named RemotePE, which operates entirely in memory, leaving no artifacts on the filesystem. The attack chain involves two loaders: DPAPILoader, which decrypts and loads RemotePELoader using the Windows Data Protection API, and RemotePELoader, which contacts a command-and-control server to fetch and execute RemotePE in memory. This multi-stage approach allows the malware to evade traditional detection mechanisms and maintain persistent access to compromised systems. ([thehackernews.com](https://thehackernews.com/2026/05/lazarus-deploys-remotepe-memory-only.html?utm_source=openai)) The discovery of RemotePE highlights the Lazarus Group's continued evolution in cyber-attack methodologies, emphasizing the need for organizations to adopt advanced threat detection and response strategies. The use of memory-only malware underscores the importance of monitoring in-memory activities and implementing robust endpoint detection and response (EDR) solutions to detect and mitigate such sophisticated threats.
3 months ago
Kill Chain
Ghost CMS Vulnerability Leads to Massive ClickFix Attack Campaign
In May 2026, threat actors exploited a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS, affecting versions 3.24.0 through 6.19.0. This flaw allowed unauthenticated attackers to read arbitrary data from the database, including admin API keys. Utilizing these keys, attackers injected malicious JavaScript into over 700 websites, including those of Harvard University, Oxford University, and DuckDuckGo. The injected scripts facilitated ClickFix attacks, deceiving visitors into executing harmful commands via fake CAPTCHA verification prompts. ([thehackernews.com](https://thehackernews.com/2026/05/ghost-cms-cve-2026-26980-exploited-to.html?utm_source=openai)) This incident underscores the urgency of timely patch management, as the vulnerability had been addressed in version 6.19.1 released in February 2026. The widespread exploitation highlights the evolving sophistication of social engineering tactics and the critical need for organizations to maintain up-to-date security measures to protect their digital assets. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-26980/?utm_source=openai))
3 months ago
Kill Chain
TeamPCP's Supply Chain Attack: A Wake-Up Call for Software Security
In May 2026, the cybercriminal group TeamPCP executed a sophisticated supply chain attack targeting multiple software ecosystems. The campaign involved compromising the Nx Console VS Code extension, leading to the exfiltration of approximately 3,800 internal GitHub repositories. Additionally, TeamPCP trojanized Microsoft's durabletask Python SDK on PyPI and injected malicious code into 639 versions of 323 npm packages within the @antv ecosystem. These attacks resulted in significant credential theft and potential data loss across affected organizations. This incident underscores the escalating threat posed by supply chain attacks, particularly those targeting widely used development tools and libraries. The rapid succession and scale of these compromises highlight the need for enhanced vigilance and security measures within software development and deployment pipelines.
3 months ago
Kill Chain
Ghost CMS Vulnerability Exploited in Widespread ClickFix Campaign
In May 2026, a critical SQL injection vulnerability (CVE-2026-26980) in Ghost CMS versions 3.24.0 through 6.19.0 was exploited in a large-scale campaign known as ClickFix. Threat actors leveraged this flaw to gain unauthorized access to over 700 domains, including prominent institutions like Harvard University, Oxford University, and DuckDuckGo. By extracting admin API keys, attackers injected malicious JavaScript into website articles, leading to further exploitation and potential data exfiltration. This incident underscores the persistent threat posed by unpatched vulnerabilities in widely used content management systems. The exploitation of CVE-2026-26980 highlights the importance of timely software updates and robust security practices to prevent unauthorized access and maintain the integrity of web platforms.
3 months ago
Kill Chain
ShinyHunters Ransomware Attack on Charter Communications - May 2026
In May 2026, the cybercriminal group ShinyHunters executed a ransomware attack against Charter Communications, Inc., a major U.S. telecommunications and cable company known for its Spectrum services. The attack involved unauthorized access to Charter's systems, leading to the encryption of critical data and disruption of services. ShinyHunters demanded a ransom for the decryption keys, threatening to leak sensitive customer and corporate information if their demands were not met. The breach was publicly disclosed on May 23, 2026, highlighting significant vulnerabilities in Charter's cybersecurity defenses. This incident underscores the escalating threat posed by sophisticated ransomware groups like ShinyHunters, who have been increasingly targeting large corporations across various sectors. The attack on Charter Communications serves as a stark reminder of the importance of robust cybersecurity measures and the need for organizations to proactively defend against evolving cyber threats.
3 months ago
Kill Chain
Laravel Lang Supply Chain Attack: A Wake-Up Call for Open-Source Security
In May 2026, attackers compromised the Laravel Lang GitHub organization by rewriting existing git tags across multiple repositories, including laravel-lang/lang, laravel-lang/http-statuses, laravel-lang/attributes, and laravel-lang/actions. This manipulation redirected developers to malicious commits in attacker-controlled forks, leading to the installation of credential-stealing malware via Composer. The malware targeted sensitive information such as cloud credentials, SSH keys, and browser data, posing significant risks to developers and organizations relying on these packages. This incident underscores the evolving nature of supply chain attacks, highlighting the need for enhanced security measures in software development pipelines. The exploitation of GitHub's tagging system to distribute malware emphasizes the importance of verifying package integrity and monitoring for unusual repository activities to prevent similar breaches.
3 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
