Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2749 to 2760 of 5988
Extradition of Xu Zewei: Unveiling the HAFNIUM Cyber Espionage Campaign
In early 2021, the Chinese state-sponsored threat group HAFNIUM exploited zero-day vulnerabilities in Microsoft Exchange Server to infiltrate approximately 13,000 U.S. organizations. The attackers targeted sectors including infectious disease research, law firms, universities, defense contractors, and policy think tanks, aiming to steal sensitive data such as COVID-19 vaccine research. The campaign involved deploying web shells for persistent remote access and exfiltrating data to external servers. ([cyberscoop.com](https://cyberscoop.com/xu-zewei-extradited-china-national-silk-typhoon-hafnium/?utm_source=openai)) On April 27, 2026, the U.S. Department of Justice announced the extradition of Xu Zewei from Italy to the United States. Xu, allegedly operating under the direction of China's Ministry of State Security, was charged with multiple offenses related to the HAFNIUM campaign. This development underscores the ongoing international efforts to hold cybercriminals accountable and highlights the persistent threat posed by nation-state actors targeting critical sectors. ([cyberscoop.com](https://cyberscoop.com/xu-zewei-extradited-china-national-silk-typhoon-hafnium/?utm_source=openai))
4 months ago
Kill Chain
Navigate360 P3 Global Intel Data Breach: A Wake-Up Call for Educational Cybersecurity
In March 2026, Navigate360's P3 Global Intel platform, an anonymous tip line used by over 30,000 schools and 5,000 public safety agencies, was reportedly breached by a hacker group known as Internet Yiff Machine. The attackers claimed to have exfiltrated approximately 93 gigabytes of data, including over 8 million law enforcement tips containing sensitive personally identifiable information (PII) of students and informants. This incident has raised significant concerns about the platform's security measures and the anonymity it promises to its users. The breach underscores the growing trend of cyberattacks targeting educational institutions, which have become increasingly frequent and sophisticated. The exposure of sensitive student data not only compromises individual privacy but also erodes trust in systems designed to enhance school safety. This incident highlights the urgent need for robust cybersecurity practices and compliance with data protection regulations within the education sector.
4 months ago
Kill Chain
Anthropic's Claude Mythos AI Model Unveils Thousands of Zero-Day Vulnerabilities
In April 2026, Anthropic unveiled Claude Mythos Preview, an advanced AI model capable of autonomously identifying and exploiting zero-day vulnerabilities across major operating systems and web browsers. This model discovered thousands of high-severity vulnerabilities, including a 27-year-old bug in OpenBSD, and demonstrated the ability to chain multiple flaws to bypass security mechanisms. Due to the potential risks associated with its capabilities, Anthropic restricted access to Mythos, providing it only to select industry partners under Project Glasswing to allow for remediation before broader release. The emergence of AI models like Claude Mythos signifies a paradigm shift in cybersecurity, where the speed and scale of vulnerability discovery and exploitation are dramatically increased. This development underscores the urgent need for organizations to enhance their defensive strategies, prioritize rapid patch management, and adopt AI-driven security solutions to keep pace with evolving threats.
4 months ago
Kill Chain
Analyzing GitHub's March 2026 RCE Vulnerability (CVE-2026-3854)
In March 2026, GitHub identified a critical remote code execution (RCE) vulnerability (CVE-2026-3854) affecting its platforms, including GitHub.com and GitHub Enterprise Server. The flaw allowed users with push access to execute arbitrary commands on the server during a git push operation by exploiting unsanitized push options. GitHub promptly validated the issue, deployed a fix within two hours, and confirmed no evidence of exploitation. This incident underscores the importance of rigorous input sanitization and rapid response mechanisms in mitigating supply chain vulnerabilities. As software supply chains grow increasingly complex, organizations must prioritize proactive security measures to prevent similar threats.
4 months ago
Kill Chain
VECT 2.0 Ransomware: A New Threat to Data Integrity
In April 2026, the VECT 2.0 ransomware emerged, targeting Windows, Linux, and ESXi systems. Due to a critical flaw in its encryption implementation, files larger than 131KB are irreversibly destroyed, rendering recovery impossible even for the attackers. This flaw effectively transforms VECT 2.0 into a data wiper rather than traditional ransomware. ([gixtools.net](https://gixtools.net/feeds/items/vect-2-0-ransomware-irreversibly-destroys-files-over-131kb-on-windows-linux-esxi/?utm_source=openai)) The incident underscores the evolving nature of cyber threats, where flawed ransomware can lead to permanent data loss. Organizations must prioritize robust backup strategies and incident response plans to mitigate such risks.
4 months ago
Kill Chain
Critical Vulnerability in Hugging Face's LeRobot Exposes Systems to Remote Code Execution
In April 2026, a critical vulnerability (CVE-2026-25874) was identified in Hugging Face's open-source robotics platform, LeRobot. This flaw, stemming from unsafe deserialization practices using Python's pickle module over unauthenticated gRPC channels, allows unauthenticated attackers to execute arbitrary code on both policy servers and robot clients. Exploitation can lead to full system compromise, data theft, and potential physical safety risks due to the nature of robotic operations. This incident underscores the persistent risks associated with deserializing untrusted data, especially in AI and robotics platforms. It highlights the necessity for secure coding practices, robust authentication mechanisms, and the importance of timely patching to mitigate such vulnerabilities.
4 months ago
Kill Chain
After Mythos: New Playbooks For a Zero-Window Era
In April 2026, Anthropic's AI model, Claude Mythos, autonomously identified thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability led to the formation of Project Glasswing, a collaborative initiative involving tech giants like Apple, Google, and JPMorgan Chase, aiming to patch vulnerabilities faster than AI can discover them. However, unauthorized access to Mythos raised significant security concerns, highlighting the potential risks of such powerful AI tools. ([anthropic.com](https://www.anthropic.com/glasswing?utm_source=openai)) The incident underscores the urgent need for robust security protocols in AI development and deployment. As AI models become more sophisticated, ensuring their secure use is paramount to prevent potential misuse and safeguard critical infrastructure.
4 months ago
Kill Chain
Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks
In April 2026, Chinese national Xu Zewei was extradited from Italy to the United States to face charges related to cyberattacks conducted between February 2020 and June 2021. Xu, allegedly operating under the direction of China's Ministry of State Security, targeted U.S. universities and organizations to steal COVID-19 research data. He exploited vulnerabilities in Microsoft Exchange Server, compromising thousands of systems worldwide. Xu was arrested in Milan in July 2025 and now faces multiple charges, including wire fraud and aggravated identity theft. ([justice.gov](https://www.justice.gov/opa/pr/prolific-chinese-state-sponsored-contract-hacker-extradited-italy?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber espionage, particularly in the context of global health crises. The extradition highlights international cooperation in combating cybercrime and the ongoing need for robust cybersecurity measures to protect sensitive research and infrastructure.
4 months ago
Kill Chain
Microsoft Entra ID Agent ID Administrator Role Privilege Escalation Vulnerability
In March 2026, a critical vulnerability was identified in Microsoft Entra ID's Agent ID Administrator role, designed to manage AI agent identities. This flaw allowed users with this role to take over arbitrary service principals by assigning themselves as owners and adding new credentials, potentially escalating privileges to the Global Administrator level. Microsoft addressed the issue by April 9, 2026, restricting the role's permissions to prevent such unauthorized access. This incident underscores the importance of stringent role scoping and continuous monitoring of privileged accounts to prevent similar security breaches in the future.
4 months ago
Kill Chain
UNC6692's 'Snow' Malware: A New Era of Social Engineering Attacks
In December 2025, the threat actor UNC6692 initiated a sophisticated attack combining social engineering, cloud service exploitation, and custom malware. The campaign began with a flood of spam emails to targets, followed by impersonation of IT helpdesk staff via Microsoft Teams. Victims were deceived into downloading a fake 'Mailbox Repair Utility,' which installed the 'Snow' malware suite, including Snowbelt, Snowglaze, and Snowbasin. This malware facilitated unauthorized access, credential theft, and lateral movement within enterprise networks. The attackers leveraged AWS S3 buckets for payload delivery and command-and-control infrastructure, effectively bypassing traditional security measures. ([darkreading.com](https://www.darkreading.com/cloud-security/unc6692-social-engineering-malware-cloud-abuse/?utm_source=openai)) This incident underscores the evolving tactics of cyber adversaries who exploit trusted cloud services and communication platforms to infiltrate organizations. The use of legitimate cloud infrastructure for malicious purposes highlights the need for enhanced monitoring of cloud-based activities and user education to recognize sophisticated social engineering attempts.
4 months ago
Kill Chain
GlassWorm Campaign Escalates with Malicious VS Code Extensions
In April 2026, the GlassWorm campaign escalated by deploying 73 malicious Visual Studio (VS) Code extensions on the Open VSX marketplace. These extensions, initially appearing benign, were later updated to deliver self-replicating malware, compromising developer environments and potentially poisoning the software supply chain. The malware utilized techniques such as external payload retrieval and bundled native binaries, acting as thin loaders to evade detection. This approach allowed attackers to access sensitive information, including source code, credentials, and internal systems, posing significant risks to organizations relying on these tools. The resurgence of GlassWorm highlights the evolving nature of supply chain attacks, emphasizing the need for continuous monitoring of software dependencies. Organizations must implement stringent security measures, such as verifying the authenticity of extensions, auditing installed tools for recent updates, and educating developers on the risks associated with third-party software. This incident underscores the critical importance of securing the software development lifecycle to prevent widespread compromise.
4 months ago
Kill Chain
Understanding the 2026 AWS Cognito Refresh Token Abuse Incident
In March 2026, AWS updated its Threat Technique Catalog to highlight a significant security concern: the abuse of Amazon Cognito refresh tokens. Threat actors have been exploiting long-lived refresh tokens to maintain unauthorized access to AWS environments. By obtaining a valid refresh token—through methods like credential theft or compromised client-side storage—attackers can continuously generate new access and ID tokens without re-authentication, effectively establishing a persistent foothold in the system. This technique allows them to operate undetected, as the legitimate user's session remains unaffected. The default lifespan of these tokens is 30 days, but they can be configured for up to 10 years, amplifying the potential risk. ([aws-samples.github.io](https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1098.A006.html?utm_source=openai)) This incident underscores the evolving tactics of cyber adversaries who leverage legitimate cloud service functionalities to evade detection. Organizations must reassess their security postures, particularly concerning token management and monitoring, to mitigate such stealthy persistence mechanisms.
4 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
