Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2269 to 2280 of 5960
Mini Shai Hulud: @antv npm Supply Chain Attack Exposes CI/CD Credentials
In May 2026, a supply chain attack targeted the @antv npm package ecosystem. A threat actor compromised an @antv maintainer account, publishing malicious versions of popular data-visualization packages. This led to widespread impact, as the malicious code propagated through dependencies like echarts-for-react, affecting CI/CD pipelines and cloud workloads. The payload, a 499 KB obfuscated JavaScript file, executed silently during npm install, aiming to steal credentials from GitHub Actions environments. Key features included multi-platform credential theft, process memory scraping, privilege escalation, dual-channel data exfiltration, and SLSA provenance forgery, indicating a sophisticated focus on CI/CD environments. This incident underscores the escalating threat of supply chain attacks, particularly targeting CI/CD environments. The attack's sophistication, including SLSA provenance forgery, highlights the need for enhanced security measures in software development pipelines to prevent unauthorized access and data breaches.
3 months ago
Kill Chain
Trivy Supply Chain Compromise: A Wake-Up Call for Security Tool Integrity
In March 2026, Aqua Security's open-source vulnerability scanner, Trivy, was compromised in a sophisticated supply chain attack. Threat actors injected credential-stealing malware into Trivy's official releases, affecting the core scanner binary and associated GitHub Actions. This breach enabled attackers to harvest sensitive data from organizations relying on Trivy for security assessments. The campaign, attributed to the group TeamPCP, expanded to other security tools, including Checkmarx KICS and LiteLLM, indicating a targeted approach against security infrastructure. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/03/24/detecting-investigating-defending-against-trivy-supply-chain-compromise/?utm_source=openai)) This incident underscores the escalating trend of supply chain attacks targeting security tools, exploiting the trust placed in them by organizations. The compromise of widely used security applications highlights the need for enhanced vigilance and robust security measures within the software supply chain to prevent similar breaches.
3 months ago
Kill Chain
Showboat Linux Malware Targets Middle East Telecoms in 2026
In mid-2022, a telecommunications provider in the Middle East was targeted by a sophisticated cyber espionage campaign involving a new Linux malware named Showboat. This modular post-exploitation framework is capable of spawning remote shells, transferring files, and functioning as a SOCKS5 proxy. The malware's design allows attackers to establish a persistent foothold within compromised systems, facilitating unauthorized access to internal networks and sensitive data. The campaign has been attributed to China-linked threat actors, with command-and-control infrastructure traced back to Chengdu, Sichuan province. The attackers likely exploited vulnerabilities or default remote access accounts to deploy the malware, underscoring the critical need for robust security measures in telecommunications infrastructure. This incident highlights a concerning trend of state-sponsored cyber espionage targeting critical infrastructure sectors, particularly telecommunications. The use of advanced, stealthy malware like Showboat demonstrates the evolving capabilities of threat actors and the importance of proactive defense strategies. Organizations must prioritize the implementation of comprehensive security protocols, regular system audits, and employee training to mitigate the risks posed by such sophisticated attacks.
3 months ago
Kill Chain
GitHub's Internal Repositories Compromised in May 2026 Breach
In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. This incident led to unauthorized access and exfiltration of approximately 3,800 internal repositories. The attack was orchestrated by the hacker group TeamPCP, who exploited the poisoned extension to infiltrate GitHub's internal systems. GitHub promptly detected the breach, removed the malicious extension, isolated the affected endpoint, and initiated a comprehensive incident response, including rotating critical credentials. There is currently no evidence indicating that customer data stored outside of GitHub's internal repositories was impacted. ([github.blog](https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/?utm_source=openai)) This breach underscores the escalating threat of supply chain attacks targeting trusted development tools. The incident highlights the necessity for heightened vigilance and robust security measures within the software development community to prevent similar exploits in the future. ([thehackernews.com](https://thehackernews.com/2026/05/github-internal-repositories-breached.html?utm_source=openai))
4 months ago
Kill Chain
GitHub's 2026 Internal Repositories Breach: A Supply Chain Attack by TeamPCP
In May 2026, GitHub experienced a significant security breach when an employee's device was compromised through a malicious Visual Studio Code extension. This intrusion led to the exfiltration of approximately 3,800 internal repositories containing proprietary source code. The threat actor group known as TeamPCP claimed responsibility for the attack, offering the stolen data for sale on cybercrime forums with a starting price of $50,000. GitHub's investigation confirmed the breach but found no evidence that customer data stored outside its internal repositories was affected. This incident underscores the escalating threat of supply chain attacks targeting development environments. The use of compromised development tools to infiltrate organizations highlights the need for enhanced vigilance and security measures within software supply chains. Organizations must prioritize the integrity of their development tools and implement robust monitoring to detect and prevent such sophisticated attacks.
4 months ago
Kill Chain
YellowKey Zero-Day: Bypassing BitLocker Encryption with Physical Access
In May 2026, a security researcher known as 'Nightmare Eclipse' publicly disclosed a zero-day vulnerability named 'YellowKey' affecting Windows BitLocker encryption. This flaw allows attackers with physical access to a device to bypass BitLocker protections using a USB drive containing specially crafted 'FsTx' files. By rebooting into the Windows Recovery Environment (WinRE) and triggering a shell with unrestricted access, attackers can access encrypted data without requiring user credentials. Microsoft has acknowledged the vulnerability, assigned it CVE-2026-45585, and provided mitigation guidance to protect affected systems. The disclosure of YellowKey underscores the critical importance of physical security measures and the need for prompt application of security updates. Organizations should review their device access policies and implement the recommended mitigations to prevent potential exploitation of this vulnerability.
4 months ago
Kill Chain
Drupal Issues Critical Patch for SQL Injection Vulnerability (CVE-2026-9082)
On May 20, 2026, Drupal released a highly critical security update addressing a SQL injection vulnerability (CVE-2026-9082) in its core database abstraction API. This flaw specifically affects sites utilizing PostgreSQL databases, allowing unauthenticated attackers to execute arbitrary SQL commands, potentially leading to data breaches, privilege escalation, or remote code execution. The vulnerability impacts Drupal versions 8.9.0 through 11.3.9, with patches provided for supported and certain end-of-life versions. Administrators are urged to apply these updates promptly to mitigate the risk of exploitation. The urgency of this update underscores the persistent threat posed by SQL injection vulnerabilities, which remain a favored attack vector due to their potential for severe impact. Organizations must prioritize timely patch management and maintain vigilance against such critical flaws to safeguard their systems and data.
4 months ago
Kill Chain
GitHub's 2026 Breach: Lessons from the TeamPCP VS Code Extension Attack
In May 2026, GitHub confirmed a security breach involving the exfiltration of approximately 3,800 internal repositories. The incident originated when an employee installed a malicious Visual Studio Code (VS Code) extension, which compromised the device and allowed unauthorized access to GitHub's internal code repositories. The threat actor, identified as TeamPCP, claimed responsibility for the attack and attempted to sell the stolen data on cybercrime forums for at least $50,000. GitHub's investigation indicated that the breach was limited to internal repositories, with no evidence suggesting that customer data was affected. This incident underscores the growing threat of supply chain attacks targeting development environments. The use of malicious VS Code extensions as an attack vector highlights the need for heightened vigilance and robust security measures within software development processes. Organizations must reassess their security protocols to mitigate risks associated with third-party tools and extensions.
4 months ago
Kill Chain
PinTheft Vulnerability: Critical Root Escalation Flaw in Arch Linux
In May 2026, a critical privilege escalation vulnerability named 'PinTheft' was identified in the Linux kernel's Reliable Datagram Sockets (RDS) protocol. This flaw allows local attackers to gain root privileges on systems where the RDS module is loaded, notably affecting Arch Linux by default. The vulnerability arises from a double-free error in the RDS zerocopy send path, which can be exploited to overwrite the page cache through io_uring fixed buffers. A proof-of-concept exploit has been publicly released, demonstrating the ease of exploitation under specific conditions. The emergence of 'PinTheft' underscores a concerning trend of privilege escalation vulnerabilities in the Linux kernel, following recent disclosures like 'Copy Fail' (CVE-2026-31431) and 'Pack2TheRoot' (CVE-2026-41651). These incidents highlight the critical need for timely patching and vigilant system monitoring to mitigate the risk of unauthorized access and potential system compromise.
4 months ago
Kill Chain
Grafana Labs Breach: Lessons from the TanStack Supply-Chain Attack
In May 2026, Grafana Labs experienced a security breach stemming from the TanStack npm supply-chain attack orchestrated by the cybercrime group TeamPCP. The attackers published malicious versions of TanStack packages, which, when integrated into Grafana's CI/CD pipeline, executed credential-stealing malware. This led to the exfiltration of GitHub workflow tokens, granting unauthorized access to Grafana's private repositories. Although the company promptly rotated most tokens upon detecting the intrusion, one token was overlooked, enabling the attackers to access and download the company's source code and internal operational information. Importantly, no customer data or production systems were compromised during this incident. ([grafana.com](https://grafana.com/blog/grafana-labs-security-update-latest-on-tanstack-npm-supply-chain-ransomware-incident/?utm_source=openai)) This breach underscores the escalating threat posed by sophisticated supply-chain attacks targeting widely-used open-source packages. Organizations must enhance their vigilance and implement robust security measures within their development pipelines to mitigate such risks. The incident also highlights the critical importance of comprehensive credential management and the necessity for thorough audits to ensure all potential vulnerabilities are addressed promptly.
4 months ago
Kill Chain
Hackers Exploit SonicWall VPN MFA Bypass Vulnerability CVE-2024-12802
In early 2026, threat actors exploited a vulnerability in SonicWall Gen6 SSL-VPN appliances, identified as CVE-2024-12802, to bypass multi-factor authentication (MFA). By brute-forcing VPN credentials and leveraging incomplete patching, attackers gained unauthorized access to internal networks. Once inside, they conducted reconnaissance, tested credential reuse, and attempted to deploy tools like Cobalt Strike for command-and-control communication. The exploitation was facilitated by organizations failing to perform necessary manual reconfigurations after firmware updates, leaving systems susceptible to MFA bypass. This incident underscores the critical importance of comprehensive patch management and adherence to vendor-recommended remediation steps. The exploitation of CVE-2024-12802 highlights a broader trend of attackers targeting VPN vulnerabilities to infiltrate corporate networks, emphasizing the need for vigilant security practices and thorough system updates.
4 months ago
Kill Chain
Critical ExifTool Vulnerability on macOS: CVE-2026-3102 Analysis
In February 2026, a critical vulnerability identified as CVE-2026-3102 was discovered in ExifTool versions up to 13.49 on macOS. This flaw allows attackers to execute arbitrary commands by embedding malicious shell commands within the metadata of image files. When a vulnerable version of ExifTool processes such a file, the embedded commands are executed, potentially leading to unauthorized actions on the system. The vulnerability specifically affects the SetMacOSTags function in the MacOS.pm module, where improper handling of the DateTimeOriginal metadata field enables command injection. ([kaspersky.com](https://www.kaspersky.com/blog/exiftool-macos-picture-vulnerability-mitigation-cve-2026-3102/55362/?utm_source=openai)) The exploitation of this vulnerability underscores the risks associated with processing untrusted files, especially in automated workflows. Given ExifTool's widespread use in various applications, including digital asset management and forensic analysis, the potential for widespread impact is significant. Organizations are urged to update to ExifTool version 13.50 or later to mitigate this risk. ([kaspersky.com](https://www.kaspersky.com/blog/exiftool-macos-picture-vulnerability-mitigation-cve-2026-3102/55362/?utm_source=openai))
4 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
