Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3469 to 3480 of 5983
Unveiling 'Zombie ZIP': A New Frontier in Malware Evasion
In March 2026, security researcher Chris Aziz unveiled a novel malware evasion technique termed 'Zombie ZIP.' This method involves manipulating ZIP file headers to mislead antivirus and endpoint detection systems into treating compressed malicious payloads as uncompressed data. Consequently, security tools scan the files without detecting the embedded threats. The technique proved effective against 50 out of 51 antivirus engines tested on VirusTotal. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-zombie-zip-technique-lets-malware-slip-past-security-tools/?utm_source=openai)) The emergence of 'Zombie ZIP' underscores the evolving sophistication of malware delivery methods, highlighting the need for enhanced detection mechanisms capable of identifying such deceptive techniques. Organizations must stay vigilant and update their security protocols to counteract these advanced evasion strategies.
6 months ago
Kill Chain
BlackSanta EDR Killer: A New Threat to HR Departments in 2026
In March 2026, a sophisticated cyberattack campaign was uncovered targeting human resources (HR) departments. Russian-speaking threat actors distributed malware via spear-phishing emails containing ISO image files disguised as resumes. Upon execution, these files initiated a multi-stage infection chain, culminating in the deployment of 'BlackSanta,' an Endpoint Detection and Response (EDR) killer. BlackSanta disabled security solutions by terminating antivirus processes, shutting down EDR agents, and suppressing system logging, allowing attackers to exfiltrate sensitive data undetected. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blacksanta-edr-killer-spotted-targeting-hr-departments/?utm_source=openai)) This incident underscores a growing trend of cybercriminals exploiting HR workflows to infiltrate organizations. The use of advanced evasion techniques, such as steganography and DLL sideloading, highlights the increasing sophistication of these attacks. Organizations must enhance security measures within HR processes to mitigate such threats. ([darkreading.com](https://www.darkreading.com/threat-intelligence/blacksanta-edr-killer-hr-workflows?utm_source=openai))
6 months ago
Kill Chain
ShinyHunters Exploit Salesforce Experience Cloud Misconfigurations in 2026 Data Breach
In March 2026, Salesforce disclosed that the ShinyHunters cybercriminal group exploited misconfigured Experience Cloud sites to access sensitive data from approximately 100 high-profile companies. The attackers utilized a modified version of the open-source tool AuraInspector to identify and exploit overly permissive guest user configurations, enabling unauthorized data extraction. Salesforce emphasized that the breach resulted from customer misconfigurations rather than inherent platform vulnerabilities. This incident underscores the critical importance of adhering to security best practices when configuring cloud services. Misconfigurations can lead to significant data breaches, as demonstrated by the ShinyHunters' exploitation of Salesforce Experience Cloud sites. Organizations must regularly review and secure their cloud configurations to prevent unauthorized access and data exposure.
6 months ago
Kill Chain
BeatBanker Malware: A New Threat to Android Devices in 2026
In March 2026, cybersecurity researchers identified a new Android malware named BeatBanker, which masquerades as a legitimate Starlink application to infiltrate devices. Once installed, BeatBanker combines banking trojan functionalities with Monero cryptocurrency mining capabilities. It can steal user credentials, manipulate cryptocurrency transactions, and grant attackers full remote control over the infected device. The malware employs sophisticated evasion techniques, including playing an inaudible audio file on a loop to maintain persistence and monitoring device conditions to optimize its operations without raising suspicion. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-beatbanker-android-malware-poses-as-starlink-app-to-hijack-devices/?utm_source=openai)) This incident underscores the evolving sophistication of mobile malware, highlighting the need for heightened vigilance among users and organizations. The use of legitimate app disguises and advanced persistence mechanisms signifies a trend towards more covert and resilient cyber threats targeting mobile platforms.
6 months ago
Kill Chain
BeatBanker: The Dual-Mode Android Malware Threatening Brazilian Users in 2026
In March 2026, cybersecurity researchers identified 'BeatBanker,' a sophisticated Android malware campaign targeting users in Brazil. Disguised as legitimate applications, including a fake Google Play Store and a counterfeit Starlink app, BeatBanker employs phishing tactics to infiltrate devices. Once installed, it operates as both a cryptocurrency miner and a banking Trojan, enabling attackers to hijack devices, steal financial credentials, and manipulate cryptocurrency transactions. Notably, the malware maintains persistence by continuously playing an inaudible audio file, preventing system termination. The campaign has evolved to deploy the BTMOB remote administration tool, granting attackers full control over compromised devices. This incident underscores the escalating complexity of mobile malware threats and the critical need for users to download apps exclusively from official sources, scrutinize app permissions, and keep their systems updated to mitigate such risks.
6 months ago
Kill Chain
Microsoft SharePoint 2025 ToolShell Zero-Day Exploitation
In July 2025, a critical zero-day vulnerability, CVE-2025-53770, was discovered in Microsoft SharePoint, allowing unauthenticated remote code execution. Dubbed 'ToolShell,' this exploit enabled attackers to gain full control over affected servers, leading to data exfiltration and deployment of ransomware. The vulnerability stemmed from an incomplete fix of a 2020 issue, CVE-2020-1147, and was actively exploited by Chinese state-affiliated groups, including Storm-2603, Linen Typhoon, and Violet Typhoon. Over 400 organizations worldwide, including U.S. federal agencies and the National Nuclear Security Administration, were compromised. Microsoft released emergency patches for SharePoint Server 2019 and SharePoint Subscription Edition, but SharePoint Enterprise Server 2016 remained unpatched at the time. Organizations were urged to apply patches, rotate machine keys, and implement additional security measures to mitigate the threat. ([windowscentral.com](https://www.windowscentral.com/software-apps/were-witnessing-an-urgent-and-active-threat-microsoft-sharepoint-toolshell-vulnerability-is-being-attacked-globally?utm_source=openai)) This incident underscores the escalating risk of zero-day vulnerabilities and the rapid exploitation timelines by sophisticated threat actors. The 'ToolShell' attacks highlight the critical need for organizations to maintain vigilant patch management, continuous monitoring, and robust incident response strategies to defend against evolving cyber threats.
6 months ago
Kill Chain
KadNap Malware: Over 14,000 Asus Routers Hijacked into Stealth Botnet
In August 2025, cybersecurity researchers identified a new malware strain named KadNap, which primarily targets Asus routers to conscript them into a botnet used for proxying malicious traffic. By March 2026, over 14,000 devices had been infected, with more than 60% located in the United States. KadNap employs a customized version of the Kademlia Distributed Hash Table (DHT) protocol, enabling it to conceal command-and-control (C2) infrastructure within a peer-to-peer network, thereby evading traditional network monitoring and enhancing resilience against detection and disruption efforts. The malware is distributed through a shell script that establishes persistence via cron jobs, downloads a malicious ELF file, and executes it, effectively integrating the compromised device into the botnet. ([thehackernews.com](https://thehackernews.com/2026/03/kadnap-malware-infects-14000-edge.html?utm_source=openai)) The emergence of KadNap underscores a growing trend of sophisticated malware targeting edge networking devices, exploiting their vulnerabilities to build resilient botnets. This incident highlights the critical need for organizations and individuals to secure their network infrastructure, as such compromised devices can be leveraged for various malicious activities, including anonymizing cybercriminal operations and facilitating large-scale attacks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-kadnap-botnet-hijacks-asus-routers-to-fuel-cybercrime-proxy-network/?utm_source=openai))
6 months ago
Kill Chain
APT28's Stealthy Cyber-Espionage Tactics Target Ukrainian Military in 2026
In April 2024, the Russian state-sponsored hacking group APT28 initiated a cyber-espionage campaign targeting Ukrainian military personnel. Utilizing spear-phishing messages sent via the Signal messaging app, attackers distributed malicious Microsoft Word documents embedded with macros. Once enabled, these macros triggered a multi-stage infection chain, deploying the COVENANT framework and the BEARDSHELL backdoor. The malware leveraged legitimate cloud services like Icedrive and Koofr for command-and-control communications, facilitating long-term surveillance and data exfiltration. ([thehackernews.com](https://thehackernews.com/2026/03/apt28-uses-beardshell-and-covenant.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored actors, who increasingly exploit trusted platforms and sophisticated obfuscation techniques to evade detection. The use of legitimate cloud services for command-and-control highlights the challenges in distinguishing malicious activity from normal network traffic, emphasizing the need for advanced threat detection mechanisms. ([scworld.com](https://www.scworld.com/news/fancy-bear-attacks-abuse-office-macros-legitimate-cloud-services?utm_source=openai))
6 months ago
Kill Chain
LeakyLooker Vulnerabilities: A Wake-Up Call for Cloud Security
In March 2026, Tenable Research disclosed nine critical cross-tenant vulnerabilities, collectively termed 'LeakyLooker,' in Google Looker Studio. These flaws allowed attackers to execute arbitrary SQL queries on victims' databases, leading to potential data exfiltration, insertion, and deletion across Google Cloud Platform (GCP) services. The vulnerabilities affected organizations utilizing connectors such as Google Sheets, BigQuery, Spanner, PostgreSQL, MySQL, and Cloud Storage. Google addressed these issues following responsible disclosure in June 2025. The 'LeakyLooker' vulnerabilities underscore the evolving threat landscape in cloud environments, highlighting the necessity for robust security measures and continuous monitoring. Organizations must remain vigilant against cross-tenant vulnerabilities to safeguard sensitive data and maintain compliance with industry standards.
6 months ago
Kill Chain
FortiGate Devices Exploited to Breach Networks and Steal Service Account Credentials
In early 2026, threat actors exploited vulnerabilities and weak credentials in FortiGate Next-Generation Firewall (NGFW) appliances to breach networks across healthcare, government, and managed service providers. By accessing these devices, attackers extracted configuration files containing service account credentials and network topology information, enabling unauthorized access to Active Directory environments and the enrollment of rogue workstations. The breaches were detected during lateral movement phases, preventing further escalation. ([sentinelone.com](https://www.sentinelone.com/blog/fortigate-edge-intrusions/?utm_source=openai)) This incident underscores the critical importance of securing network infrastructure devices, as their compromise can lead to significant data breaches and operational disruptions. The exploitation of such devices highlights the evolving tactics of threat actors targeting essential security appliances to gain deeper access into organizational networks. ([sentinelone.com](https://www.sentinelone.com/blog/fortigate-edge-intrusions/?utm_source=openai))
6 months ago
Kill Chain
Odido's 2026 Data Breach: A Case Study in Social Engineering Attacks
In February 2026, Dutch telecom provider Odido experienced a significant data breach affecting over 6 million customer accounts. Attackers employed social engineering tactics, including phishing emails and impersonation of IT staff, to gain unauthorized access to Odido's customer relationship management system. This breach exposed sensitive personal information such as names, addresses, telephone numbers, bank account details, dates of birth, and government-issued ID numbers. The incident underscores the critical need for robust employee training and advanced security measures to prevent similar attacks. ([cybernews.com](https://cybernews.com/security/odido-hackers-phishing-attack/?utm_source=openai)) This breach highlights a growing trend of cybercriminals leveraging sophisticated social engineering techniques to infiltrate organizations. As these methods become more prevalent, companies must enhance their security protocols and employee awareness programs to mitigate the risk of such attacks.
6 months ago
Kill Chain
Beware of 'InstallFix' Attacks: Fake Claude Code Sites Spreading Malware
In March 2026, a cyberattack campaign known as 'InstallFix' targeted developers by creating fake installation pages for Anthropic's Claude Code, an AI coding assistant. These counterfeit sites, promoted through Google-sponsored ads, closely mimicked legitimate pages and instructed users to execute malicious commands in their terminals. This led to the deployment of Amatera Stealer malware, which harvested sensitive information such as browser credentials and cryptocurrency wallets, potentially compromising enterprise development environments. This incident underscores the growing trend of attackers exploiting the widespread practice of copying and pasting commands from online sources. It highlights the urgent need for heightened vigilance and verification of software installation sources to prevent similar social engineering attacks.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
