Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3025 to 3036 of 5988
Cisco's 2026 Trivy Supply Chain Breach: A Wake-Up Call for Development Security
In March 2026, Cisco's internal development environment was breached through a sophisticated supply chain attack involving the Trivy vulnerability scanner. Threat actors, identified as TeamPCP, compromised Trivy's GitHub Actions pipeline, injecting credential-stealing malware into official releases. This allowed them to harvest credentials from organizations using Trivy, including Cisco. Leveraging these stolen credentials, the attackers infiltrated Cisco's build systems and developer workstations, exfiltrating over 300 private GitHub repositories containing source code for AI-powered products and unreleased items. Additionally, customer repositories belonging to banks, business process outsourcing firms, and U.S. government agencies were among those exfiltrated. AWS keys were also stolen and used for unauthorized activities across Cisco's cloud accounts. Cisco has since isolated affected systems, initiated reimaging, and is performing wide-scale credential rotation to contain the breach. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisco-source-code-stolen-in-trivy-linked-dev-environment-breach/?utm_source=openai)) This incident underscores the escalating threat posed by supply chain attacks, where compromising a widely-used tool can have cascading effects across multiple organizations. The breach highlights the critical need for organizations to scrutinize the security of third-party tools integrated into their development pipelines and to implement robust monitoring and incident response strategies to detect and mitigate such sophisticated attacks.
5 months ago
Kill Chain
Critical Vulnerability in GPL Odorizers GPL750 Devices (CVE-2026-4436)
In April 2026, a critical vulnerability (CVE-2026-4436) was identified in GPL Odorizers' GPL750 devices, which are used for odorant injection in natural gas pipelines. This flaw allows low-privileged remote attackers to manipulate register values via Modbus packets, potentially leading to incorrect odorant levels being injected into gas lines. Affected versions include GPL750 (XL4) >=v1.0, GPL750 (XL4 Prime) >=v4.0, GPL750 (XL7) >=v13.0, and GPL750 (XL7 Prime) >=v18.4. The vulnerability has a CVSS v3 base score of 8.6, indicating high severity. ([gasodorizer.com](https://www.gasodorizer.com/odorization/gpl-750-odorant-injection/?utm_source=openai)) The exploitation of this vulnerability could result in significant safety hazards due to improper odorization of natural gas, which is essential for leak detection. Organizations using these devices are urged to update to the latest software versions and implement recommended mitigations to prevent potential exploitation. ([gasodorizer.com](https://www.gasodorizer.com/odorization/gpl-750-odorant-injection/?utm_source=openai))
5 months ago
Kill Chain
Critical Vulnerability in Contemporary Controls BASC-20T Puts Industrial Systems at Risk
In April 2026, a critical vulnerability (CVE-2025-13926) was identified in Contemporary Controls' BASC-20T unitary controller, widely used in industrial control systems. This flaw allows attackers to intercept and manipulate network traffic, enabling unauthorized actions such as reconfiguring devices, renaming or deleting files, performing file transfers, and executing remote procedure calls. The vulnerability affects BASControl20 version 3.1 and poses significant risks to sectors like commercial facilities, critical manufacturing, and energy. ([building-controls.com](https://www.building-controls.com/products/ccs-basc20t?utm_source=openai)) This incident underscores the escalating threats to industrial control systems, with a notable increase in vulnerabilities and attacks targeting operational technology environments. Organizations must prioritize securing legacy systems, implementing robust network segmentation, and ensuring timely updates to mitigate such risks. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/industrial-control-system-vulns/?utm_source=openai))
5 months ago
Kill Chain
EngageLab SDK Vulnerability: A Wake-Up Call for Android Developers
In April 2025, a critical intent redirection vulnerability was discovered in the EngageLab SDK, a widely used third-party Android library for managing messaging and push notifications. This flaw allowed malicious applications to exploit the SDK's exported activity, MTCommonActivity, to gain unauthorized access to private data by bypassing Android's security mechanisms. The vulnerability affected numerous applications, including cryptocurrency wallets, with over 30 million installations, exposing sensitive user information to potential risk. EngageLab addressed the issue by releasing version 5.2.1 on November 3, 2025, which set the vulnerable activity to non-exported, mitigating the risk. This incident underscores the significant security implications of vulnerabilities in third-party SDKs, especially in high-value sectors like digital asset management. It highlights the necessity for developers to rigorously review and monitor third-party components integrated into their applications to prevent similar security breaches.
5 months ago
Kill Chain
Storm-2755: Unveiling the 2026 Payroll Pirate AiTM Attack in Canada
In April 2026, a financially motivated threat actor identified as Storm-2755 targeted Canadian employees through a sophisticated 'payroll pirate' campaign. Utilizing adversary-in-the-middle (AiTM) phishing techniques, the attackers intercepted authentication sessions to gain unauthorized access to employee profiles on HR platforms. This access enabled them to divert salary payments to accounts under their control, resulting in direct financial losses for both individuals and organizations. The campaign was notable for its use of malvertising and search engine optimization (SEO) poisoning to lure victims to malicious sites, effectively bypassing traditional multi-factor authentication (MFA) methods. This incident underscores the evolving nature of cyber threats, particularly the increasing prevalence of AiTM attacks that can circumvent standard MFA protections. Organizations must recognize the limitations of traditional security measures and adopt more robust, phishing-resistant authentication methods to safeguard against such sophisticated attacks.
5 months ago
Kill Chain
Anthropic's Claude Mythos AI: A Game-Changer in Cybersecurity
In March 2026, Anthropic's AI model, Claude Mythos, identified thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented discovery included a 27-year-old bug in OpenBSD and a critical flaw in FFmpeg. Due to the model's potential for misuse, Anthropic restricted access to select organizations under Project Glasswing to facilitate responsible vulnerability remediation. ([techcrunch.com](https://techcrunch.com/2026/04/07/anthropic-mythos-ai-model-preview-security/?utm_source=openai)) The incident underscores the dual-use nature of advanced AI in cybersecurity, highlighting the need for stringent access controls and collaborative efforts to mitigate risks associated with powerful AI tools.
5 months ago
Kill Chain
AWS AgentCore IAM God Mode Vulnerability Exposes Critical Security Risks
In April 2026, a security analysis revealed that the Amazon Bedrock AgentCore Starter Toolkit's default IAM roles granted overly permissive access, allowing AI agents to perform actions across all resources within an AWS account. This misconfiguration enabled potential attackers to exfiltrate proprietary ECR images, access other agents' memories, invoke code interpreters, and extract sensitive data. The issue stemmed from the toolkit's auto-create logic, which favored deployment ease over the principle of least privilege. Following disclosure, AWS updated its documentation to warn users that the default roles are intended for development and testing purposes only and are not recommended for production deployments. This incident underscores the critical importance of adhering to the principle of least privilege in IAM configurations, especially as organizations increasingly deploy AI agents in cloud environments. Overly permissive roles can lead to significant security risks, including data breaches and unauthorized access to sensitive resources.
5 months ago
Kill Chain
Unveiling the 2023-2024 Hack-for-Hire Campaign Targeting Journalists in MENA
Between 2023 and 2024, a sophisticated hack-for-hire campaign targeted journalists and activists in the Middle East and North Africa, notably in Egypt and Lebanon. The attackers employed spear-phishing techniques, sending messages that appeared to be from legitimate sources to deceive victims into revealing personal data, including credentials and financial information. This campaign has been linked to the Bitter APT group, known for targeting government and critical infrastructure sectors across South Asia. The operation underscores the persistent threat posed by state-sponsored cyber espionage groups utilizing advanced social engineering tactics to infiltrate and compromise sensitive information. ([accessnow.org](https://www.accessnow.org/press-release/hack-for-hire-new-report-egyptian-journalists/?utm_source=openai))
5 months ago
Kill Chain
Critical RCE Vulnerability Discovered in Apache ActiveMQ Classic
In April 2026, a critical remote code execution (RCE) vulnerability, CVE-2026-34197, was discovered in Apache ActiveMQ Classic, a widely used open-source message broker. This flaw, present for over 13 years, allows authenticated attackers to execute arbitrary commands on the broker's Java Virtual Machine (JVM) by exploiting the Jolokia JMX-HTTP bridge. The vulnerability affects versions before 5.19.4 and from 6.0.0 up to 6.2.3. Exploitation involves sending a crafted request that forces the broker to load a remote Spring XML file, leading to command execution during its initialization. The discovery underscores the importance of proactive vulnerability management and the potential of AI tools in identifying complex security flaws. Organizations using affected ActiveMQ versions are urged to upgrade to versions 5.19.5 or 6.2.3 to mitigate this risk. ([ubuntu.com](https://ubuntu.com/security/CVE-2026-34197?utm_source=openai))
5 months ago
Kill Chain
New macOS Malware Campaign Exploits Script Editor in ClickFix Attack
In April 2026, a new macOS malware campaign emerged, leveraging the Script Editor application to deliver the Atomic Stealer (AMOS) malware. Attackers employed a variation of the ClickFix technique, directing users to malicious websites that prompted them to open Script Editor via the 'applescript://' URL scheme. This method executed obfuscated commands to download and run AMOS, which exfiltrated sensitive data including Keychain information, browser credentials, and cryptocurrency wallets. This incident underscores the evolving tactics of threat actors targeting macOS systems, particularly through trusted applications like Script Editor. The shift from Terminal-based to Script Editor-based ClickFix attacks highlights the need for continuous vigilance and user education to recognize and avoid such sophisticated social engineering schemes.
5 months ago
Kill Chain
Iran-Linked Hackers Target U.S. Critical Infrastructure in 2026
In early April 2026, Iran-affiliated cyber actors targeted internet-facing operational technology (OT) devices across U.S. critical infrastructure sectors, including programmable logic controllers (PLCs) manufactured by Rockwell Automation. These attacks led to diminished PLC functionality, manipulation of display data, and, in some cases, operational disruption and financial loss. The Cybersecurity and Infrastructure Security Agency (CISA), along with the FBI and NSA, issued warnings about these threats, emphasizing the need for immediate action to secure vulnerable OT assets. ([nextgov.com](https://www.nextgov.com/cybersecurity/2026/04/pro-iran-hackers-are-targeting-us-industrial-control-systems-advisory-says/412679/?utm_source=openai)) This incident underscores the escalating cyber threats from nation-state actors targeting critical infrastructure. The exploitation of internet-exposed PLCs highlights the urgent need for organizations to implement robust cybersecurity measures, including network segmentation, regular software updates, and the use of strong, unique passwords to protect against such sophisticated attacks.
5 months ago
Kill Chain
Magento 2026: PolyShell Vulnerability Exploited in Credit Card Skimming Attacks
In April 2026, a significant cybersecurity incident targeted nearly 100 online stores utilizing the Magento e-commerce platform. Attackers exploited the 'PolyShell' vulnerability, a critical flaw in Magento's REST API, allowing unauthenticated remote code execution. By injecting malicious code into a 1x1-pixel SVG image within the websites' HTML, they deployed a sophisticated credit card skimmer. This skimmer intercepted checkout processes, presenting a fake 'Secure Checkout' overlay to customers, capturing their payment information, and exfiltrating it through encrypted channels. The campaign's stealthy nature and the widespread use of Magento made this attack particularly impactful. This incident underscores a growing trend of attackers leveraging zero-day vulnerabilities in widely used platforms to conduct large-scale data theft. The use of obfuscated code within seemingly benign elements like SVG images highlights the evolving sophistication of threat actors. Organizations must remain vigilant, ensuring timely patching and employing advanced detection mechanisms to mitigate such risks.
5 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
