Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 265 to 276 of 5924
Serbian Student Activists Targeted by Pegasus Zero-Click Spyware Campaign
In December 2025 through January 2026, NSO Group's Pegasus spyware infected the iPhone of a Serbian student protest movement member using a zero-click iMessage exploit. The attack was part of a broader surveillance campaign targeting at least 14 Serbian activists, opposition politicians, and student leaders coinciding with March 2026 local elections. Citizen Lab and SHARE Foundation confirmed the infection, while a separate incident involved NoviSpy Android malware deployed during police detention of another student activist. This incident highlights the escalating use of commercial spyware against civil society, particularly as authoritarian governments increasingly weaponize surveillance technology to suppress political dissent and monitor opposition movements ahead of critical elections.
1 week ago
Kill Chain
Shai-Hulud Infostealer Evolves to Target 469 Credential Locations Across Software Supply Chains
In August 2026, GitGuardian researchers discovered that the Shai-Hulud infostealer worm had evolved to scan for credentials across 469 locations in developer environments, representing a 148% increase from earlier variants that checked only 189 paths. The malware targets CI/CD tooling, cloud configurations, AI tool configs, package registries, and development environments to harvest reusable credentials for supply chain attacks. The stolen credentials enable lateral movement across trusted software supply chains, turning credential theft into ongoing propagation vectors through package publishing systems. This incident highlights the critical shift in attack methodologies where threat actors no longer need to break trust relationships but instead exploit existing credential sprawl across modern development ecosystems. The exponential increase in targeted credential locations demonstrates the growing sophistication of supply chain attacks and the urgent need for comprehensive secrets management across DevOps pipelines.
1 week ago
Kill Chain
Threat Actors Weaponize Trusted Node.js Runtime for Stealth Malware Delivery
Since February 2026, threat actors have been weaponizing the legitimate Node.js JavaScript runtime (node.exe) to deliver malicious payloads in targeted attacks against government departments, technology companies, and hotels. The Symantec Threat Hunter Team identified this technique as particularly effective because node.exe is a trusted binary that can execute arbitrary JavaScript code while evading traditional security detection mechanisms. Attackers leverage the runtime's legitimate presence in enterprise environments to establish persistence, execute malware, and maintain command and control communications without triggering security alerts. This campaign reflects the growing trend of living-off-the-land tactics where attackers abuse legitimate system tools rather than deploying custom malware, making detection significantly more challenging for traditional security solutions and highlighting the need for behavioral analysis and runtime protection.
1 week ago
Kill Chain
Seven Critical Vulnerabilities Added to CISA's KEV Catalog Demand Immediate Action
On September 2, 2026, CISA added seven actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, affecting critical enterprise systems including Sangoma Switchvox, SonicWall SMA1000 appliances, JFrog Artifactory, and other widely deployed platforms. The vulnerabilities span SQL injection, authentication bypass, command injection, and request smuggling attack vectors, with threat actors already leveraging these flaws to compromise federal and private sector networks. The additions coincide with CISA's new Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize rapid remediation of high-risk vulnerabilities that grant total system control. This incident highlights the accelerating pace of vulnerability exploitation as threat actors increasingly target authentication systems, web applications, and network appliances to establish persistent access. The rapid weaponization of these CVEs demonstrates the critical need for organizations to implement proactive vulnerability management and zero-trust security controls.
1 week ago
Kill Chain
Global RMM Phishing Campaign Exploits Legitimate Cloud Services Across 46 Countries
In September 2026, security researchers identified a sophisticated RMM phishing campaign spanning 46 countries, with the United States accounting for 45% of observed activity. The operation used fake documents mimicking tax forms, shipping notifications, and government communications to trick victims into installing legitimate remote monitoring and management software. Attackers leveraged rapidly rotating infrastructure on Vercel, GitHub Pages, and Netlify, with 94% of 425 identified URLs observed for only a single day. The campaign targeted education, technology, government, banking, and manufacturing sectors. This incident highlights the growing trend of threat actors abusing legitimate cloud services and software for malicious purposes, making detection increasingly challenging through traditional IOC-based approaches.
1 week ago
Kill Chain
Microsoft Teams Impersonation Campaign Exploits Remote Support Trust for Enterprise Access
Microsoft Threat Intelligence discovered a sophisticated social engineering campaign where threat actors impersonate IT support personnel through Microsoft Teams external collaboration to trick users into granting remote access. Once control is established via legitimate remote management tools, attackers deploy a malicious MSI package that stages a Node.js runtime and JavaScript implant for persistent command execution. The campaign progresses through extensive reconnaissance, Active Directory enumeration, and lateral movement via Windows Remote Management (WinRM) toward high-value assets including domain controllers, representing a precursor to ransomware deployment or data theft operations. This attack pattern demonstrates the evolving threat landscape where attackers leverage trusted enterprise collaboration platforms and legitimate administrative tools to bypass traditional security controls. The shift from commodity phishing to hands-on-keyboard operations targeting identity infrastructure reflects the increasing sophistication of modern threat actors seeking enterprise-wide access for high-impact cyberattacks.
1 week ago
Kill Chain
SANS Honeypot Captures Massive Automated Credential Attack Campaign
The SANS Internet Storm Center's Honeypot-Omaha deployment captured extensive automated credential attack campaigns targeting SSH and Telnet services. Threat actors from IP addresses associated with PPTECHNOLOGY LIMITED and other providers executed systematic brute-force attacks, successfully compromising honeypot systems through weak credentials. Once gaining access, attackers performed reconnaissance, system enumeration, and data exfiltration while attempting to cover their tracks using commands like 'rm -rf filter'. The analysis revealed over 400 file artifacts and multiple attack sessions showing coordinated botnet-style automation targeting vulnerable internet-facing services. This incident highlights the persistent threat landscape facing organizations with exposed SSH and Telnet services, demonstrating how attackers leverage automated tools and compromised infrastructure to systematically target weak authentication mechanisms across internet-connected systems.
1 week ago
Kill Chain
Critical Azure Privilege Escalation Flaw Exposes Hidden Risks in Cloud RBAC
In June 2026, NetSPI security researchers discovered a critical privilege escalation vulnerability in Microsoft Azure's Role-Based Access Control (RBAC) system. The vulnerability existed in the built-in 'Anyscale Platform Administrator Role' which contained unconstrained Microsoft.Authorization/roleAssignments/write permissions, allowing arbitrary escalation to Owner-level privileges without proper Attribute-Based Access Control (ABAC) restrictions. This finding highlighted broader security gaps in Azure's rapidly expanding attack surface, which now includes over 200 services, 897 built-in RBAC roles, and 22,018 different permissions. Microsoft addressed the issue within two weeks of disclosure by removing the problematic permissions from the affected role. This incident represents a critical trend in cloud security as organizations increasingly rely on complex cloud permission models that can contain hidden escalation paths, emphasizing the urgent need for granular permission auditing and zero-trust access controls in multi-cloud environments.
1 week ago
Kill Chain
AI-Powered Cyber Campaigns Expose New Threat Landscape in Latin America
Two sophisticated AI-enhanced cyber campaigns targeted organizations across Latin America in 2026, demonstrating how threat actors are integrating artificial intelligence into their attack workflows. The first campaign (CL-CRI-1131) targeted Mexican transportation companies and government entities using living-off-the-land techniques and self-hosted NextChat instances for AI assistance. The second campaign (CL-CRI-1163) focused on Brazilian financial institutions, employing custom remote access trojans and Go-based SOCKS5 proxies with AI-generated naming conventions. Both campaigns utilized commercial large language models like ChatGPT and Claude to overcome technical obstacles, generate exploit scripts, and streamline post-exploitation activities. Despite enhanced technical capabilities through AI integration, the attackers exposed their operations through poor operational security, including unsecured staging directories and publicly accessible NextChat interfaces. This represents a significant evolution in regional threat landscapes where diverse threat groups are independently adopting AI to accelerate their attack capabilities while maintaining fundamental security weaknesses that defenders can exploit.
1 week ago
Kill Chain
Inside the Lazarus Group's Fake IT Worker Employment Scam: A 2024 Investigation
Security researchers from ANY.RUN conducted an extensive investigation into North Korean IT worker infiltration schemes by creating a fake company to attract fraudulent job applicants. The study revealed sophisticated operations where Lazarus Group affiliates use stolen identities, AI-generated profile photos, and elaborate cover stories to secure remote positions at legitimate organizations. These fake employees then establish persistent access to corporate networks, potentially enabling data theft, intellectual property exfiltration, and deployment of malware while generating revenue for North Korean state operations. The investigation documented multiple phases of the scam including initial contact, identity verification circumvention, and operational security measures used by the infiltrators. This represents a significant evolution in state-sponsored cyber operations, blending traditional espionage with employment fraud to achieve long-term network access and financial gain for the DPRK regime.
1 week ago
Kill Chain
Historic Federal Detention: Maine Teen First Minor Charged in 764 Extremist Case
In December 2024, a 17-year-old from Maine became the first minor to be federally charged and detained for crimes related to involvement in 764, a nihilistic violent extremist collective. The teenager was convicted of multiple federal crimes including conspiracy to sexually exploit children, distributing child sexual abuse material, cyberstalking, and identity theft. This case represents a significant shift in federal law enforcement policy, as authorities have historically avoided prosecuting minors for extremist activities, creating what experts called a dangerous loophole that encouraged maximum harm before age 18. This prosecution signals law enforcement's evolved approach to addressing violent online extremism that increasingly targets and recruits minors. With the FBI investigating over 500 subjects nationwide connected to 764 and affiliated groups, this case establishes precedent for holding juvenile perpetrators accountable while disrupting recruitment strategies that exploit legal protections for minors.
1 week ago
Kill Chain
How Law Enforcement Finally Defeated the 23-Year Sality Botnet Empire
The Sality botnet, a Russia-based peer-to-peer malware operation that infected over 11 million devices during its 23-year lifespan, was successfully dismantled in January 2025 through a coordinated effort by CrowdStrike, law enforcement agencies, and the Shadowserver Foundation. The botnet's decentralized architecture, which historically made it resilient against takedown attempts, was ultimately exploited by researchers who manipulated its peer-to-peer communication system to permanently sever operator control. The operation involved domain seizures coordinated by the FBI, Justice Department, and European authorities, marking the end of one of the longest-running criminal botnets in cybersecurity history. This takedown demonstrates the evolving capabilities of law enforcement and private security firms to dismantle sophisticated peer-to-peer botnets, signaling a shift in the cybercrime landscape where even decentralized criminal infrastructure is no longer immune to coordinated disruption efforts.
1 week ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
