Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 325 to 336 of 5924
Critical Denial of Service Vulnerability Exposes Rockwell Automation Industrial Controllers
Rockwell Automation disclosed CVE-2021-42260, a high-severity denial of service vulnerability affecting ControlLogix, CompactLogix, GuardLogix, and Compact GuardLogix controllers. The vulnerability, with a CVSS score of 7.5, allows attackers to trigger an infinite loop condition through corrupt crafted data, causing major nonrecoverable faults (MNRF) in safety controllers and requiring program downloads for recovery. The flaw impacts multiple firmware versions across the 34.x, 35.x, 36.x, and 37.x series, affecting critical manufacturing infrastructure deployed worldwide. This vulnerability highlights the ongoing risks to operational technology environments where denial of service attacks can cause significant operational disruption. As industrial control systems become increasingly connected and targeted by threat actors, vulnerabilities like CVE-2021-42260 demonstrate the critical need for robust OT security measures and timely patch management in manufacturing environments.
2 weeks ago
Kill Chain
The Coding Agent Trap: How Rogue AI Endpoints Became the New Supply Chain Threat
In August 2024, security researchers documented a novel supply chain attack where threat actors discovered exposed LLM inference endpoints, relabeled them with popular model names like DeepSeek, and distributed them as 'free' alternatives to attract AI coding agents. A honeypot captured a real coding agent session from China that transmitted 88 messages containing filesystem data, PowerShell command outputs, and tool manifests to an untrusted endpoint. The malicious endpoint operator could have responded with tool calls to execute arbitrary commands, read sensitive files, or exfiltrate data from the victim's machine without exploiting vulnerabilities. This represents a new attack vector where AI agents voluntarily connect to rogue infrastructure, exposing their capabilities and local environment data through normal inference requests with tools enabled and permissive configurations. This incident highlights the emerging risks as AI coding agents become mainstream development tools, with threat actors adapting traditional supply chain tactics to target autonomous systems that can execute code and access filesystems based on remote model responses.
2 weeks ago
Kill Chain
Critical DOS Vulnerabilities Threaten Rockwell Automation RSLinx Classic Industrial Systems
Four critical denial-of-service vulnerabilities (CVE-2026-9621, CVE-2026-9622, CVE-2026-9624, CVE-2026-9625) were discovered in Rockwell Automation's RSLinx Classic versions 4.50 and earlier. These vulnerabilities allow attackers to crash the RSLinx Classic service by sending specially crafted CIP packets, exploiting integer overflow, integer underflow, and buffer overflow conditions. The vulnerabilities affect critical manufacturing infrastructure worldwide and require service restarts to recover, potentially disrupting industrial operations and production systems. These vulnerabilities highlight the growing threat landscape facing industrial control systems as cybercriminals increasingly target critical infrastructure. With the rise of nation-state actors and ransomware groups focusing on OT environments, securing industrial communication protocols like CIP has become paramount for operational resilience.
2 weeks ago
Kill Chain
Critical Vulnerabilities Expose Rockwell Automation Industrial Systems to Remote Attacks
In September 2026, CISA disclosed critical vulnerabilities in Rockwell Automation's FactoryTalk Historian Machine Edition affecting Series B 5.202 and Series C 7.101. CVE-2025-12768, with a CVSS score of 8.0, enables remote code execution through an out-of-bounds write condition exploitable by attackers with low-level authentication. CVE-2026-12661 allows denial-of-service attacks via stack-based buffer overflows when crafted requests are sent to the web interface, potentially crashing industrial systems. These vulnerabilities impact critical infrastructure sectors including chemical manufacturing, healthcare, and water systems worldwide. The disclosure emphasizes the growing threat landscape targeting industrial control systems and operational technology environments. Similar buffer overflow vulnerabilities in ICS components have been increasingly exploited by nation-state actors and ransomware groups to disrupt critical infrastructure operations.
2 weeks ago
Kill Chain
Iranian State Hackers Exploit Tech Job Market to Deploy Advanced Cross-Platform Malware
Iranian threat group Nimbus Manticore (also known as Mirage Kitten) has expanded their attack methodology by deploying cross-platform remote access trojans (RATs) through sophisticated social engineering campaigns targeting software engineers. The group poses as recruiters from major technology companies on LinkedIn and other job platforms, delivering trojanized coding challenges containing NodeRabbit and PollCat malware. These Node.js and JavaScript-based RATs can infect Windows, Linux, and macOS systems, representing a significant evolution from their traditional C/C++ toolset. The campaign has been observed targeting victims across Afghanistan, Egypt, and Ethiopia, demonstrating the group's expanded geographic reach and technical capabilities. This incident highlights the growing trend of state-sponsored actors adopting cross-platform development frameworks to maximize their attack surface while leveraging legitimate recruitment processes as attack vectors. The sophisticated nature of these fake coding challenges and the pressure tactics employed demonstrate how threat actors are increasingly exploiting the competitive job market in the technology sector.
2 weeks ago
Kill Chain
Iran-Linked Nation-State Actors Launch Coordinated Attacks on US Water Infrastructure
In August 2026, Iran-linked threat actors conducted a sophisticated campaign targeting critical water and wastewater systems across at least 12 US states, utilizing advanced persistent threat techniques to infiltrate industrial control systems. The attackers successfully compromised SCADA networks and human-machine interfaces, demonstrating their ability to manipulate critical infrastructure operations. In a parallel attack, the same threat group shut down a UK power plant for four days in July 2026, highlighting the global reach and severity of their capabilities. The incidents caused significant operational disruptions, water service outages affecting hundreds of thousands of residents, and forced emergency response protocols across multiple states. These attacks represent a dangerous escalation in nation-state targeting of critical infrastructure, coinciding with increased geopolitical tensions and sophisticated adversaries developing specialized capabilities for industrial control system compromise. The incidents underscore the urgent need for enhanced OT security measures and zero-trust architectures protecting critical national infrastructure.
2 weeks ago
Kill Chain
Supply Chain Attack: Malicious Packagist Packages Exploit iOS Devices to Steal Cryptocurrency Wallets
In September 2026, cybersecurity researchers discovered 13 malicious Composer theme packages on Packagist targeting Vietnamese movie and comic streaming sites. These supply chain attacks injected JavaScript that deployed spyware on unpatched iOS devices running versions 18.4 through 18.6.x. The campaign exploited WebKit vulnerabilities CVE-2025-31277 and CVE-2025-43529 to break out of Safari's sandbox and install kernel-level malware. The sophisticated attack chain exfiltrated keychain databases, Wi-Fi passwords, SMS data, photos, and cryptocurrency wallet seeds from popular wallets including Bitget, Trust Wallet, and OKX, uploading encrypted data to command and control servers hosted on Funnull infrastructure. This incident highlights the evolving threat landscape where supply chain attacks increasingly target mobile platforms and cryptocurrency assets. The campaign's focus on stealing wallet seeds represents a concerning escalation from traditional data theft to direct financial crime, particularly as mobile cryptocurrency adoption accelerates across Southeast Asia.
2 weeks ago
Kill Chain
Guildma (Astaroth) Malware Evolves with Advanced Geofencing and Evasion Techniques
In August 2026, a sophisticated Guildma (Astaroth) malware campaign targeted Brazilian users through geofenced phishing emails written in Brazilian Portuguese. The attack required victims to access malicious links from Brazil-based IP addresses with Brazilian Portuguese language and regional settings, demonstrating advanced evasion techniques. The malware was delivered via a zip archive containing a Windows shortcut that utilized alternate data streams to deploy a 64-bit DLL, which subsequently installed an AutoIt-compiled Guildma payload for credential theft and information stealing. This campaign represents the continued evolution of Brazilian-origin banking trojans that have expanded globally, leveraging sophisticated geofencing and language-based targeting to evade detection and analysis. The use of legitimate cloud infrastructure like Azure websites and advanced evasion techniques demonstrates how threat actors are adapting to modern security controls while maintaining persistence through alternate data streams and AutoIt compilation.
2 weeks ago
Kill Chain
Critical Traefik Proxy Vulnerability Exposes HTTP/3 Timeout Bypass
In December 2024, Bishop Fox disclosed a critical vulnerability in Traefik proxy versions through 3.7.11, identified as CVE-2024-45410. The vulnerability stemmed from Traefik's request read timeout mechanism failing to apply to HTTP/3 connections, despite being enabled by default and documented as universally applied. This gap existed across four years of releases, allowing potential denial-of-service attacks and resource exhaustion through prolonged HTTP/3 connections. Upon responsible disclosure, Traefik maintainers issued a patch within twelve days, addressing the timeout enforcement inconsistency. This vulnerability highlights the growing security challenges in HTTP/3 implementations as organizations rapidly adopt the protocol for performance benefits. With HTTP/3 gaining widespread enterprise adoption and edge proxy deployments increasing, implementation gaps like these represent significant attack surfaces that threat actors are beginning to exploit more frequently.
2 weeks ago
Kill Chain
DoD Refrigeration Systems Under Cyber Attack: When Supply Chains Become Attack Vectors
In August 2026, multiple U.S. Department of Defense military base commissaries experienced simultaneous refrigeration system failures across at least seven installations, including Fort Irwin, F.E. Warren Air Force Base, Fort Huachuca, Naval Station Newport, Columbus Air Force Base, Travis Air Force Base, and Naval Air Station Lemoore. The coordinated nature and timing of these outages strongly suggests a sophisticated cyber attack targeting critical infrastructure systems within the military supply chain. The Pentagon acknowledged awareness of the disruptions but declined to provide details about the scope or attribution of the incidents. This incident highlights the growing threat to operational technology and IoT devices within critical infrastructure environments. As nation-state actors increasingly target supply chain vulnerabilities and connected systems, the simultaneous failure of refrigeration systems across geographically dispersed military installations demonstrates how cyber threats can disrupt essential services and potentially compromise food safety and operational readiness.
2 weeks ago
Kill Chain
McKesson's $55M Data Extortion: How ShinyHunters Exploited Healthcare's Cloud Vulnerabilities
In August 2024, McKesson Corporation, a major healthcare distributor handling one-third of North America's pharmaceuticals with $403.4 billion in revenue, suffered a sophisticated data extortion attack by the ShinyHunters cybercrime group. The attackers gained access to third-party applications between August 21-25, stealing sensitive data from oncology, multispecialty, and medical-surgical business units. ShinyHunters demanded over $55 million in ransom and threatened to leak stolen data by September 1, 2024, demonstrating their typical social engineering tactics to exploit identity and access management weaknesses in cloud-hosted environments. This incident highlights the escalating threat of data extortion campaigns targeting critical healthcare infrastructure, as ShinyHunters continues their spree of high-profile attacks against cloud platforms including Oracle, Salesforce, and Snowflake, exploiting valid credentials to evade traditional security controls.
2 weeks ago
Kill Chain
Federal Whistleblower Exposes Critical Security Flaws in USPS Election Systems
A federal whistleblower has exposed critical security and operational flaws in the U.S. Postal Service's rushed deployment of three new IT systems designed to control mail-in ballot processing for the 2026 midterm elections. The complaint reveals that USPS bypassed standard software development practices, including pre-release testing and security validation, to implement systems that could reject entire batches of ballots based on single scanning errors. The Federal Ballot Mail Portal and associated verification systems were developed in a matter of weeks rather than months, creating significant risks to election integrity and voter disenfranchisement. This incident highlights the growing intersection of cybersecurity vulnerabilities and critical infrastructure, particularly as election systems become increasingly digitized without proper security oversight. The rushed deployment of untested systems in mission-critical environments reflects broader challenges organizations face when political pressure overrides established security protocols and development best practices.
2 weeks ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
