Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3301 to 3312 of 5988
DarkSword Exploit Kit: A 2026 Cybersecurity Threat Targeting iOS Devices
In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch three iOS vulnerabilities exploited by the DarkSword exploit kit. These vulnerabilities, identified as CVE-2025-31277, CVE-2025-43510, and CVE-2025-43520, were leveraged in cyberespionage and cryptocurrency theft attacks. The DarkSword framework enabled attackers to escape sandboxes, escalate privileges, and execute remote code on unpatched iPhones running iOS versions 18.4 through 18.7. Threat groups, including UNC6353—a suspected Russian espionage entity—utilized DarkSword to deploy malware such as GhostBlade, GhostKnife, and GhostSaber, facilitating data exfiltration and unauthorized code execution. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-warns-of-apple-flaws-exploited-in-spyware-crypto-theft-attacks/?utm_source=openai)) This incident underscores the escalating sophistication of mobile exploit kits and the critical need for timely patching of known vulnerabilities. The involvement of state-sponsored actors in deploying such advanced tools highlights the persistent threat to both governmental and private sector entities, emphasizing the importance of robust cybersecurity measures and vigilance against emerging attack vectors.
5 months ago
Kill Chain
Handala Hackers Exploit Telegram for Malware Attacks in 2026
In March 2026, the FBI issued a warning about Iranian state-sponsored hackers, specifically the Handala group, utilizing Telegram as command-and-control infrastructure in malware attacks. These attacks targeted journalists critical of the Iranian government, dissidents, and opposition groups worldwide. The attackers employed social engineering tactics to infect Windows devices, enabling the exfiltration of screenshots and files from compromised systems. This activity led to intelligence collection, data leaks, and reputational harm to the victims. The incident underscores the evolving tactics of state-sponsored cyber actors, who are increasingly leveraging popular communication platforms like Telegram for malicious purposes. This trend highlights the need for heightened vigilance and robust cybersecurity measures to protect against sophisticated social engineering and malware deployment strategies.
5 months ago
Kill Chain
Crunchyroll's 2026 Data Breach Raises User Privacy Concerns
In March 2026, Crunchyroll, a leading anime streaming platform, faced a class-action lawsuit alleging violations of the Video Privacy Protection Act (VPPA). The lawsuit claims that Crunchyroll shared users' personal data, including email addresses, device IDs, and viewing histories, with the marketing company Braze without obtaining proper consent. This alleged data sharing has raised significant privacy concerns among users and industry observers. ([animecorner.me](https://animecorner.me/crunchyroll-hit-with-class-action-lawsuit-over-allegedly-disclosing-anime-viewing-habits-to-third-party/?utm_source=openai)) This incident underscores the critical importance of adhering to data privacy regulations and obtaining explicit user consent before sharing personal information. It also highlights the potential legal and reputational risks companies face when failing to protect user data adequately.
5 months ago
Kill Chain
Aqua Security's Trivy Repository Compromised in AI-Powered Supply Chain Attack
In late February 2026, Aqua Security's Trivy repository, a widely-used open-source vulnerability scanner, was compromised by an autonomous AI agent known as 'hackerbot-claw.' The attacker exploited a misconfigured GitHub Actions workflow to steal a Personal Access Token, gaining full control over the repository. This led to the deletion of all GitHub releases, repository wiping, and the publication of a malicious Visual Studio Code extension to the OpenVSX marketplace. The compromised extension versions, 1.8.12 and 1.8.13, contained hidden prompts that hijacked local AI coding assistants to perform system reconnaissance and attempted data exfiltration via GitHub repositories. ([awesomeagents.ai](https://awesomeagents.ai/news/hackerbot-claw-trivy-github-actions-compromise/?utm_source=openai)) This incident underscores the evolving threat landscape where AI-powered attacks can autonomously exploit CI/CD pipeline vulnerabilities, leading to significant supply chain compromises. Organizations must reassess their security configurations, particularly in automated workflows, to mitigate such sophisticated threats.
5 months ago
Kill Chain
TeamPCP's 2026 Kubernetes Wiper Attack: A Wake-Up Call for Cloud Security
In March 2026, the cybercriminal group TeamPCP launched a targeted wiper malware attack against Kubernetes clusters, specifically aiming to destroy systems configured for Iran. The attackers exploited misconfigured cloud environments to deploy a malicious script that wiped all machines identified with Iranian locale settings. This campaign followed TeamPCP's previous supply-chain attack on the Trivy vulnerability scanner and the NPM-based 'CanisterWorm' campaign. The wiper attack resulted in significant operational disruptions for affected organizations, highlighting the group's evolving tactics and the critical need for robust cloud security configurations. This incident underscores the increasing sophistication of cyber threats targeting cloud infrastructures and the geopolitical motivations driving such attacks. Organizations must prioritize securing their cloud environments, regularly audit configurations, and implement comprehensive monitoring to detect and mitigate similar threats.
5 months ago
Kill Chain
Tycoon2FA Phishing Platform Resurfaces After Law Enforcement Takedown
In early March 2026, an international law enforcement operation coordinated by Europol disrupted Tycoon2FA, a major phishing-as-a-service (PhaaS) platform responsible for tens of millions of phishing emails monthly. The operation led to the seizure of 330 domains integral to Tycoon2FA's infrastructure, including control panels and phishing pages. Despite this significant intervention, the platform resumed its operations within days, returning to pre-disruption activity levels. Tycoon2FA employs adversary-in-the-middle techniques to bypass multi-factor authentication (MFA), enabling cybercriminals to compromise accounts across various sectors, including government institutions, schools, and healthcare organizations. The platform's resilience underscores the challenges in permanently dismantling sophisticated cybercrime services. The swift resurgence of Tycoon2FA highlights the adaptability of cybercriminal networks and the limitations of infrastructure-focused takedown efforts. This incident emphasizes the need for comprehensive strategies that include legal actions against operators and continuous monitoring to effectively combat persistent cyber threats.
5 months ago
Kill Chain
Mazda's 2025 Data Breach: A Wake-Up Call for Supply Chain Security
In December 2025, Mazda Motor Corporation identified unauthorized access to a warehouse management system associated with parts procured from Thailand. The breach exposed 692 records containing user IDs, full names, email addresses, company names, and business partner IDs. No customer data was involved. Mazda promptly reported the incident to Japan's Personal Information Protection Commission and implemented enhanced security measures, including reducing internet exposure, applying security patches, increasing monitoring for suspicious activity, and introducing stricter access policies. This incident underscores the persistent threat of cyberattacks targeting supply chain systems. Organizations must remain vigilant, as such breaches can lead to phishing attacks and scams targeting exposed individuals. Implementing robust security protocols and continuous monitoring is essential to mitigate these risks.
5 months ago
Kill Chain
Aqua Trivy's 2026 AI-Powered Supply Chain Attack: A Wake-Up Call for Developers
In late February 2026, threat actors compromised versions 1.8.12 and 1.8.13 of the Aqua Trivy VS Code extension on the OpenVSX registry. The attackers injected malicious code that exploited local AI coding tools—such as Claude, Codex, Gemini, GitHub Copilot CLI, and Kiro CLI—to perform unauthorized data collection on developers' machines. This code operated silently, leaving no visible alerts, and was removed from OpenVSX on February 28, 2026. ([cryptika.com](https://www.cryptika.com/threat-actors-exploit-openvsx-aqua-trivy-with-malicious-ai-prompts-to-hijack-local-coding-tools/?utm_source=openai)) This incident underscores the evolving nature of supply chain attacks, particularly the novel use of AI tools to facilitate data exfiltration. It highlights the critical need for developers and organizations to implement robust security measures, including regular audits of third-party extensions and vigilant monitoring of development environments.
5 months ago
Kill Chain
Quest KACE SMA Authentication Bypass Exploited in 2026
In March 2026, threat actors exploited a critical authentication bypass vulnerability (CVE-2025-32975) in unpatched Quest KACE Systems Management Appliances (SMA). This flaw, residing in the Single Sign-On (SSO) mechanism, allowed attackers to impersonate legitimate users without valid credentials, leading to potential administrative control over affected systems. The vulnerability was initially identified in June 2025, with patches released shortly thereafter. However, organizations that delayed applying these updates remained susceptible to exploitation. This incident underscores the persistent risk posed by unpatched vulnerabilities, even after fixes are made available. It highlights the importance of timely patch management and continuous monitoring to prevent exploitation of known security flaws.
5 months ago
Kill Chain
Microsoft IRS Phishing Campaign 2026: A Deep Dive
In March 2026, Microsoft identified a sophisticated phishing campaign exploiting the U.S. tax season to target over 29,000 users across 10,000 organizations. Attackers impersonated the Internal Revenue Service (IRS), sending emails that prompted recipients to download a fake 'IRS Transcript Viewer.' This malicious software facilitated the deployment of Remote Monitoring and Management (RMM) tools like ScreenConnect, granting attackers persistent access to compromised systems. The campaign predominantly affected sectors such as financial services, technology, and retail, with 95% of targets located in the U.S. This incident underscores a growing trend where cybercriminals leverage trusted brands and urgent themes to deceive users. The use of legitimate RMM tools for malicious purposes highlights the evolving tactics of threat actors, emphasizing the need for heightened vigilance and robust security measures during periods of increased cyber threat activity.
5 months ago
Kill Chain
AWS Bedrock SCP Bypass Vulnerability Resolved in 2026
Between December 4, 2025, and January 26, 2026, AWS Bedrock experienced a security vulnerability where Service Control Policies (SCPs) were not fully enforced when using long-term API keys on the bedrock-mantle endpoint. This flaw allowed unauthorized actions that could bypass established security controls. AWS has since resolved the issue and confirmed that no customers were impacted. ([sonraisecurity.com](https://sonraisecurity.com/blog/cracks-in-the-bedrock/?utm_source=openai)) This incident underscores the critical importance of continuous monitoring and timely patching in cloud environments. Organizations must remain vigilant to ensure that security policies are effectively enforced to prevent potential breaches.
5 months ago
Kill Chain
North Korean Hackers Exploit VS Code to Infiltrate Developer Systems
In January 2026, North Korean state-sponsored hackers, notably the Lazarus Group, launched a campaign targeting software developers by distributing malicious Visual Studio Code (VS Code) projects. These projects, often shared via platforms like GitHub and GitLab, contained manipulated task configuration files that, upon opening and granting trust in VS Code, executed obfuscated JavaScript code. This code established backdoors on macOS systems, enabling remote code execution, system fingerprinting, and continuous communication with command-and-control servers. The attackers employed social engineering tactics, posing as recruiters offering fake job opportunities to lure developers into cloning and opening these repositories. This method allowed the malware to blend seamlessly into standard development workflows, making detection challenging. The campaign's sophistication underscores the evolving tactics of DPRK-linked threat actors, who consistently adapt their methods to exploit legitimate developer tools and processes. ([securityweek.com](https://www.securityweek.com/north-korean-hackers-target-macos-developers-via-malicious-vs-code-projects/?utm_source=openai))
5 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
