STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 265 to 276 of 6832 threat reports

Financial Services1 week ago

REF8801: How a Fake Web3 Accelerator Turned npm Packages Into an AI Agent Spy Operation

In October 2026, Elastic Security Labs uncovered REF8801, a threat operation posing as a Web3 venture capital accelerator called Apex Accelerator. The campaign published malicious npm packages—@apexacc/cli and @apexacc/audit—targeting cryptocurrency founders and developers with promises of AI credits, coding tools, and smart contract audits. Once installed, the packages deployed the CloudSyncD macOS backdoor and a custom Windows infostealer exfiltrating data via Telegram, while simultaneously hijacking victims' AI agent traffic by redirecting OpenRouter LLM requests through attacker-controlled infrastructure and registering rogue MCP servers to intercept prompts, code snippets, and conversation history. This campaign reflects a sharp escalation in supply-chain threats targeting the intersection of Web3 and agentic AI ecosystems. As developers increasingly embed LLM-powered agents into workflows, attackers are pivoting from credential theft alone to compromising the AI control plane itself—silently reshaping agent behavior, poisoning prompt context, and exfiltrating proprietary code and conversation data at scale.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

$Rank Math PRO Hijacked: How a Trusted WordPress Plugin Update Channel Became a Self-Restoring Backdoor$

Internet1 week ago

Rank Math PRO Hijacked: How a Trusted WordPress Plugin Update Channel Became a Self-Restoring Backdoor

Between 20:02 UTC on October 15 and 07:12 UTC on October 16, 2026, attackers compromised Rank Math's own distribution infrastructure and replaced legitimate downloads and auto-updates of the paid Rank Math PRO WordPress SEO plugin (v3.0.123) with a malware-laced build. Any site that installed and activated the tainted copy should be treated as fully compromised. The malware (CVE-2026-111862, CVSS 9.8) installs a self-restoring PHP backdoor, drops rogue admin accounts, adds SSH keys, modifies .htaccess to execute .cache files as PHP, plants scheduled tasks, and exfiltrates credentials to the attacker-controlled domain rank1cdn[.]com—registered roughly 24 hours before the attack window opened. This incident is the third confirmed case in 2026 of a premium WordPress plugin vendor's update channel being weaponized to deliver backdoored builds, following similar attacks on Smart Slider 3 Pro in April and ShapedPlugin Pro plugins in June. The pattern signals a deliberate, escalating campaign targeting the supply chains of commercial WordPress ecosystems, where millions of sites silently auto-update from vendor-controlled servers outside the scrutiny of WordPress.org's checksum infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT1 week ago

Plex2Shell: How a Four-CVE Chain Turned Media Servers Into Crypto Mines and Proxy Nodes

In October 2026, threat actors began actively exploiting a chained set of four vulnerabilities in Plex Media Server—collectively dubbed Plex2Shell—to achieve unauthenticated remote code execution. The attack chain, involving CVEs 2026-96652, 96654, 96655, and 96656, was weaponized within 24 hours of a public proof-of-concept release on October 16, 2026. Attackers deployed the XMRig-based cryptominer 'mylovelyminer' and a stealthy Linux reverse proxy backdoor named 'myawesomeproxy,' both linked to the AISURU proxyware botnet infrastructure. Plex had patched the flaws in version 1.43.3.10861 released August 3, 2026, but unpatched internet-exposed instances remained vulnerable. This incident underscores the persistent danger of n-day exploitation windows—where attackers race to compromise unpatched systems immediately after PoC publication. The connection to the AISURU botnet signals organized, infrastructure-backed campaigns targeting self-hosted media platforms to harvest compute resources and build covert proxy networks for downstream attacks.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(high)

Read report

Computer Software/Engineering1 week ago

GhostAction's Font File Trick: How a Fake Woff2 Asset Stole Secrets from 94 GitHub Repos

In October 2026, the GhostAction threat actor escalated a supply-chain campaign by registering the phishing domain my-github[.]com and deploying a reverse-proxy kit that silently harvested GitHub credentials and 2FA codes, then stealthily authorized OAuth tokens with repo and workflow write permissions. The actor embedded a credential stealer inside a fake font file (fa-solid-400.woff2) committed to 94 repositories across 66 owners, using a VS Code tasks.json runOn:folderOpen trigger to persist on developer machines entirely outside GitHub's runner controls. The stealer harvested AWS keys, PyPI and npm tokens, Kubernetes credentials, SSH private keys, and AI provider secrets, exfiltrating everything over plain HTTP to a single attacker-controlled IP. This incident illustrates a maturing supply-chain playbook in which attackers combine OAuth device-code phishing, IDE auto-execution abuse, and stealer malware disguised as legitimate assets to survive platform-level mitigations. As open-source ecosystems grow more interconnected, a single compromised maintainer account can cascade stolen secrets across thousands of downstream consumers, amplifying both blast radius and regulatory exposure.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Banking/Mortgage1 week ago

TAG-217 and ARTEX: How AI-Powered Attackers Breached Seven South Korean Banks

In October 2026, threat actor TAG-217 executed a multi-institution cyberattack against at least seven South Korean financial organizations, exposing personal data of approximately 68,000 individuals. Preparations began as early as August 2026, with the actor assembling tools leveraging the open-source AI penetration testing framework ARTEX alongside multiple AI platforms including Claude Code, DeepSeek, Grok, and Zhipu AI. TAG-217, assessed as a Chinese-speaking operator, exploited AI-assisted automation to opportunistically probe systems at scale across diverse targets, using residential proxies to obscure origin. Compromised data included customer records and outsourced developer personal information. This incident marks a significant inflection point in AI-enabled offensive operations. The use of open-source AI pentesting frameworks lowers the barrier for sophisticated, multi-target financial sector intrusions. As agentic attack tooling becomes commoditized, defenders face campaigns that are faster, broader, and harder to attribute—making cloud network segmentation, egress controls, and behavioral anomaly detection essential countermeasures.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Computer/Network Security1 week ago

Inside the ShinyHunters Betrayal: When Your Ransomware Negotiator Works for the Attacker

In October 2026, U.S. federal investigators revealed that executives at two ransomware negotiation firms maintained covert operational ties to ShinyHunters, a prolific extortion group responsible for over $70 million in victim payments that year. One U.S.-based consultant allegedly helped operate Shinywire, the group's victim-shaming extortion portal, while Canadian executive Edward Dubrovsky was arrested for threatening to disclose stolen data and interfering with commerce through extortion. Signal messages recovered during the Dutch arrest of ShinyHunters suspect Pepijn van der Stap exposed that negotiators knew of breaches—including the FBI jobs site hack—before victims were notified, revealing a systemic corruption of the incident response supply chain. This case exposes a structural flaw at the heart of the cyber extortion ecosystem: ransomware negotiators incentivized by percentage-based fees on ransom payments have a financial interest in ensuring victims pay—and pay more. As regulators and insurers scrutinize negotiator conflicts of interest, organizations must question whether their incident response partners are working for them or against them.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering1 week ago

Fake Claude & ChatGPT Campaigns Are Targeting Your Developers Right Now

Between April and October 2026, threat actors launched over 1,258 documented campaigns impersonating popular AI brands including Anthropic's Claude and OpenAI's ChatGPT to target enterprise developers and marketing professionals. Attackers leveraged SEO poisoning, malicious ads, fake GitHub-hosted CLI installers, and ClickFix-style social engineering to trick employees into running malicious terminal commands or pasting payloads into their systems. Successful compromises resulted in the theft of source code, SSH keys, CI/CD tokens, cloud API credentials, and active business session cookies—turning a single user action into broad organizational exposure including financial loss and supply chain risk. These campaigns reflect a rapidly maturing social engineering playbook that weaponizes the AI adoption wave. As enterprises push employees to integrate AI tooling into daily workflows, attackers exploit the resulting trust and urgency. The combination of legitimate hosting infrastructure (Claude.ai, ChatGPT domains, Cloudflare Pages, GitHub) with ClickFix and InstallFix tactics makes detection extremely difficult and signals a durable, escalating threat to developer-heavy organizations.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Information Technology/IT1 week ago

BYOVD and EDR Killers: Four Kill-Chain Variants, Four Hunts—Before Ransomware Encrypts Your Files

Bring Your Own Vulnerable Driver (BYOVD) attacks have become a cornerstone technique enabling ransomware groups such as RansomHub, Black Basta, Kasseika, BlackByte, and LockBit to neutralize endpoint detection and response (EDR) tools before deploying encryption. Attackers load legitimately signed but flawed kernel drivers—exploiting the gap between Microsoft's driver-signing trust model and its incomplete blocklist enforcement—to issue process-termination IOCTLs that kill security agents at Ring 0, bypassing Protected Process Light entirely. The commoditization of purpose-built EDR killers like AvNeutralizer (AuKill) and EDRKillShifter, sold on Russian-language forums for $4,000–$15,000 and distributed through ransomware affiliate programs, has industrialized what was once a sophisticated capability into a repeatable checklist item available to any affiliate operator. The BYOVD threat is no longer a niche kernel-exploitation concern—it is the standard pre-ransomware preparation step across multiple major threat actor ecosystems. With tooling commoditized, affiliate programs distributing EDR killers at scale, and four distinct kill-chain variants (BYOVD, BYOI, admin-to-kernel, and driverless suspension) each evading single-technique detection rules, organizations that rely on endpoint security alone face a widening, often invisible coverage gap that precedes every encryption event.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(high)

Read report

Defense/Space2 weeks ago

Major Cybersecurity Incidents Rock Week 40: Pentagon Breach, KillSec Takedown, and $387M Crypto Heist

Week 40 of 2026 witnessed three major cybersecurity incidents highlighting persistent threats across government, cryptocurrency, and organized cybercrime sectors. The Pentagon's Defense Manpower Data Center suffered a breach exposing personal data of 3 million military personnel and veterans, including Social Security numbers and military records, discovered in July 2026 but ongoing since October 2025. Simultaneously, North Korean state-sponsored hackers exploited third-party zero-day vulnerabilities to steal $387 million from Bitget cryptocurrency exchange, while international law enforcement successfully dismantled the KillSec ransomware operation, arresting key members including a 16-year-old administrator. These incidents demonstrate the convergence of nation-state attacks targeting critical infrastructure, the evolving sophistication of cryptocurrency heists, and the increasing involvement of younger cybercriminals in ransomware operations, underscoring the need for enhanced zero-trust security frameworks and international cybercrime cooperation.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT2 weeks ago

CVE-2026-21589: Atlassian Data Center Under Siege as Exploits Hit Within Hours

Threat actors are actively exploiting CVE-2026-21589, a critical vulnerability in Atlassian Data Center products including Bitbucket, Confluence, and Jira, within two hours of public proof-of-concept release. The flaw allows unauthenticated attackers to access sensitive configuration files through path traversal sequences, potentially exposing administrative credentials and enabling privilege escalation. Multiple enterprises running unpatched Atlassian instances face immediate risk of unauthorized access and data compromise. This incident demonstrates the accelerating timeline between vulnerability disclosure and active exploitation, highlighting the critical importance of rapid patch deployment and network segmentation for enterprise applications exposed to the internet.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(low)

Read report

Computer Software/Engineering2 weeks ago

SneakPeek Vulnerability Exposes Critical AI Development Tool Security Gaps

In July 2026, security researchers at Noma disclosed a high-severity vulnerability dubbed 'SneakPeek' in Anthropic's Claude Code Desktop application. The zero-click vulnerability exploited flaws in the automated preview pane's sandbox architecture, allowing attackers to silently exfiltrate sensitive developer credentials including SSH private keys, AWS tokens, and OAuth credentials. By placing malicious HTML files larger than 256KB in public repositories, attackers could trigger automatic code execution when developers used Claude to review files, bypassing all sandbox protections through missing content security policies and unrestricted origin access. This incident highlights the growing security risks in AI-powered development tools as organizations increasingly integrate autonomous AI agents into critical workflows. The vulnerability required two separate patches after researchers bypassed the initial fix, demonstrating the complexity of securing AI applications and the need for comprehensive runtime protection beyond vendor-provided security baselines.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services2 weeks ago

The Industrialization of BYOVD: How Ransomware Turned EDR Killing Into Big Business

Bring Your Own Vulnerable Driver (BYOVD) attacks have evolved from isolated tactics into an industrialized supply chain serving ransomware operators. Research shows attackers successfully disabled security tools in 48% of intrusions in 2024, with BYOVD emerging as the fastest-growing method. What began as custom one-off binaries has transformed into a mature marketplace, with tools like AvNeutralizer selling for $4,000-$15,000 and spreading across multiple ransomware families including Black Basta, LockBit, and RansomHub. The technique leverages thousands of vulnerable signed drivers to achieve kernel-level access and terminate EDR processes, with some attack chains reaching SYSTEM privileges in just 30 milliseconds. This industrialization has dramatically lowered the skill barrier for ransomware affiliates while increasing attack success rates. The threat landscape now features maintained toolkits, versioned releases, and tiered affiliate access models that mirror legitimate software development practices, making BYOVD a structural threat to enterprise security defenses.

Medium impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

1...21 22 23 24 25...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

REF8801: How a Fake Web3 Accelerator Turned npm Packages Into an AI Agent Spy Operation

Rank Math PRO Hijacked: How a Trusted WordPress Plugin Update Channel Became a Self-Restoring Backdoor

Plex2Shell: How a Four-CVE Chain Turned Media Servers Into Crypto Mines and Proxy Nodes

GhostAction's Font File Trick: How a Fake Woff2 Asset Stole Secrets from 94 GitHub Repos

TAG-217 and ARTEX: How AI-Powered Attackers Breached Seven South Korean Banks

Inside the ShinyHunters Betrayal: When Your Ransomware Negotiator Works for the Attacker

Fake Claude & ChatGPT Campaigns Are Targeting Your Developers Right Now

BYOVD and EDR Killers: Four Kill-Chain Variants, Four Hunts—Before Ransomware Encrypts Your Files

Major Cybersecurity Incidents Rock Week 40: Pentagon Breach, KillSec Takedown, and $387M Crypto Heist

CVE-2026-21589: Atlassian Data Center Under Siege as Exploits Hit Within Hours

SneakPeek Vulnerability Exposes Critical AI Development Tool Security Gaps

The Industrialization of BYOVD: How Ransomware Turned EDR Killing Into Big Business

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

REF8801: How a Fake Web3 Accelerator Turned npm Packages Into an AI Agent Spy Operation

Rank Math PRO Hijacked: How a Trusted WordPress Plugin Update Channel Became a Self-Restoring Backdoor

Plex2Shell: How a Four-CVE Chain Turned Media Servers Into Crypto Mines and Proxy Nodes

GhostAction's Font File Trick: How a Fake Woff2 Asset Stole Secrets from 94 GitHub Repos

TAG-217 and ARTEX: How AI-Powered Attackers Breached Seven South Korean Banks

Inside the ShinyHunters Betrayal: When Your Ransomware Negotiator Works for the Attacker

Fake Claude & ChatGPT Campaigns Are Targeting Your Developers Right Now

BYOVD and EDR Killers: Four Kill-Chain Variants, Four Hunts—Before Ransomware Encrypts Your Files

Major Cybersecurity Incidents Rock Week 40: Pentagon Breach, KillSec Takedown, and $387M Crypto Heist

CVE-2026-21589: Atlassian Data Center Under Siege as Exploits Hit Within Hours

SneakPeek Vulnerability Exposes Critical AI Development Tool Security Gaps

The Industrialization of BYOVD: How Ransomware Turned EDR Killing Into Big Business

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?