Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2581 to 2592 of 5988
CloudZ Malware Exploits Microsoft Phone Link to Steal SMS and OTPs
In May 2026, cybersecurity researchers identified a new variant of the CloudZ remote access tool (RAT) that employs a malicious plugin named Pheno to exploit Microsoft's Phone Link application. This malware monitors active Phone Link sessions on Windows 10 and 11 systems, accessing the application's local SQLite database to intercept SMS messages and one-time passwords (OTPs) without compromising the associated mobile device. The attack chain begins with a fake ScreenConnect update, leading to the deployment of a Rust-based loader, followed by a .NET loader that installs CloudZ RAT and establishes persistence via a scheduled task. The .NET loader includes anti-analysis checks to evade detection. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cloudz-malware-abuses-microsoft-phone-link-to-steal-sms-and-otps/?utm_source=openai)) This incident underscores the evolving tactics of threat actors who are increasingly targeting desktop applications that bridge connections to mobile devices. By compromising the Phone Link application, attackers can bypass traditional mobile security measures and directly access sensitive authentication codes, highlighting the need for enhanced security protocols in cross-device applications. ([csoonline.com](https://www.csoonline.com/article/4167092/stealthy-malware-abuses-microsoft-phone-link-to-siphon-sms-otps-from-enterprise-pcs.html?utm_source=openai))
4 months ago
Kill Chain
Vimeo Data Breach 2026: Lessons in Supply Chain Security
In April 2026, Vimeo experienced a data breach resulting from a compromise at Anodot, a third-party analytics provider. The ShinyHunters cybercrime group exploited this vulnerability to access Vimeo's Snowflake and BigQuery instances, exfiltrating data that included technical information, video titles, metadata, and customer email addresses. Notably, user login credentials and payment information remained secure. Following unsuccessful extortion attempts, ShinyHunters leaked a 106GB archive of the stolen data online. This incident underscores the escalating threat posed by supply chain attacks, where vulnerabilities in third-party services can lead to significant data breaches. Organizations are increasingly targeted through their service providers, highlighting the need for robust third-party risk management and enhanced security measures to protect sensitive data.
4 months ago
Kill Chain
Critical Spring Security Vulnerability CVE-2026-22732: What You Need to Know
In March 2026, a critical vulnerability identified as CVE-2026-22732 was discovered in Spring Security versions 5.7.0 through 7.0.3. This flaw causes HTTP response headers specified for servlet applications to be omitted, potentially exposing applications to attacks such as Cross-Site Scripting (XSS) and clickjacking. The vulnerability affects applications using the default lazy writing of HTTP headers, leading to the absence of essential security headers in responses. ([spring.io](https://spring.io/security/cve-2026-22732?utm_source=openai)) The omission of these headers undermines client-side protections, increasing the risk of sensitive data exposure and other security breaches. Organizations utilizing affected versions of Spring Security are urged to upgrade to the latest patched versions or apply recommended workarounds to mitigate this risk. ([spring.io](https://spring.io/security/cve-2026-22732?utm_source=openai))
4 months ago
Kill Chain
Student Exploits TETRA Vulnerabilities to Halt Taiwan High-Speed Trains
In April 2026, a 23-year-old university student in Taiwan exploited vulnerabilities in the Taiwan High Speed Rail Corporation's (THSRC) TETRA communication system. Utilizing software-defined radio (SDR) equipment and handheld radios, the student transmitted a forged 'General Alarm' signal, causing four high-speed trains to halt operations for 48 minutes. The attack was facilitated by the static nature of the system's parameters, which had remained unchanged for 19 years, allowing the student to bypass multiple verification layers. Authorities arrested the individual, who now faces charges under Article 184 of the Criminal Law, with potential imprisonment of up to 10 years. This incident underscores the critical need for regular security assessments and updates in communication systems, especially those integral to public safety and infrastructure. The exploitation of longstanding vulnerabilities in the TETRA protocol highlights the urgency for organizations to proactively address potential security gaps to prevent similar disruptions in the future.
4 months ago
Kill Chain
Quasar Linux Malware: A New Threat to Software Developers in 2026
In May 2026, cybersecurity researchers identified Quasar Linux (QLNX), a sophisticated malware targeting software developers' systems. QLNX combines rootkit, backdoor, and credential-stealing functionalities, deploying across development environments like npm, PyPI, GitHub, AWS, Docker, and Kubernetes. It achieves stealth and persistence through in-memory execution, log wiping, process name spoofing, and multiple persistence mechanisms, including LD_PRELOAD and systemd. The malware's capabilities include interactive shell access, file and process management, credential harvesting (SSH keys, browser data, cloud configurations), keylogging, and lateral movement via SSH-based techniques. By compromising developer workstations, QLNX poses a significant supply chain risk, potentially enabling attackers to publish malicious packages to public repositories. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-stealthy-quasar-linux-malware-targets-software-developers/amp/?utm_source=openai)) The emergence of QLNX underscores a growing trend of sophisticated malware targeting development environments to facilitate supply chain attacks. This incident highlights the critical need for enhanced security measures within software development pipelines to prevent unauthorized access and mitigate potential threats to software supply chains.
4 months ago
Kill Chain
DAEMON Tools Supply Chain Attack: A Wake-Up Call for Software Security
In April 2026, a sophisticated supply chain attack compromised the official installers of DAEMON Tools, a widely used virtual drive emulation software. Attackers injected malicious code into the software's installers, which were distributed from the legitimate DAEMON Tools website and signed with valid digital certificates. This allowed the malware to execute arbitrary commands and remotely control infected devices. The compromised versions, ranging from 12.5.0.2421 to 12.5.0.2434, have been in circulation since April 8, 2026. The attack has affected users in over 100 countries, with significant impacts in Russia, Brazil, Turkey, Spain, Germany, France, Italy, and China. Approximately 10% of the affected systems belong to businesses and organizations, exposing enterprise networks to severe risks. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/kaspersky-identifies-ongoing-supply-chain-attack-on-official-daemon-tools-website-distributing-backdoor-malware?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where trusted software is exploited to distribute malware. The DAEMON Tools compromise highlights the need for organizations to implement stringent software procurement protocols, conduct regular security audits, and enforce strict administrative privileges to mitigate such risks. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/kaspersky-identifies-ongoing-supply-chain-attack-on-official-daemon-tools-website-distributing-backdoor-malware?utm_source=openai))
4 months ago
Kill Chain
Critical Apache HTTP/2 Flaw (CVE-2026-23918) Enables DoS and Potential RCE
In May 2026, the Apache Software Foundation disclosed a critical vulnerability (CVE-2026-23918) in Apache HTTP Server version 2.4.66, involving a double-free error in the HTTP/2 protocol handling. This flaw allows attackers to execute denial-of-service attacks and potentially achieve remote code execution by sending specific HTTP/2 frames. The issue was identified by researchers Bartlomiej Dmitruk and Stanislaw Strzalkowski and has been addressed in version 2.4.67. Organizations using affected versions are urged to upgrade immediately to mitigate the risk. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-23918?utm_source=openai)) The widespread adoption of HTTP/2 and the default inclusion of mod_http2 in many deployments amplify the urgency of this vulnerability. Exploitation could lead to significant service disruptions and unauthorized access, underscoring the importance of prompt patching and vigilant monitoring of server configurations.
4 months ago
Kill Chain
Unitree Go1 Robot Backdoor Vulnerability Exposes Critical Security Flaws
In March 2025, security researchers uncovered a critical backdoor vulnerability in Unitree Robotics' Go1 quadruped robot, designated as CVE-2025-2894. This flaw allowed unauthorized remote control of the robots via the CloudSail service, posing significant risks to operational integrity and safety. Exploiting this backdoor, attackers could access live camera feeds, manipulate robot movements, and potentially exfiltrate sensitive data without the operator's knowledge. The discovery highlighted the urgent need for robust security measures in the rapidly evolving field of embodied AI systems. The incident underscores the growing cybersecurity challenges associated with integrating autonomous robots into critical workflows. As these systems become more prevalent, ensuring their security against unauthorized access and control is paramount to prevent potential operational disruptions and data breaches.
4 months ago
Kill Chain
Urgent: cPanel Vulnerability CVE-2026-41940 Under Active Exploitation
In late April 2026, a critical authentication bypass vulnerability, CVE-2026-41940, was disclosed in cPanel and WHM software, affecting versions after 11.40. This flaw allows unauthenticated remote attackers to gain administrative access to servers, posing a significant risk to millions of websites. Within 24 hours of disclosure, multiple threat actors began exploiting the vulnerability, leading to server compromises, website defacements, and ransomware deployments. Notably, the "sorry" ransomware encrypts files and appends a ".sorry" extension, with over 7,000 cPanel instances identified as compromised. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/04/multiple-threat-actors-actively-exploit-cpanel-vulnerability-cve-2026-41940/?utm_source=openai)) The rapid exploitation of CVE-2026-41940 underscores the critical need for organizations to promptly apply security patches and implement robust monitoring systems. The incident highlights the increasing speed at which threat actors exploit newly disclosed vulnerabilities, emphasizing the importance of proactive cybersecurity measures.
4 months ago
Kill Chain
VENOMOUS#HELPER: Phishing Campaign Leveraging RMM Tools Targets 80+ Organizations
Since April 2025, the VENOMOUS#HELPER phishing campaign has targeted over 80 organizations, primarily in the United States, by exploiting legitimate Remote Monitoring and Management (RMM) tools—SimpleHelp and ScreenConnect—to establish persistent remote access. Attackers initiate the campaign with phishing emails impersonating the U.S. Social Security Administration, leading victims to download malicious executables that install these RMM tools, thereby bypassing traditional security defenses. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/rmm-tools-stealthy-phishing-campaign?utm_source=openai)) This incident underscores a growing trend of cybercriminals leveraging trusted software to evade detection, highlighting the need for organizations to scrutinize the use of legitimate tools within their networks and enhance employee awareness to recognize sophisticated phishing attempts. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/rmm-tools-stealthy-phishing-campaign?utm_source=openai))
4 months ago
Kill Chain
Microsoft Edge's Cleartext Password Storage: A Security Wake-Up Call
In May 2026, security researcher Tom Jøran Sønstebyseter Rønning disclosed that Microsoft Edge decrypts and stores all saved user passwords in cleartext within process memory upon browser launch, retaining them throughout the session. This design allows attackers with administrative privileges to access these credentials, posing significant risks in shared and enterprise environments. Microsoft confirmed this behavior is intentional, stating it is 'by design.' This incident underscores the critical need for organizations to reassess their reliance on browser-based password storage solutions. The exposure of credentials in memory highlights vulnerabilities that can be exploited, emphasizing the importance of adopting dedicated password management tools and implementing robust security policies to mitigate such risks.
4 months ago
Kill Chain
Surge in Cyber-Enabled Cargo Theft: A 2025 Analysis
In 2025, cargo theft losses in the United States and Canada surged by 60%, reaching an estimated $725 million. This increase is attributed to cybercriminals employing sophisticated tactics such as phishing, impersonation, and system compromises to hijack goods during transit. By infiltrating supply chain systems, these actors rerouted shipments, leading to significant financial and operational disruptions for businesses. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260430?utm_source=openai)) The FBI's April 30, 2026, public service announcement underscores the evolving nature of cargo theft, emphasizing the integration of cyber techniques into traditional theft methods. This trend highlights the urgent need for enhanced cybersecurity measures within the transportation and logistics sectors to mitigate the risks posed by these advanced threats. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260430?utm_source=openai))
4 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
