Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 253 to 264 of 5924
BraZetsu Malware Transforms Compromised Networks Into Criminal Marketplace Assets
In February 2026, cybersecurity researchers discovered BraZetsu, a sophisticated Python-based malware framework developed by the Exilware threat group targeting Latin American organizations. The malware transforms compromised Windows hosts into commercial assets sold through the 'Infected Marketplace' for initial access brokerage operations. BraZetsu employs AI-enhanced reconnaissance capabilities to scan victim networks, extract financial data including Brazilian CNAB banking files, and maintain persistent command and control through WebSocket protocols. The framework represents a significant evolution in Initial Access Broker (IAB) operations, demonstrating how cybercriminals are leveraging artificial intelligence to automate target prioritization and commercialize network access at scale. This incident highlights the growing sophistication of IAB operations and the increasing use of AI in cybercrime, representing a critical shift in how threat actors monetize initial network access and scale their operations across regional markets.
1 week ago
Kill Chain
AI-Powered Cyber Threats Surge in H1 2026: 215 Exploited Vulnerabilities Signal New Attack Era
The first half of 2026 witnessed a 34% surge in actively exploited vulnerabilities, reaching 215 CVEs compared to 161 in H1 2025. Threat actors increasingly leveraged AI-enabled capabilities to enhance traditional attack methods, with malware like PromptSpy using generative AI for improved persistence and CANFAIL employing LLM-generated decoy logic. Microsoft remained the most targeted vendor with 40 exploited CVEs, while attackers focused on network-accessible vulnerabilities requiring no authentication. The campaign demonstrated how adversaries are blending malicious activities with legitimate tools and trusted services, making detection significantly more challenging. This trend represents a critical evolution in cyber warfare where AI augments rather than replaces established intrusion techniques. Organizations face compressed remediation timelines as AI-assisted vulnerability research accelerates exploit development, while attackers abuse trusted platforms and routine workflows to evade detection systems designed for traditional threat patterns.
1 week ago
Kill Chain
AWS CloudTrail Forensics: Defending Against Cross-Account Attacks and Crypto Mining
AWS released a comprehensive incident response guide demonstrating two critical attack scenarios affecting cloud environments in 2025. The first scenario involves a cross-account S3 data deletion attack where threat actors assumed roles from trusted accounts, performed reconnaissance through ListBuckets operations, and executed scripted deletions of financial reports, PII databases, and production backups within a 13-second window. The second scenario showcases cryptocurrency mining operations deployed through AWS CloudFormation, where attackers leveraged console credentials without MFA to create the 'CRYPTO' stack containing EC2 instances for mining operations. Both incidents highlight the sophistication of modern cloud-native attacks that exploit legitimate AWS services and cross-account trust relationships. These attack patterns are increasingly relevant as organizations accelerate cloud adoption while struggling with proper access controls, zero trust implementation, and multi-cloud visibility. The incidents underscore the critical need for enhanced CloudTrail monitoring, cross-account access reviews, and comprehensive egress security policies.
1 week ago
Kill Chain
Multi-Stage AWS Attack: From SSRF to Unauthorized AI Model Access
A sophisticated multi-stage attack demonstrated how web application vulnerabilities can cascade into unauthorized AI service access across AWS regions. The incident began with a Server-Side Request Forgery (SSRF) vulnerability in a web application that allowed attackers to exploit IMDSv1 endpoints and harvest temporary AWS credentials from an EC2 instance's webdev role. Using these compromised credentials, the threat actor conducted permission boundary testing, established console access without MFA, and ultimately pivoted to Amazon Bedrock services across multiple regions, successfully invoking AI models and consuming computational resources. This attack chain highlights critical gaps in cloud security architecture, particularly the dangerous combination of overprivileged IAM roles, legacy metadata service configurations, and inconsistent cross-region security controls that enabled lateral movement from a simple web vulnerability to unauthorized AI infrastructure access.
1 week ago
Kill Chain
Massive Identity Verification Breach: 153M Driver's Licenses Compromised at IDScan.net
In September 2026, a new identity theft service called Nexus launched on the dark web selling digital scans of over 153 million drivers licenses from the United States and Canada. The breach appears to originate from Louisiana-based identity verification company IDScan.net, which provides services to major clients including Hertz, Target, FedEx, and numerous marijuana dispensaries. The stolen data includes infrared and ultraviolet scans with timestamps indicating continuous exfiltration over more than a year, prompting an FBI investigation by the New Orleans field office. This massive identity document breach represents one of the largest exposures of state-issued identification data in U.S. history, with attackers offering licenses of high-profile government officials including Defense Secretary Pete Hegseth and FBI leadership. The incident highlights critical vulnerabilities in third-party identity verification systems that process over 21 million verifications monthly across 20,000 locations worldwide.
1 week ago
Kill Chain
The AI Vulnerability Surge: Why 2026's 'Vulnpocalypse' May Be More Manageable Than Expected
New research from Echo analyzing nearly 40,000 CVE lifecycles reveals that while AI tools like Anthropic's Claude Mythos have dramatically accelerated vulnerability discovery, the anticipated 'Vulnpocalypse' may be more manageable than feared. Monthly CVE disclosures surged 145% from June 2024 to June 2026, rising from 3,173 to 7,765, with AI enabling exploit development in under one day for less than $2,000. However, fewer than 10% of AI-discovered vulnerabilities receive external validation, and most critical ratings are downgraded upon review. The study found that 89% of examined vulnerabilities already have fixes available, but 40% remain unpatched for over six months due to deployment challenges rather than fix availability. Organizations can better manage this surge by focusing on rapid validation, intelligent prioritization, and automated remediation processes rather than completely overhauling their vulnerability management programs.
1 week ago
Kill Chain
The AI Cybercrime Revolution: How Artificial Intelligence Tilts the Playing Field Toward Attackers
In 2026, artificial intelligence is fundamentally transforming the cybercrime landscape by dramatically compressing attack timelines and lowering entry barriers for threat actors. Former cybercriminal Brett Johnson, known as the 'original Internet Godfather' by the US Secret Service, demonstrated at Black Hat USA how AI enables attackers to conduct reconnaissance, identify crown jewels, and execute attacks in significantly reduced timeframes. While defenders still operate reactively, AI empowers criminals to automate target research, vulnerability discovery, and even ransomware development without requiring advanced technical skills. This shift is driving more attackers toward critical infrastructure targets like hospitals and schools, where higher payouts justify the risks. The technology's learning-based nature means it benefits attackers more than defenders, as it must observe successful attacks to improve, creating an inherent advantage for malicious actors in the current threat landscape.
1 week ago
Kill Chain
Breeze Comet Cybercrime Group: Direct Manipulation of Global Financial Payment Systems
Breeze Comet (formerly UNC5669) represents Brazil's most sophisticated cybercrime group, systematically infiltrating financial institutions across Brazil and expanding globally since 2024. The group employs advanced tactics including insider recruitment, physical network access via rogue hardware, and exploitation of compromised government websites as trusted attack vectors. Using custom malware like CobaltSpin, RealBreeze, and KickPlate, they penetrate segmented financial networks to directly manipulate payment systems including Brazil's Pix instant payment platform, executing hundreds of fraudulent transactions worth tens of thousands of dollars within 24-48 hours of system compromise. This incident highlights the evolution of financially-motivated cybercrime from traditional ransomware and fraud schemes to direct payment system manipulation. As instant payment systems proliferate globally and threat actors increasingly leverage AI for malware development, Breeze Comet's successful model poses significant risks to financial infrastructure worldwide, particularly in regions with similar digital payment architectures.
1 week ago
Kill Chain
Critical SonicWall SMA 1000 Zero-Days Under Active Exploitation: CVE-2026-83548 & CVE-2026-83549
In September 2026, attackers began actively exploiting two zero-day vulnerabilities in SonicWall SMA 1000 perimeter devices, enabling unauthenticated remote code execution. CVE-2026-83548, a critical SSRF vulnerability with a CVSS score of 10.0, allows unauthorized access through an unintended alternate access path, while CVE-2026-83549 enables OS command injection. When chained together, these flaws provide complete system compromise of affected appliances running versions 12.4.3-03453/12.5.0-02835 and older. SonicWall confirmed ongoing exploitation and urged immediate patching to versions 12.4.3-03526/12.5.0-02952 or higher. This incident highlights the continued targeting of edge security devices as initial compromise vectors, following a pattern of sophisticated zero-day attacks against network perimeter appliances throughout 2026, emphasizing the critical need for rapid patch management and network segmentation strategies.
1 week ago
Kill Chain
Machine Speed Terror: How AI Agents Compressed a 2-Week Breach Into 10 Hours
In September 2026, threat actors demonstrated the devastating potential of AI-assisted cyberattacks by compressing a typical two-week enterprise breach timeline into just 10 hours. The attackers deployed coordinated frontier AI agents that autonomously breached network security layers, harvested credentials, seized root access, hijacked CI/CD pipelines, and weaponized the victim's own AI infrastructure. The attack began with exploitation of a public API endpoint and escalated through systematic extraction of hardcoded tokens from code repositories, ultimately providing master administrative credentials and complete system compromise. This machine-speed ransomware attack represents a paradigm shift from individual AI-assisted tasks to orchestrated multi-agent operations that can outpace traditional security response capabilities. The emergence of AI-driven attack coordination signals a new era where threat actors can achieve enterprise-scale breaches with unprecedented speed and efficiency, forcing organizations to fundamentally reimagine their defense strategies and response timelines.
1 week ago
Kill Chain
Seven Critical Vulnerabilities Exploited in Wild: AI Infrastructure Becomes Prime Target
CISA added seven critical vulnerabilities to its Known Exploited Vulnerabilities catalog in September 2026 after observing active exploitation by threat actors. The vulnerabilities span multiple platforms including SonicWall SMA appliances, Sangoma Switchvox, JFrog Artifactory, and AI infrastructure components like LiteLLM and Kestra. Attackers exploited these flaws to deploy reverse shells, cryptocurrency miners, and conduct unauthorized operations, with campaigns targeting AI infrastructure becoming increasingly prominent as adversaries seek to harvest API keys and monetize compromised systems. This incident highlights the growing threat landscape targeting AI infrastructure and the critical importance of rapid vulnerability remediation. With AI systems becoming prime targets for credential theft and resource hijacking, organizations must prioritize security updates and implement comprehensive monitoring across their AI workloads to prevent similar exploitation campaigns.
1 week ago
Kill Chain
FalconFlank Zero-Day Targets CrowdStrike Falcon: When EDR Becomes the Attack Vector
In September 2026, security researcher Chaotic Eclipse released FalconFlank, a zero-day privilege escalation exploit targeting CrowdStrike Falcon endpoint security software. The vulnerability abuses office malicious macros remediation functionality within Falcon Sensor to achieve privilege escalation on fully updated Windows 11 25H2 and Windows Server 2025 systems. This disclosure follows the researcher's pattern of releasing proof-of-concept exploits for major endpoint security products, including recent vulnerabilities in Kaspersky and Microsoft Defender, highlighting systemic weaknesses in endpoint protection platforms. This incident underscores the growing trend of security researchers targeting endpoint detection and response (EDR) solutions themselves, exposing critical trust assumptions in enterprise security architectures and forcing organizations to reconsider their defense-in-depth strategies.
1 week ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
