Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2557 to 2568 of 5988
Critical Zero-Day Vulnerability in Palo Alto Networks Firewalls Exploited
In May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID Authentication Portal of their PAN-OS software. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Active exploitation of this zero-day vulnerability has been observed, particularly targeting firewalls with the User-ID Authentication Portal exposed to untrusted networks or the public internet. ([securityvulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-0300?utm_source=openai)) The incident underscores the persistent threat posed by zero-day vulnerabilities in critical network infrastructure. Organizations are urged to implement immediate mitigations, such as restricting access to the vulnerable portal to trusted networks or disabling it if not required, until official patches are released. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/06/palo-alto-firewalls-vulnerability-exploited-cve-2026-0300/?utm_source=openai))
4 months ago
Kill Chain
Securing Backup Systems Against Ransomware: A Critical Imperative
In May 2026, a comprehensive analysis highlighted a critical vulnerability in organizational cybersecurity: the deliberate targeting and destruction of backup systems by ransomware attackers. Despite the presence of backup solutions, many organizations found their recovery mechanisms compromised due to exposed and unprotected backup infrastructures. Attackers exploited this weakness by gaining administrative credentials, accessing backup consoles, and deleting or encrypting backup files, rendering recovery efforts futile. This systematic approach underscores the necessity for enhanced security measures to protect backup systems from such targeted attacks. The increasing sophistication of ransomware tactics, including the focus on backup destruction, reflects a broader trend in cyber threats. Organizations must recognize that traditional backup strategies are insufficient against modern ransomware attacks. Implementing integrated solutions that combine backup with security controls, such as immutability, access protection, and threat detection, is essential to ensure data resilience and business continuity in the face of evolving cyber threats.
4 months ago
Kill Chain
MuddyWater's Deceptive Tactics: Unmasking the Chaos Ransomware Facade
In early 2026, the Iranian state-sponsored hacking group MuddyWater orchestrated a cyber-espionage operation disguised as a Chaos ransomware attack. Utilizing Microsoft Teams for social engineering, the attackers initiated chats with employees, conducted screen-sharing sessions, harvested credentials, manipulated multi-factor authentication settings, and deployed remote access tools like AnyDesk. This approach enabled them to establish persistence, exfiltrate data, and send extortion emails, all while maintaining the facade of a ransomware attack. ([rapid7.com](https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored actors who blend traditional cybercrime methods with espionage objectives. The use of legitimate communication platforms for initial access highlights the need for organizations to enhance their security awareness training and implement robust monitoring of collaboration tools to detect and prevent such sophisticated attacks.
4 months ago
Kill Chain
Critical vm2 Sandbox Vulnerability (CVE-2026-26956) Allows Host Code Execution
In May 2026, a critical vulnerability identified as CVE-2026-26956 was discovered in vm2, a widely-used Node.js sandboxing library. This flaw allows attackers to escape the sandbox environment and execute arbitrary code on the host system. The issue affects vm2 version 3.10.4 and earlier, particularly in environments running Node.js 25 with WebAssembly exception handling and JSTag support enabled. Exploitation involves triggering a specially crafted TypeError, leading to the leakage of host-side error objects into the sandbox, which attackers can manipulate to gain access to Node.js internals and execute commands on the host. The discovery of this vulnerability underscores the challenges in securely isolating untrusted code within JavaScript sandbox environments. Given vm2's extensive use in online coding platforms, automation tools, and SaaS applications, the potential impact is significant. Users are strongly advised to upgrade to vm2 version 3.10.5 or later to mitigate the risk associated with this vulnerability.
4 months ago
Kill Chain
xlabs_v1 Botnet: A New Threat Exploiting ADB-Exposed IoT Devices
In May 2026, cybersecurity researchers uncovered a new botnet named xlabs_v1, derived from the Mirai malware, which exploits internet-exposed devices running Android Debug Bridge (ADB) on TCP port 5555. This botnet targets devices such as Android TV boxes, set-top boxes, and smart TVs, enlisting them to perform distributed denial-of-service (DDoS) attacks, particularly against game servers and Minecraft hosts. The malware supports 21 flood variants across TCP, UDP, and raw protocols, including RakNet and OpenVPN-shaped UDP, capable of bypassing consumer-grade DDoS protection. Notably, xlabs_v1 lacks a persistence mechanism, requiring re-infection for each attack, and includes a 'killer' subsystem to eliminate competing malware, ensuring full control over the compromised device's bandwidth. ([thehackernews.com](https://thehackernews.com/2026/05/mirai-based-xlabsv1-botnet-exploits-adb.html?utm_source=openai)) The emergence of xlabs_v1 highlights the ongoing evolution of IoT-targeted malware and the increasing sophistication of DDoS-for-hire services. This incident underscores the critical need for securing IoT devices, particularly those with default-enabled services like ADB, to prevent their exploitation in large-scale cyber attacks.
4 months ago
Kill Chain
OceanLotus's 2025 PyPI Supply Chain Attack: Unveiling the ZiChatBot Malware
In July 2025, the OceanLotus APT group initiated a supply chain attack by uploading malicious Python wheel packages to the Python Package Index (PyPI). These packages, named 'uuid32-utils', 'colorinal', and 'termncolor', acted as droppers for a previously unknown malware family called ZiChatBot, targeting both Windows and Linux platforms. The infection chain involved extracting a DLL or .SO dropper from the wheel package, establishing persistence via registry (Windows) or crontab (Linux), and deploying ZiChatBot. Notably, ZiChatBot utilized Zulip's public REST APIs as its command and control infrastructure, deviating from traditional dedicated servers and complicating detection efforts. The malicious packages were swiftly removed from PyPI, and the associated Zulip organization was deactivated. To date, no confirmed infections have been reported. This campaign underscores OceanLotus's expanding strategy of leveraging supply chain attacks to target a global audience, following a similar GitHub-based phishing campaign earlier in 2025.
4 months ago
Kill Chain
Rockstar Games Data Breach: A Case Study in Third-Party Exploitation
In April 2026, Rockstar Games experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers exploited vulnerabilities in Anodot, a monitoring tool integrated with Rockstar's Snowflake cloud infrastructure, to gain unauthorized access. This breach led to the exfiltration of nearly 80 million records, including sensitive internal corporate information. While Rockstar confirmed that no player data or passwords were compromised, the incident underscores the risks associated with third-party integrations and the potential for indirect attack vectors. This breach is part of a broader trend of financially motivated cyber extortion campaigns targeting major organizations. ShinyHunters' tactics, particularly their use of social engineering and exploitation of third-party services, highlight the evolving threat landscape. Organizations must remain vigilant, ensuring robust security measures are in place for both internal systems and external partnerships to mitigate such risks.
4 months ago
Kill Chain
Unveiling Threat Activity Enablers: Key Players in 2025's Cyber Threat Landscape
In 2025, Recorded Future's Insikt Group identified a significant rise in the utilization of Threat Activity Enablers (TAEs)—entities that provide infrastructure and services to support malicious cyber activities. These TAEs, often operating through complex networks of shell companies and lacking stringent Know Your Customer (KYC) policies, have become central to the operations of ransomware groups, botnets, and state-sponsored actors. Notably, German hosting provider aurologic GmbH emerged as a key player, offering services to multiple high-risk networks implicated in various cyber threats. ([recordedfuture.com](https://www.recordedfuture.com/research/malicious-infrastructure-finds-stability-with-aurologic-gmbh?utm_source=openai)) The persistence and adaptability of TAEs pose a substantial challenge to cybersecurity efforts. Their ability to rapidly rebrand and manipulate network resources allows them to evade sanctions and takedowns, ensuring the continuity of malicious operations. This trend underscores the necessity for organizations to enhance their threat intelligence capabilities and adopt proactive measures to identify and mitigate risks associated with such enablers. ([recordedfuture.com](https://www.recordedfuture.com/blog/threat-activity-enablers?utm_source=openai))
4 months ago
Kill Chain
CloudZ RAT and Pheno Plugin Exploit Windows Phone Link to Bypass 2FA
In January 2026, attackers initiated a campaign leveraging the CloudZ remote access Trojan (RAT) and a new plugin named Pheno to exploit Microsoft's Phone Link application on Windows PCs. By compromising the PC, they intercepted SMS messages and one-time passwords (OTPs) synced from connected mobile devices, effectively bypassing two-factor authentication without directly infecting the phones. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/attacks-abuse-windows-phone-link-texts-bypass-2fa?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who are now targeting cross-device synchronization tools to access sensitive information. The exploitation of trusted applications like Phone Link highlights the need for enhanced security measures in endpoint management and the potential vulnerabilities in multi-factor authentication systems. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/attacks-abuse-windows-phone-link-texts-bypass-2fa?utm_source=openai))
4 months ago
Kill Chain
UAE Faces Unprecedented Cyberattacks Amid Regional Tensions
In early 2026, the United Arab Emirates (UAE) experienced a significant surge in cyberattacks, with daily breach attempts escalating from 90,000–200,000 to between 600,000 and 800,000 following the onset of military operations by Israel and the U.S. against Iran. These attacks, attributed to nation-state actors and hacktivist groups, targeted critical infrastructure sectors such as finance, telecommunications, aviation, law enforcement, and energy. The UAE's Cybersecurity Council reported that the national cyber defense system successfully thwarted these organized cyberattacks, which included ransomware, phishing campaigns, and the exploitation of artificial intelligence technologies to develop sophisticated offensive tools. ([gulfnews.com](https://gulfnews.com/uae/government/uae-thwarts-terrorist-cyberattacks-targeting-vital-digital-infrastructure-1.500451219?utm_source=openai)) This escalation underscores the evolving nature of cyber threats in the region, highlighting the increasing integration of advanced technologies into malicious digital activities. The UAE's proactive defense measures and improved cyber visibility have been instrumental in mitigating the impact of these attacks, reflecting a broader trend of heightened cyber resilience among Gulf nations. ([thenationalnews.com](https://www.thenationalnews.com/future/technology/2026/02/18/uae-cybersecurity-fake-news-disinformation/?utm_source=openai))
4 months ago
Kill Chain
Critical Remote Code Execution Vulnerability in Palo Alto PAN-OS (CVE-2026-0300)
In May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in its PAN-OS software, specifically within the User-ID Authentication Portal service. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. The vulnerability affects multiple versions of PAN-OS, including 12.1, 11.2, 11.1, and 10.2, with exploitation observed in instances where the User-ID Authentication Portal is exposed to untrusted networks or the public internet. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The active exploitation of CVE-2026-0300 underscores the persistent threat posed by unauthenticated remote code execution vulnerabilities in critical network infrastructure. Organizations are urged to implement immediate mitigations, such as restricting access to the User-ID Authentication Portal to trusted internal networks, to reduce the risk of compromise. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))
4 months ago
Kill Chain
CloudZ RAT and Pheno Plugin Exploit Windows Phone Link to Steal Credentials
In May 2026, cybersecurity researchers uncovered an intrusion involving the CloudZ remote access tool (RAT) and a previously undocumented plugin named Pheno. The attackers exploited Microsoft's Phone Link application to intercept sensitive mobile data, including SMS messages and one-time passwords (OTPs), without compromising the mobile device itself. This method allowed the attackers to bypass two-factor authentication mechanisms by accessing credentials synchronized between the victim's PC and mobile device. This incident highlights the evolving tactics of threat actors who are increasingly targeting legitimate cross-device synchronization features to facilitate credential theft. Organizations should reassess their security postures, especially concerning applications that bridge mobile and desktop environments, to mitigate similar threats.
4 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
