Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3133 to 3144 of 5988
REF1695's 2023 Campaign: Unveiling the Threat of Fake Installers
In November 2023, a financially motivated threat actor, codenamed REF1695, initiated a campaign leveraging fake software installers to deploy remote access trojans (RATs) and cryptocurrency miners. The attackers utilized ISO files containing a .NET Reactor-protected loader and instructions guiding users to bypass Microsoft Defender SmartScreen protections. This method facilitated the installation of a previously undocumented .NET implant known as CNB Bot, enabling unauthorized access and resource exploitation on compromised systems. Beyond cryptomining, REF1695 monetized infections through Cost Per Action (CPA) fraud, directing victims to content locker pages under the guise of software registration. This multifaceted approach not only compromised system integrity but also led to financial losses for affected organizations. The incident underscores the evolving tactics of cybercriminals who combine traditional malware deployment with social engineering techniques to maximize their illicit gains. Organizations are urged to enhance their cybersecurity measures, including user education on recognizing phishing attempts and the importance of verifying software sources, to mitigate such threats.
5 months ago
Kill Chain
Urgent: Patch Critical RCE Vulnerabilities in Progress ShareFile
In March 2026, security researchers identified two critical vulnerabilities in Progress ShareFile, designated as CVE-2026-2699 and CVE-2026-2701. These flaws, when exploited in tandem, allow unauthenticated attackers to execute remote code by bypassing authentication mechanisms and uploading malicious web shells. Progress promptly addressed these issues by releasing Storage Zone Controller version 5.12.4 on March 10, 2026. Given the approximately 30,000 internet-facing instances of ShareFile, immediate patching is imperative to prevent potential exploitation. This incident underscores the persistent threat posed by chaining multiple vulnerabilities to achieve significant security breaches. Organizations must remain vigilant, ensuring timely updates and comprehensive security assessments to mitigate such risks.
5 months ago
Kill Chain
React2Shell Exploitation Leads to Massive Credential Harvesting in 2026
In early 2026, a large-scale credential harvesting operation exploited the React2Shell vulnerability (CVE-2025-55182) to compromise 766 Next.js hosts. Attackers leveraged this critical remote code execution flaw in React Server Components to gain unauthorized access to sensitive data, including database credentials, SSH private keys, AWS secrets, shell command history, Stripe API keys, and GitHub tokens. The breach underscores the severe risks associated with unpatched vulnerabilities in widely used web frameworks. The React2Shell vulnerability, disclosed in December 2025, has been actively exploited by threat actors, leading to significant data breaches and system compromises. This incident highlights the urgent need for organizations to promptly apply security patches and implement robust monitoring to detect and mitigate exploitation attempts.
5 months ago
Kill Chain
Cisco IMC Vulnerabilities: Authentication Bypass and Command Injection Risks in 2026
In April 2026, Cisco disclosed two critical vulnerabilities in its Integrated Management Controller (IMC): CVE-2026-20093 and CVE-2026-20094. CVE-2026-20093 is an authentication bypass flaw that allows unauthenticated, remote attackers to gain admin access by exploiting improper handling of password change requests. CVE-2026-20094 is a command injection vulnerability enabling authenticated users with read-only privileges to execute arbitrary commands as the root user due to inadequate input validation. Exploitation of these vulnerabilities could lead to full system compromise, including unauthorized access, data manipulation, and potential service disruptions. ([cisco.com](https://www.cisco.com/c/en/us/support/docs/csa/cisco-sa-cimc-auth-bypass-AgG2BxTn.html?utm_source=openai)) The disclosure of these vulnerabilities underscores the ongoing risks associated with out-of-band management interfaces. As organizations increasingly rely on such systems for remote administration, ensuring their security becomes paramount. This incident highlights the necessity for regular security assessments, prompt application of patches, and vigilant monitoring to mitigate potential threats.
5 months ago
Kill Chain
AZ Monica Hospital Cyberattack: A Stark Reminder for Healthcare Security
In January 2026, AZ Monica Hospital in Antwerp, Belgium, experienced a significant cyberattack that disrupted its computer systems, leading to the cancellation of at least 70 surgeries and the transfer of seven critical patients to other facilities. The attack also affected patient registration processes and emergency services, compelling the hospital to advise patients to seek care elsewhere. This incident underscores the escalating threat of cyberattacks on healthcare institutions, highlighting the critical need for robust cybersecurity measures to protect patient safety and maintain operational continuity.
5 months ago
Kill Chain
Casbaneiro Banking Trojan's 2026 Campaign: A Wake-Up Call for Financial Cybersecurity
In early 2026, the Brazilian cybercrime group known as Augmented Marauder launched a sophisticated phishing campaign targeting Spanish-speaking users across Latin America and Europe. Utilizing the Horabot malware, they distributed the Casbaneiro banking trojan through deceptive emails containing password-protected PDFs. Once executed, Casbaneiro monitored victims' online banking activities, capturing credentials and facilitating unauthorized financial transactions. The campaign's worm-like propagation via compromised email accounts significantly amplified its reach and impact. This incident underscores the evolving tactics of cybercriminals in deploying banking trojans, highlighting the need for enhanced email security measures and user awareness. The use of dynamic PDF lures and self-propagating malware reflects a broader trend of increasingly sophisticated phishing techniques aimed at financial institutions and their customers.
5 months ago
Kill Chain
Understanding Cookie-Controlled PHP Web Shells in Linux Hosting
In early 2026, threat actors increasingly exploited PHP web shells on Linux servers, utilizing HTTP cookies as control channels. This method allowed malicious code to remain dormant during normal operations, activating only when specific cookie values were present, thereby evading traditional detection mechanisms. The attackers employed various obfuscation techniques, including layered encoding and dynamic function reconstruction, to conceal their activities. This approach enabled persistent access, often through scheduled tasks that reinstated the web shell if removed, complicating remediation efforts. The incidents underscored the need for enhanced monitoring of web server processes and stricter controls over scheduled tasks to prevent unauthorized access and maintain system integrity. The rise of cookie-controlled PHP web shells highlights a significant shift in attacker tactics, emphasizing stealth and persistence. Organizations must adapt by implementing advanced detection strategies, such as behavior-based monitoring and anomaly detection, to identify and mitigate these sophisticated threats effectively.
5 months ago
Kill Chain
Critical Security Alert: CVE-2026-5281 in Google Chrome's Dawn Component
In April 2026, a critical use-after-free vulnerability, identified as CVE-2026-5281, was discovered in Google Chrome's Dawn component, which handles WebGPU operations. This flaw allows remote attackers who have compromised the renderer process to execute arbitrary code via crafted HTML pages. The vulnerability affects Chrome versions prior to 146.0.7680.178. Google has released a patch to address this issue, and users are strongly advised to update their browsers immediately to mitigate potential risks. ([leakycreds.com](https://www.leakycreds.com/vulnerability/CVE-2026-5281?utm_source=openai)) The inclusion of CVE-2026-5281 in CISA's Known Exploited Vulnerabilities catalog underscores the severity of the threat, as it has been actively exploited in the wild. This incident highlights the ongoing challenges in securing widely used software components and the importance of timely updates to protect against emerging threats. ([thecyberthrone.in](https://thecyberthrone.in/2026/04/02/cve-2026-5281-google-chrome-dawn-use-after-free-under-active-exploitation/?utm_source=openai))
5 months ago
Kill Chain
Axios Supply Chain Attack: A Wake-Up Call for Software Security
In late March 2026, attackers compromised the npm account of a primary maintainer of Axios, a widely-used JavaScript HTTP client library with over 100 million weekly downloads. They published two malicious versions, axios@1.14.1 and axios@0.30.4, which included a hidden dependency named 'plain-crypto-js'. This dependency executed a post-install script that deployed a cross-platform Remote Access Trojan (RAT) targeting Windows, macOS, and Linux systems. The RAT connected to a command-and-control server to retrieve platform-specific payloads, performed reconnaissance, and established persistence, with self-deletion capabilities to evade detection. The malicious versions were available for approximately three hours before removal, but the widespread use of Axios means the impact could be significant. ([sans.org](https://www.sans.org/blog/axios-npm-supply-chain-compromise-malicious-packages-remote-access-trojan?utm_source=openai)) This incident underscores the growing threat of supply chain attacks, where trusted software components are exploited to distribute malware. The sophistication of this attack, including the use of a legitimate maintainer's credentials and the deployment of a cross-platform RAT, highlights the need for enhanced security measures in software development and distribution processes. Organizations must remain vigilant and implement robust monitoring and response strategies to mitigate such risks. ([sans.org](https://www.sans.org/blog/axios-npm-supply-chain-compromise-malicious-packages-remote-access-trojan?utm_source=openai))
5 months ago
Kill Chain
Coruna iPhone Hacking Toolkit Leak: A Wake-Up Call for Cybersecurity
In early 2026, security researchers uncovered 'Coruna,' a sophisticated iPhone hacking toolkit comprising 23 exploits across five attack chains, targeting iOS versions 13.0 through 17.2.1. Initially developed by U.S. defense contractor L3Harris's division Trenchant, Coruna was intended for government use. However, it leaked and was subsequently utilized by Russian espionage groups and Chinese cybercriminals, leading to widespread data theft and compromising tens of thousands of devices. ([techcrunch.com](https://techcrunch.com/2026/03/09/an-iphone-hacking-toolkit-used-by-russian-spies-likely-came-from-u-s-military-contractor/?utm_source=openai)) The Coruna incident underscores the risks associated with the proliferation of advanced cyber tools beyond their original intent. It highlights the urgent need for robust security measures and timely software updates to protect against such sophisticated threats. ([techcrunch.com](https://techcrunch.com/2026/03/26/a-major-hacking-tool-has-leaked-online-putting-millions-of-iphones-at-risk-heres-what-you-need-to-know/?utm_source=openai))
5 months ago
Kill Chain
Anthropic's 2026 Source Code Leak: Lessons in Software Security
In March 2026, Anthropic, an AI company, inadvertently exposed the complete source code of its proprietary coding assistant, Claude Code. The leak occurred when a routine software update mistakenly included a 60 MB source map file (`cli.js.map`) in the NPM package version 2.1.88, allowing reconstruction of approximately 1,900 files and 500,000 lines of TypeScript code. This exposure revealed internal architectures and unreleased features, providing competitors with insights into Anthropic's development roadmap. The company confirmed that no sensitive customer data or credentials were compromised and attributed the incident to human error in the release packaging process. ([theguardian.com](https://www.theguardian.com/technology/2026/apr/01/anthropic-claudes-code-leaks-ai?utm_source=openai)) This incident underscores the critical importance of stringent internal security and release management practices, especially for organizations handling proprietary and sensitive information. The rapid dissemination of the leaked code across platforms like GitHub highlights the challenges in containing such exposures once they occur. ([theguardian.com](https://www.theguardian.com/technology/2026/apr/01/anthropic-claudes-code-leaks-ai?utm_source=openai))
5 months ago
Kill Chain
Google Drive Enhances Security with AI-Powered Ransomware Detection
In April 2026, Google announced the general availability of its AI-powered ransomware detection feature for Google Drive, now enabled by default for all paying users. This feature, initially introduced in beta in September 2025, utilizes advanced AI models to monitor file synchronization activities. Upon detecting ransomware-like behavior, it automatically pauses file syncing, alerts users and IT administrators, and provides detailed instructions for restoring uncorrupted files. This proactive approach aims to minimize the impact of ransomware attacks by safeguarding documents stored in Google Drive and facilitating swift recovery processes. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/google-drive-ransomware-detection-now-on-by-default-for-paying-users/?utm_source=openai)) The release of this enhanced security feature underscores the growing threat of ransomware attacks targeting cloud storage services. By integrating AI-driven detection mechanisms, Google addresses the need for robust, automated defenses against increasingly sophisticated cyber threats, highlighting the importance of proactive security measures in protecting organizational data assets.
5 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
