Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 2857 to 2868 of 5988
Scattered Spider Leader Pleads Guilty to Multi-Million Dollar Crypto Theft
In April 2026, Tyler Robert Buchanan, a British national and alleged leader of the Scattered Spider cybercrime group, pleaded guilty in the United States to charges of wire fraud and aggravated identity theft. Between September 2021 and April 2023, Buchanan and his co-conspirators executed SMS phishing attacks targeting employees of various companies across industries such as entertainment, telecommunications, and technology. By impersonating legitimate entities, they obtained confidential information, enabling them to hijack email accounts through SIM swapping and steal over $8 million in cryptocurrency. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/british-scattered-spider-hacker-pleads-guilty-to-crypto-theft-charges/?utm_source=openai)) This case underscores the persistent threat posed by sophisticated social engineering tactics employed by cybercriminal groups like Scattered Spider. Organizations must remain vigilant against such methods, as the group's activities have led to significant financial losses and operational disruptions across multiple sectors. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-shares-tactics-of-notorious-scattered-spider-hacker-collective/?utm_source=openai))
5 months ago
Kill Chain
Surge in Microsoft Teams Helpdesk Impersonation Attacks in 2026
In April 2026, Microsoft reported a surge in cyberattacks where threat actors impersonated IT helpdesk personnel via Microsoft Teams. These attackers initiated cross-tenant chats, convincing employees to grant remote access under the guise of resolving account issues or performing security updates. Utilizing legitimate tools like Quick Assist and Rclone, they conducted reconnaissance, moved laterally across networks, and exfiltrated sensitive data to external cloud storage, effectively blending malicious activities with routine IT operations. This incident underscores a significant shift in cyberattack strategies, highlighting the exploitation of trusted collaboration platforms for social engineering. The increasing sophistication of such attacks necessitates heightened vigilance and robust security measures to protect against unauthorized access and data breaches.
5 months ago
Kill Chain
Seiko USA Website Defaced: Hackers Claim Customer Data Theft
In April 2026, Seiko USA's website was defaced by attackers who claimed to have breached the company's Shopify backend, exfiltrating sensitive customer data including names, email addresses, phone numbers, order histories, and shipping information. The attackers demanded a ransom, threatening to publicly release the stolen data if their demands were not met. Seiko USA has not publicly confirmed the breach, and the defaced content has since been removed from the website. This incident underscores the growing trend of cybercriminals targeting e-commerce platforms to access customer data, highlighting the critical need for robust security measures and prompt incident response strategies to protect sensitive information and maintain customer trust.
5 months ago
Kill Chain
Gentlemen Ransomware's Strategic Use of SystemBC Botnet in April 2026
In April 2026, the Gentlemen ransomware-as-a-service (RaaS) operation was found to be utilizing the SystemBC proxy malware to enhance its attack capabilities. This collaboration led to the creation of a botnet comprising over 1,570 compromised hosts, primarily targeting corporate environments. The attackers gained initial access, escalated privileges to Domain Admin, and deployed Cobalt Strike payloads for lateral movement. They then used SystemBC to establish covert command-and-control channels, facilitating the deployment of ransomware payloads across the network. This sophisticated attack chain resulted in significant operational disruptions and data encryption for the affected organizations. The integration of SystemBC into ransomware operations signifies a concerning evolution in cybercriminal tactics, emphasizing the need for organizations to bolster their defenses against such multifaceted threats. The incident underscores the importance of comprehensive security measures, including network segmentation, regular patching, and advanced threat detection systems, to mitigate the risks posed by increasingly sophisticated ransomware campaigns.
5 months ago
Kill Chain
FakeWallet Campaign: Crypto-Stealing Apps Infiltrate China's Apple App Store
In April 2026, a campaign named 'FakeWallet' was discovered, involving 26 malicious applications on China's Apple App Store that impersonated popular cryptocurrency wallets like Metamask, Coinbase, Trust Wallet, and OneKey. These apps were designed to steal users' recovery or seed phrases, enabling attackers to drain cryptocurrency assets. The threat actors employed typosquatting and fake branding to deceive users into downloading these apps, which were disguised as games or calculator applications to circumvent regional restrictions. Upon installation, the apps redirected users to phishing sites that mimicked legitimate crypto services, prompting them to download trojanized wallet apps via iOS provisioning profiles. These malicious apps intercepted mnemonic phrases during wallet setup or recovery processes, encrypted them, and transmitted the data to the attackers, facilitating unauthorized access to victims' cryptocurrency funds. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinas-apple-app-store-infiltrated-by-crypto-stealing-wallet-apps/?utm_source=openai)) This incident underscores a growing trend of sophisticated cyber threats targeting cryptocurrency users through official app stores, highlighting the need for enhanced vigilance and security measures. The use of legitimate enterprise features like iOS provisioning profiles for malicious purposes indicates an evolution in attack vectors, emphasizing the importance of continuous monitoring and user education to mitigate such risks.
5 months ago
Kill Chain
KelpDAO's $290 Million DeFi Breach: A Wake-Up Call for Cross-Chain Security
In April 2026, KelpDAO, a decentralized finance (DeFi) platform, suffered a significant security breach resulting in the theft of approximately $290 million worth of rsETH tokens. The attackers exploited vulnerabilities in KelpDAO's cross-chain bridge, specifically targeting the verification layer by compromising remote procedure call (RPC) nodes. This manipulation allowed them to forge cross-chain messages and illicitly transfer funds. Preliminary investigations attribute the attack to North Korea's state-sponsored Lazarus Group, known for sophisticated cyber operations targeting financial institutions. This incident underscores the critical importance of robust security configurations in DeFi platforms, particularly concerning cross-chain interoperability. The reliance on a single-verifier setup without redundancy exposed KelpDAO to this exploit. As DeFi continues to evolve, ensuring multi-layered security measures and adhering to best practices in system architecture are imperative to mitigate such risks.
5 months ago
Kill Chain
FakeWallet Crypto Stealer: A New Threat in the Apple App Store
In March 2026, over twenty phishing apps masquerading as popular cryptocurrency wallets were discovered on the Apple App Store. These malicious applications redirected users to browser pages resembling the App Store, distributing trojanized versions of legitimate wallets designed to steal recovery phrases and private keys. Metadata indicates this campaign has been active since at least late 2025. ([securelist.com](https://securelist.com/fakewallet-cryptostealer-ios-app-store/119482/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals targeting cryptocurrency users, highlighting the need for enhanced vigilance and security measures within app marketplaces to prevent such deceptive practices.
5 months ago
Kill Chain
Critical RCE Vulnerability in SGLang via Malicious GGUF Model Files
In April 2026, a critical vulnerability (CVE-2026-5760) was identified in SGLang, an open-source framework for serving large language models. The flaw resides in the reranking endpoint (/v1/rerank), where unsandboxed Jinja2 template rendering allows remote code execution (RCE) when processing malicious GPT-Generated Unified Format (GGUF) model files. Exploitation enables attackers to execute arbitrary code on the server, potentially leading to data exfiltration, system manipulation, or denial-of-service attacks. ([kb.cert.org](https://kb.cert.org/vuls/id/915947?utm_source=openai)) This incident underscores the importance of secure template rendering practices in AI model serving frameworks. Organizations utilizing SGLang should promptly update to a patched version and implement recommended mitigations to prevent exploitation. ([thehackernews.com](https://thehackernews.com/2026/04/sglang-cve-2026-5760-cvss-98-enables.html?utm_source=openai))
5 months ago
Kill Chain
WhatsApp Metadata Leak Raises Privacy Concerns
In early 2026, security researcher Tal Be'ery uncovered vulnerabilities in WhatsApp's multi-device encryption protocol that allowed attackers to infer user metadata, including device operating systems and online status, without user interaction. This flaw enabled potential adversaries to perform device fingerprinting, facilitating targeted malware attacks. Meta, WhatsApp's parent company, began rolling out fixes in January 2026 to address these issues, but challenges in fully masking device signatures persist. ([darkreading.com](https://www.darkreading.com/endpoint-security/whatsapp-leaks-user-metadata?utm_source=openai)) This incident underscores the critical importance of securing metadata in encrypted communications. As messaging platforms expand their features, ensuring comprehensive privacy protections becomes increasingly complex, highlighting the need for continuous security assessments and prompt remediation of identified vulnerabilities.
5 months ago
Kill Chain
ZionSiphon Malware: A New Threat to Israeli Water Infrastructure
In April 2026, cybersecurity researchers identified a new malware strain named ZionSiphon, specifically engineered to target Israeli water treatment and desalination systems. The malware exhibits capabilities such as establishing persistence, modifying local configuration files, and scanning for operational technology (OT) services within local networks. Notably, ZionSiphon is designed to operate exclusively within Israeli IP address ranges and targets processes associated with water treatment operations, including chlorine dosing and pressure control systems. While the current version contains a flaw that prevents full execution, its architecture indicates a significant advancement in OT-targeted cyber threats. ([thehackernews.com](https://thehackernews.com/2026/04/researchers-detect-zionsiphon-malware.html?utm_source=openai)) This discovery underscores a growing trend of politically motivated cyberattacks aimed at critical infrastructure. The emergence of ZionSiphon highlights the increasing sophistication of threats targeting OT environments, emphasizing the need for enhanced security measures to protect essential services from potential sabotage.
5 months ago
Kill Chain
Anthropic MCP Design Flaw Enables Remote Code Execution
In April 2026, security researchers identified a critical design flaw in Anthropic's Model Context Protocol (MCP) that enables remote code execution (RCE) across systems utilizing vulnerable MCP implementations. This systemic vulnerability affects over 7,000 publicly accessible servers and software packages with more than 150 million downloads. The flaw arises from unsafe defaults in MCP's configuration over the STDIO transport interface, allowing attackers to execute arbitrary OS commands and access sensitive data. Despite the disclosure of multiple CVEs, including CVE-2025-49596 and CVE-2026-22252, Anthropic has stated that the protocol's behavior is "expected," leaving the core issue unaddressed. ([thehackernews.com](https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html?utm_source=openai)) This incident underscores the escalating risks within the AI supply chain, as AI-powered integrations inadvertently expand the attack surface. Organizations are advised to implement mitigations such as blocking public IP access to sensitive services, monitoring MCP tool invocations, running MCP-enabled services in a sandbox, treating external MCP configuration input as untrusted, and installing MCP servers only from verified sources. ([thehackernews.com](https://thehackernews.com/2026/04/anthropic-mcp-design-vulnerability.html?utm_source=openai))
5 months ago
Kill Chain
Vercel's 2026 Security Breach: Lessons in Third-Party Integration Risks
In April 2026, Vercel, a prominent web infrastructure provider, experienced a security breach originating from a compromised third-party AI tool, Context.ai. An attacker exploited this vulnerability to gain unauthorized access to a Vercel employee's Google Workspace account, subsequently infiltrating Vercel's internal systems. This intrusion led to the exposure of certain environment variables not marked as 'sensitive,' potentially affecting a limited subset of customers. Vercel has since engaged incident response experts and notified law enforcement to address the situation. ([vercel.com](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident?utm_source=openai)) This incident underscores the escalating risks associated with third-party integrations and the necessity for robust security measures. The breach highlights the importance of vigilant monitoring and management of OAuth applications to prevent unauthorized access and protect sensitive data.
5 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
