Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 241 to 252 of 5923
ASCII Smuggling Crosses Over: How AI Attack Techniques Are Transforming Phishing
In February 2026, Microsoft researchers identified a large-scale phishing campaign that repurposed ASCII smuggling techniques originally developed for AI prompt injection attacks. The attackers used invisible Unicode tag characters (U+E0000-U+E007F) to split financial lure words like 'funding' within phishing emails, evading traditional email security filters that rely on keyword detection. The campaign peaked at over 2.3 million messages daily and operated through legitimate email marketing infrastructure, demonstrating how AI-era attack techniques are crossing over into traditional threat vectors. This incident highlights the evolving sophistication of phishing attacks as threat actors adapt cutting-edge evasion techniques originally designed for AI systems to bypass conventional email security defenses. The crossover represents a significant shift in the threat landscape where AI security research methods are being weaponized for traditional cybercrime.
1 week ago
Kill Chain
AI Coding Agents Become Attack Vectors: The 2026 Supply Chain Breach
In 2026, security researchers discovered a critical supply chain vulnerability affecting AI coding agents used by Fortune 500 companies and defense contractors. By scanning over 6,000 corporate domains, researchers found 120 llms.txt files pointing to unregistered code packages. When they registered these domains and hosted malicious packages, AI agents including Claude, OpenAI's Codex, and Nous Research's Hermes automatically downloaded and executed the code within hours, creating backdoors into corporate networks. The attack demonstrated how AI agents blindly trust vendor documentation without verification, treating it as ground truth and bypassing human oversight. This represents a new class of supply chain attack vector where autonomous AI systems become unwitting accomplices in corporate network compromise, similar to the SolarWinds incident but leveraging AI agent automation for broader impact.
1 week ago
Kill Chain
AI-Powered Exploitation of Georgia Voting System Reveals Election Security Gaps
A previously disclosed vulnerability in voting systems used across 21 U.S. states, including Georgia, was exploited using AI tools during the May 2026 primary election to recover the chronological order of ballots cast. The attack required only publicly available data sources - early voting lists and cast-vote record (CVR) files - combined with AI coding agents to analyze voter behavior patterns. No direct access to voting machines, networks, or source code was necessary, demonstrating how AI amplifies the exploitation of known vulnerabilities in critical infrastructure. This incident highlights the growing intersection of AI capabilities with election security vulnerabilities, as threat actors increasingly leverage automated tools to exploit weaknesses in democratic processes and critical infrastructure systems.
1 week ago
Kill Chain
SonicWall SMA 1000 Zero-Days: How Edge Device Vulnerabilities Expose Enterprise Networks
SonicWall disclosed two actively exploited zero-day vulnerabilities (CVE-2026-83548 and CVE-2026-83549) in SMA 1000 appliances in January 2025, with CISA adding them to its Known Exploited Vulnerabilities catalog. Rapid7 researchers confirmed the flaws can be chained together to achieve unauthenticated remote code execution, with the first being a maximum severity pre-authentication server-side request forgery vulnerability and the second a high-severity OS command injection flaw. The attacks represent the latest in a series of compromises targeting SonicWall customers, with ransomware groups including INC and Akira showing particular interest in exploiting these edge devices for initial access. This incident highlights the accelerating trend of threat actors targeting network appliances as primary attack vectors, particularly as organizations increase their reliance on edge security devices for zero trust architectures and hybrid cloud connectivity.
1 week ago
Kill Chain
Plex Issues Urgent Security Warning: Multiple Critical Vulnerabilities Require Immediate Patching
In September 2026, Plex issued an urgent security advisory warning users to immediately update their media servers and desktop clients to patch multiple critical vulnerabilities affecting Plex Media Server v1.43.2 and earlier. The company released patched versions (Media Server 1.43.3 and Desktop 1.115.0) and took the unusual step of emailing customers directly about the severity of these flaws, though specific CVE details were not yet published. This follows Plex's history of serious security incidents, including a 2025 credential theft vulnerability (CVE-2025-34158) and a 2022 data breach that compromised user credentials and personal information. This incident highlights the growing trend of threat actors targeting popular media streaming platforms and home entertainment systems as attack vectors for lateral movement into personal and corporate networks, particularly as remote work continues to blur the lines between home and business environments.
1 week ago
Kill Chain
When Employee Passwords Appear in Infostealer Logs: A Critical Security Response Framework
A growing cybersecurity challenge has emerged where employee corporate credentials are increasingly appearing in infostealer malware logs, with approximately 46% originating from unmanaged personal devices. These logs contain not just passwords but authenticated session cookies that can bypass multi-factor authentication, creating immediate access risks. Research indicates that exposure involving credentials for major SaaS and cloud services is growing 29% annually, with roughly 90% of logs now circulating through Telegram channels where they're accessible to initial access brokers and ransomware affiliates. This threat represents the convergence of several critical cybersecurity trends: the rise of hybrid work environments, increased reliance on SaaS applications, and the evolution of credential theft from simple password harvesting to comprehensive session hijacking. Organizations must now treat infostealer monitoring as an essential component of identity security programs.
1 week ago
Kill Chain
Critical Elementor Pro Vulnerability Enables WordPress Site Takeovers
In September 2026, threat actors began actively exploiting CVE-2026-32475, a critical vulnerability in the Elementor Pro WordPress plugin with over 6 million installations. The flaw allows attackers to bypass file upload validation by submitting an empty file as the first array element and a malicious PHP file as the second, enabling arbitrary code execution on vulnerable WordPress sites. Wordfence recorded nearly 200,000 exploitation attempts within days of the August 19 patch release, with attackers successfully deploying webshells to the /wp-content/uploads/elementor/forms/ directory for remote command execution. This incident highlights the persistent risk of web application vulnerabilities in popular content management systems, particularly when exploitation begins immediately after patch availability. The rapid weaponization demonstrates sophisticated threat actor capabilities in identifying and exploiting plugin vulnerabilities that affect millions of websites worldwide.
1 week ago
Kill Chain
€500K GDPR Fine: How Weak Access Controls Led to France's Largest Healthcare Data Breach
In summer 2025, Hôpital privé de la Loire, a French hospital in Saint-Étienne, suffered a devastating data breach that exposed sensitive information of 727,000 individuals, including 524,867 patients and 202,246 trusted third parties. The attack, executed by a teenage hacker using the alias 'Marak,' began with compromising a single doctor's account and exploiting inadequate access controls to access the entire electronic patient record system. The attacker operated undetected for several days due to lack of real-time monitoring, extracting massive volumes of sensitive healthcare data. France's data protection authority CNIL subsequently fined the hospital €500,000 for multiple GDPR violations, including insufficient authentication controls and failure to properly notify all affected parties. This incident highlights the escalating threat to healthcare organizations as attackers increasingly target medical institutions for valuable patient data, with healthcare breaches reaching record levels in 2024-2025 and regulatory enforcement becoming more stringent across Europe.
1 week ago
Kill Chain
Thomson Reuters C-Track Breach: When Court System Security Fails
In March 2026, an unauthorized party accessed Thomson Reuters' C-Track court case management platform, exposing sensitive data from courts across 11 U.S. states, the U.S. Virgin Islands, and Ontario, Canada. The breach, discovered on June 30, 2026, compromised backup files containing Social Security numbers, driver's license numbers, medical information, and sealed court documents. The unauthorized access persisted for nearly four months, affecting critical judicial systems that handle confidential legal proceedings and personal data of court users. This incident highlights the growing threat to government and legal infrastructure, particularly as courts increasingly rely on cloud-based case management systems. With ransomware groups actively targeting government entities and judicial systems becoming prime targets for data theft, this breach underscores the urgent need for enhanced security controls around privileged data access and cloud backup environments.
1 week ago
Kill Chain
Critical Cisco Nexus 9000 Vulnerability Exposes Network Infrastructure to Root-Level Compromise
In September 2026, Cisco disclosed CVE-2026-20212, a critical vulnerability with a CVSS score of 9.8 affecting Silicon One-based Nexus 9000 switches. The flaw stems from binding to unrestricted IP addresses, exposing TCP ports 43210 and 43211 in the default Layer 3 VRF instance. Unauthenticated remote attackers can exploit this vulnerability to execute arbitrary code with root privileges by sending crafted input to the exposed service, potentially causing device crashes and complete system compromise across affected enterprise network infrastructure. This incident highlights the accelerating threat landscape where AI-powered vulnerability discovery is shrinking the window between disclosure and exploitation. With critical network infrastructure increasingly targeted by nation-state actors like the China-nexus Fire Ant group, organizations face urgent pressure to implement comprehensive network segmentation and zero-trust controls.
1 week ago
Kill Chain
ThreatsDay 2026 Attack Analysis: When Social Engineering Meets Cloud Vulnerabilities
The ThreatsDay September 2026 report highlights a sophisticated multi-vector attack campaign featuring CEO-targeted phishing kits, over 5,000 compromised Dropbox accounts, and OAuth authentication bypass techniques. The attacks leveraged social engineering tactics that appeared legitimate, including fake IT support calls, malicious shared files, and trusted application impersonation to gain initial access. Threat actors exploited normal business processes and user trust, making detection extremely difficult. The campaign resulted in widespread credential theft, unauthorized access to cloud storage platforms, and potential data exfiltration across multiple organizations. This incident represents the evolving landscape of sophisticated social engineering attacks that bypass traditional security controls by exploiting human psychology and trusted business processes, highlighting the critical need for zero-trust architectures and enhanced user awareness training.
1 week ago
Kill Chain
BraZetsu Malware Transforms Compromised Networks Into Criminal Marketplace Assets
In February 2026, cybersecurity researchers discovered BraZetsu, a sophisticated Python-based malware framework developed by the Exilware threat group targeting Latin American organizations. The malware transforms compromised Windows hosts into commercial assets sold through the 'Infected Marketplace' for initial access brokerage operations. BraZetsu employs AI-enhanced reconnaissance capabilities to scan victim networks, extract financial data including Brazilian CNAB banking files, and maintain persistent command and control through WebSocket protocols. The framework represents a significant evolution in Initial Access Broker (IAB) operations, demonstrating how cybercriminals are leveraging artificial intelligence to automate target prioritization and commercialize network access at scale. This incident highlights the growing sophistication of IAB operations and the increasing use of AI in cybercrime, representing a critical shift in how threat actors monetize initial network access and scale their operations across regional markets.
1 week ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
