Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2569 to 2580 of 5988
ABB B&R PVI Vulnerability CVE-2026-0936: Secure Your Systems Now
In January 2026, ABB identified a vulnerability in its B&R PVI client application, specifically versions prior to 6.5.0. The flaw, designated as CVE-2026-0936, involves the insertion of sensitive information into log files. If exploited, an authenticated local attacker could access credential information processed by the PVI client. Notably, the logging function is disabled by default, mitigating immediate risk. ABB has released version 6.5.0 to address this issue and recommends users update promptly. This incident underscores the critical importance of secure logging practices in industrial control systems. As cyber threats targeting operational technology environments increase, organizations must proactively manage vulnerabilities to safeguard sensitive information and maintain system integrity.
4 months ago
Kill Chain
Critical Vulnerability in Johnson Controls CEM AC2000: CVE-2026-21661
In May 2026, a critical vulnerability (CVE-2026-21661) was identified in Johnson Controls' CEM AC2000 versions 10.6, 11.0, and 12.0. This flaw, stemming from an uncontrolled search path element, allows standard users to escalate privileges on the host machine via DLL hijacking. The vulnerability affects sectors such as Critical Manufacturing, Commercial Facilities, Government Services, Transportation Systems, and Energy. Johnson Controls has released specific updates to remediate this issue. The incident underscores the persistent risks associated with DLL hijacking vulnerabilities in critical infrastructure systems. Organizations are urged to promptly apply the recommended updates and review their security protocols to prevent potential exploitation.
4 months ago
Kill Chain
Critical Vulnerability in Hitachi Energy PCM600: CVE-2018-1002208
In April 2026, Hitachi Energy disclosed a vulnerability in its PCM600 product, specifically affecting versions up to 3.1 SP3. The flaw, identified as CVE-2018-1002208, stems from the use of SharpZipLib versions prior to 1.0 RC1, which are susceptible to directory traversal attacks. Exploiting this 'Zip-Slip' vulnerability, attackers can write arbitrary files via crafted Zip archives, potentially compromising system integrity. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2018-1002208?utm_source=openai)) This incident underscores the critical importance of timely software updates and vigilant dependency management. Organizations must proactively address known vulnerabilities in third-party libraries to mitigate risks associated with supply chain attacks and ensure the security of their operational environments.
4 months ago
Kill Chain
MuddyWater's Deceptive Ransomware Attack via Microsoft Teams
In early 2026, the Iranian state-sponsored hacking group MuddyWater executed a sophisticated cyber-espionage operation disguised as a Chaos ransomware attack. Utilizing Microsoft Teams for social engineering, the attackers engaged in interactive screen-sharing sessions to harvest credentials and manipulate multi-factor authentication (MFA). Once inside, they bypassed traditional ransomware workflows, opting instead for data exfiltration and establishing long-term persistence through remote management tools like DWAgent and AnyDesk. This operation highlights the evolving tactics of state-sponsored actors in obfuscating their activities by mimicking financially motivated cybercriminals. The incident underscores a growing trend where nation-state actors adopt cybercriminal methodologies to obscure attribution and complicate defensive responses. Organizations must remain vigilant against such deceptive tactics, emphasizing the need for robust security measures, continuous monitoring, and employee training to counteract sophisticated social engineering attacks.
4 months ago
Kill Chain
Critical Vulnerability in ABB B&R Automation Studio: CVE-2025-11043
In January 2026, ABB disclosed a critical vulnerability (CVE-2025-11043) in its B&R Automation Studio software versions prior to 6.5. This flaw involves improper certificate validation in the OPC-UA and ANSL over TLS clients, potentially allowing unauthenticated attackers to intercept and manipulate data exchanges. Such exploitation could lead to unauthorized access and control over industrial automation systems, posing significant risks to operational integrity. The increasing reliance on secure communication protocols in industrial control systems underscores the importance of robust certificate validation mechanisms. This incident highlights the necessity for organizations to promptly update affected systems and implement comprehensive security measures to mitigate similar vulnerabilities.
4 months ago
Kill Chain
Critical SQL Injection Vulnerability in LiteLLM Exploited Within 36 Hours
In April 2026, a critical pre-authentication SQL injection vulnerability, CVE-2026-42208, was discovered in LiteLLM, an open-source proxy facilitating unified API access to multiple large language model providers. This flaw allowed unauthenticated attackers to execute arbitrary SQL commands, leading to unauthorized access to sensitive data, including API keys for providers like OpenAI, Anthropic, and AWS Bedrock. Exploitation was observed within 36 hours of public disclosure, highlighting the rapid weaponization of such vulnerabilities. ([thehackernews.com](https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html?utm_source=openai)) The swift exploitation of CVE-2026-42208 underscores the increasing targeting of AI infrastructure by threat actors. Organizations utilizing AI services must prioritize timely patching and robust security measures to protect against similar vulnerabilities and safeguard sensitive credentials.
4 months ago
Kill Chain
Understanding CVE-2026-31431: The 'Copy Fail' Linux Privilege Escalation Vulnerability
On April 29, 2026, researchers disclosed a critical local privilege escalation vulnerability in the Linux kernel, identified as CVE-2026-31431, commonly referred to as 'Copy Fail'. This flaw allows unprivileged local users to escalate their privileges to root across major Linux distributions released since 2017, including Ubuntu, Red Hat Enterprise Linux, and SUSE. The vulnerability stems from a logic error in the kernel's cryptographic subsystem, specifically within the algif_aead module of the AF_ALG interface, enabling attackers to modify the in-memory cache of privileged executable files without altering the physical files on disk. This issue is particularly concerning in environments such as Kubernetes clusters and multi-tenant hosts, where it can facilitate container escapes and compromise of shared resources. Given the availability of a reliable proof-of-concept exploit and active exploitation in the wild, organizations are urged to apply vendor-issued kernel updates immediately to mitigate the risk.
4 months ago
Kill Chain
New Rowhammer Attacks Compromise NVIDIA GPUs, Leading to Full System Control
In April 2026, independent research teams unveiled novel Rowhammer attacks targeting NVIDIA's Ampere-generation GPUs, specifically the RTX 3060 and RTX 6000 models. These attacks, named GDDRHammer and GeForge, exploit vulnerabilities in GDDR6 memory to induce bit flips, granting attackers arbitrary read/write access to CPU memory and leading to full system compromise. The attacks are particularly effective when IOMMU memory management is disabled, a common default in BIOS settings. ([arstechnica.com](https://arstechnica.com/security/2026/04/new-rowhammer-attacks-give-complete-control-of-machines-running-nvidia-gpus/?utm_source=openai)) The emergence of these GPU-focused Rowhammer attacks signifies a critical evolution in hardware-based vulnerabilities, extending beyond traditional CPU memory exploits. This development underscores the urgent need for enhanced security measures in GPU architectures, especially as GPUs play pivotal roles in cloud computing and AI applications. Organizations must reassess their hardware security protocols to mitigate these advanced threats.
4 months ago
Kill Chain
CISA's CI Fortify Initiative: Strengthening Critical Infrastructure Resilience
In May 2026, the Cybersecurity and Infrastructure Security Agency (CISA) launched the 'CI Fortify' initiative to bolster the resilience of U.S. critical infrastructure against state-sponsored cyber threats, particularly from Chinese groups Salt Typhoon and Volt Typhoon. This program focuses on enabling essential services to operate independently for extended periods by isolating operational technology (OT) networks from IT systems and third-party connections during emergencies. ([cyberscoop.com](https://cyberscoop.com/cisa-ci-fortify-critical-infrastructure-isolation-recovery-guidance-during-conflict/?utm_source=openai)) The urgency of this initiative is underscored by recent cyber activities targeting critical sectors such as electricity, water, and telecommunications. These incidents highlight the need for infrastructure operators to develop and implement isolation and recovery plans to maintain service continuity amidst potential cyber disruptions. ([cyberscoop.com](https://cyberscoop.com/cisa-ci-fortify-critical-infrastructure-isolation-recovery-guidance-during-conflict/?utm_source=openai))
4 months ago
Kill Chain
Latvian National Sentenced for Ransomware Attacks by Former Conti Leaders
In May 2026, Latvian national Deniss Zolotarjovs was sentenced to 102 months in prison for his role in a series of ransomware attacks orchestrated by former leaders of the Conti ransomware group. Between June 2021 and August 2023, Zolotarjovs and his co-conspirators extorted nearly $16 million from over 54 companies, employing multiple aliases such as Conti, Karakurt, Royal, TommyLeaks, SchoolBoys Ransomware, and Akira. Notably, Zolotarjovs pressured victims by threatening to leak sensitive data, including children's health records, to coerce ransom payments. ([cyberscoop.com](https://cyberscoop.com/latvian-russia-ransomware-conti-sentenced/?utm_source=openai)) This case underscores the persistent threat posed by rebranded ransomware groups and highlights the importance of robust cybersecurity measures. Organizations must remain vigilant against evolving tactics employed by cybercriminals, especially those targeting sensitive data to maximize leverage.
4 months ago
Kill Chain
ScarCruft's Supply Chain Attack Delivers BirdCall Malware to Android Users
In May 2026, the North Korean state-sponsored hacking group ScarCruft (APT37) executed a supply chain attack by compromising the sqgame[.]net gaming platform, which serves the Yanbian region in China. The attackers trojanized Android game APKs available on the platform, embedding a new variant of their BirdCall backdoor malware. This Android version of BirdCall is capable of extracting geolocation data, collecting contacts, call logs, SMS messages, device information, and exfiltrating files of interest. Additionally, it can take periodic screenshots and record audio during specific time frames. The campaign appears to target ethnic Koreans in the Yanbian region, a known crossing point for North Korean defectors and refugees. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/scarcruft-hackers-push-birdcall-android-malware-via-game-platform/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors, particularly their expansion into mobile platforms through supply chain compromises. The development of Android-specific malware variants like BirdCall highlights the increasing risk to mobile device users, emphasizing the need for heightened vigilance and robust security measures when downloading applications, especially from third-party sources.
4 months ago
Kill Chain
Karakurt Extortion Gang Member Sentenced to 8.5 Years in Prison
In May 2026, Deniss Zolotarjovs, a Latvian national and member of the Russian Karakurt ransomware group, was sentenced to 8.5 years in prison in the United States. Operating under the alias "Sforza_cesarini," Zolotarjovs specialized in "cold case" negotiations, re-engaging with victims who had ceased communication without paying ransoms. Between August 2021 and November 2023, he was linked to at least six extortion cases against American organizations, contributing to over $56 million in losses, including approximately $2.8 million in ransom payments. His tactics included leveraging stolen personal and health information to intensify pressure on victims. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/karakurt-extortion-gang-negotiator-sentenced-to-85-years-in-prison/?utm_source=openai)) This sentencing marks the first conviction of a Karakurt member in the U.S., potentially paving the way for further prosecutions within the group. The case underscores the persistent threat posed by ransomware and extortion groups, highlighting the necessity for robust cybersecurity measures and international cooperation in combating cybercrime. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/karakurt-extortion-gang-negotiator-sentenced-to-85-years-in-prison/?utm_source=openai))
4 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
