Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 301 to 312 of 5924
First Major AI-Assisted Ransomware Attack: How Frontier AI Agents Executed 50+ Attack Techniques in 10 Hours
In September 2026, Unit 42 investigators responded to a groundbreaking ransomware attack where threat actors deployed frontier AI agents to autonomously breach an enterprise network in under 10 hours. The attackers used multiple AI agents working in parallel to compress traditional multi-week intrusion operations, executing over 50 MITRE ATT&CK techniques including network reconnaissance, secrets harvesting, privilege escalation, CI/CD pipeline exploitation, and cloud infrastructure hijacking. The AI-driven attack achieved the operational impact of multiple coordinated red teams while leaving behind an 80-page technical security audit documenting exploited vulnerabilities. This incident represents a critical inflection point in cybersecurity, demonstrating how threat actors are weaponizing frontier AI and agentic frameworks to dramatically accelerate attack timelines and operational efficiency, marking the emergence of machine-speed cyber operations as a mainstream threat vector.
2 weeks ago
Kill Chain
Silver Fox Supply Chain Attack: How Counterfeit Software Sites Compromise Enterprise Networks
Microsoft Defender Experts has identified an active malware campaign using counterfeit software download websites to distribute malicious installers targeting organizations across healthcare, manufacturing, gaming, technology, logistics, government, and education sectors. The campaign primarily affects China-based operations and Chinese-speaking users through high-fidelity clones of legitimate vendor sites offering popular software downloads. Once executed, the malicious installers deploy persistent malware that weakens security protections, establishes command and control connections, and enables potential data exfiltration through encrypted channels. This incident highlights the growing sophistication of supply chain attacks targeting software distribution channels, coinciding with increased regulatory focus on software supply chain security and the rise of AI-powered security evasion techniques.
2 weeks ago
Kill Chain
Leaked Russian Documents Expose Systematic Cyber Warfare Training Pipeline
In September 2026, leaked training materials from Russia's Bauman Moscow State Technical University exposed the institutional framework behind Russian state-sponsored cyber operations. The documents revealed Department No. 4's role as a pipeline for recruiting students into GRU units including Sandworm (Military Unit 74455) and APT28, showing formalized pathways from university recruitment to military cyber roles. The leak provided unprecedented insight into how Russia systematically develops cyber capabilities through supervised technical and ideological preparation of students before their assignment to intelligence and cyber warfare units. This exposure comes as Russian cyber operations have intensified against critical infrastructure globally, with increased focus on destructive attacks and espionage campaigns targeting government and private sector networks across multiple domains.
2 weeks ago
Kill Chain
Serbian Activists Targeted in Largest Documented Pegasus and NoviSpy Spyware Campaign
In early 2026, researchers discovered the first confirmed Pegasus spyware infection of the year alongside NoviSpy variant infections targeting 14 Serbian individuals, including student activists, a parliament member, and local government official. The SHARE Foundation documented this as the largest wave of surveillance in Serbia to date, coinciding with local elections and student protests following the 2024 Novi Sad railway station collapse. Pegasus infections utilized zero-click exploits from December 2025 to January 2026, while NoviSpy variants were deployed during police detention and questioning of activists. This incident highlights the continued weaponization of commercial spyware against civil society and democratic movements, demonstrating how state-sponsored surveillance capabilities are increasingly deployed to suppress political dissent and monitor opposition activities during critical electoral periods.
2 weeks ago
Kill Chain
FBI Warns of Sophisticated OAuth Consent Phishing Campaign Targeting Prominent Figures
The FBI issued a public alert in late 2025 regarding a sophisticated OAuth consent phishing campaign targeting high-profile individuals, their family members, and associates through commercial messaging applications. Attackers impersonate government officials, journalists, and public personalities to trick victims into granting access to legitimate cloud services like Microsoft or Google under the pretense of reviewing documents. Once OAuth permissions are granted, attackers gain persistent access to emails, files, and sensitive data that cannot be revoked simply by changing passwords, requiring victims to manually invalidate tokens in application security settings. This campaign highlights the growing trend of identity-centric attacks that bypass traditional security measures including multi-factor authentication, representing a significant evolution in social engineering tactics that exploit trusted authentication protocols against prominent targets.
2 weeks ago
Kill Chain
PaperCut Zero-Day Attack: How Print Infrastructure Became the New Attack Vector
Two critical zero-day vulnerabilities in PaperCut NG and MF print management software (CVE-2026-81578 and CVE-2026-82078) were actively exploited by threat actors in August 2026 for data theft attacks. The flaws can be chained to bypass authentication and achieve remote code execution on vulnerable servers used by over 100 million users across 70,000 organizations globally. PaperCut Software released three emergency patches within a week to address the vulnerabilities, but threat intelligence indicates attackers are exploiting these flaws to dump database tables and steal sensitive data from exposed servers. With over 800 PaperCut servers still exposed online and a history of ransomware groups targeting similar vulnerabilities, this incident highlights the critical risk posed by internet-facing print management infrastructure. This incident underscores the growing trend of attackers targeting enterprise software zero-days for immediate data theft rather than prolonged persistence, reflecting the increasing sophistication and speed of modern threat actors in monetizing newly discovered vulnerabilities.
2 weeks ago
Kill Chain
Venezuelan ATM Jackpotting Ring Exposed: When Physical Access Beats Network Security
Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny through ATM jackpotting attacks in Kansas during December 2025. The attackers attempted to install malware on ATMs in Wamego and Manhattan to force cash dispensers to empty their storage cassettes, but failed in both attempts and were arrested within days after surveillance cameras captured their activities. This case is part of a broader crackdown on the Tren de Aragua Venezuelan criminal organization, with the Justice Department charging 87 members in connection with ATM malware schemes that stole over $20 million in 2025. ATM jackpotting attacks represent a growing physical-digital threat where criminals bypass traditional network security by gaining direct hardware access to financial infrastructure, highlighting the critical need for comprehensive security that extends beyond network perimeters to protect physical endpoints and embedded systems.
2 weeks ago
Kill Chain
Critical Exchange Server Vulnerability Leaves 22,000 Organizations at Risk
In September 2026, security researchers discovered that nearly 22,000 Microsoft Exchange servers remained vulnerable to CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The flaw allows attackers with basic privileges to execute capture-replay attacks and hijack all user mailboxes on targeted servers. Despite Microsoft patching the vulnerability in August 2026, most servers remain unpatched, with Germany showing 85% of on-premises Exchange installations still vulnerable. The Netherlands NCSC reported that exploit code is already publicly available online. This incident highlights the persistent challenge of legacy system security as Exchange 2016 and 2019 reached end-of-support in October 2026, with Extended Security Updates ending the same month, leaving organizations exposed to mounting authentication bypass attacks.
2 weeks ago
Kill Chain
Critical Langflow Vulnerability CVE-2026-0768 Exploited to Steal AI and Cloud Credentials
Threat actors are actively exploiting CVE-2026-0768, a critical unauthenticated remote code execution vulnerability in Langflow, an open-source AI application development framework. The flaw allows attackers to execute arbitrary Python code with root privileges without authentication, enabling them to steal sensitive credentials including OpenAI API keys, AWS secrets, and administrative authentication tokens. VulnCheck detected over 360 exploitation attempts originating primarily from Russia, with attackers conducting reconnaissance and harvesting environment variables from compromised instances. This incident highlights the growing trend of AI infrastructure targeting as organizations rapidly adopt AI development platforms without adequate security controls, making them prime targets for credential theft and supply chain attacks.
2 weeks ago
Kill Chain
Faronics Deploy Platform Exploited in Sophisticated ScreenConnect RAT Campaign
Between July and August 2026, cybercriminals exploited the legitimate Faronics Deploy endpoint management platform to gain unauthorized administrative control over victim computers. The attackers used phishing emails disguised as invoices and tax documents to trick users into downloading a legitimate but malicious Faronics Deploy installer. Once installed, the threat actors remotely executed PowerShell scripts to deploy ConnectWise ScreenConnect remote access software, establishing persistent backdoor access to over 457 endpoints across multiple organizations. This incident highlights the growing trend of Living-off-the-Land (LotL) attacks where cybercriminals abuse legitimate administrative tools to bypass traditional security controls and establish covert command-and-control channels.
2 weeks ago
Kill Chain
Breeze Comet's Sophisticated Attack on Brazilian Payment Systems Exposes Critical Infrastructure Vulnerabilities
Since 2024, the financially motivated threat actor Breeze Comet (formerly UNC5669) has targeted Brazilian financial services, retail, and e-commerce organizations through sophisticated payment system manipulation attacks. The group gains initial access via password spraying and social engineering calls impersonating IT support to install remote access tools like AnyDesk, then deploys custom malware including COBALTSPIN, LIGHTPAINT, and MILDFROST to maintain persistence and lateral movement. Successfully executing hundreds of fraudulent transactions worth tens of thousands of dollars, the group specifically targets entities with access to Brazil's National Financial System Network and payment platforms like Pix, STR, and Boleto. This campaign represents a significant evolution in Latin American cybercrime from opportunistic retail fraud to direct targeting of core financial infrastructure. The threat actor's use of AI-assisted malware development and expansion into other Latin American and African countries signals a new model for financially motivated attacks that defenders must prepare for as interconnected payment ecosystems become increasingly vulnerable.
2 weeks ago
Kill Chain
How Mirage Kitten's NodeRabbit Malware Exploited Developer Trust in 2024
In 2024, Iranian APT group Mirage Kitten launched sophisticated social engineering campaigns targeting aviation and fintech sectors across the Middle East and Africa using two new cross-platform malware families: NodeRabbit and PollCat. The threat actors posed as recruiters on LinkedIn, delivering trojanized coding challenges that contained Node.js-based remote access trojans capable of running on Windows, Linux, and macOS. The malware established persistence through multiple mechanisms and communicated with command-and-control infrastructure hosted on Azure and Cloudflare, affecting organizations in Egypt, Ethiopia, and Afghanistan. This campaign represents a significant evolution in nation-state tactics, showcasing how APT groups are adapting to target developer communities through increasingly sophisticated supply chain attacks and social engineering techniques that exploit trust in professional recruitment processes.
2 weeks ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
