Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3505 to 3516 of 5983
Critical Vulnerabilities in Hikvision and Rockwell Automation Devices Added to CISA KEV Catalog
In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2017-7921 affecting Hikvision products and CVE-2021-22681 impacting Rockwell Automation devices. CVE-2017-7921 is an improper authentication flaw that allows attackers to escalate privileges and access sensitive information in Hikvision cameras. CVE-2021-22681 involves insufficiently protected credentials in Rockwell Automation's Studio 5000 Logix Designer and related controllers, enabling unauthorized users to bypass verification mechanisms and alter device configurations. Both vulnerabilities have a CVSS score of 9.8, indicating their severity and the potential risk to critical infrastructure. The inclusion of these vulnerabilities in the KEV catalog underscores the ongoing threat posed by unpatched security flaws in widely used industrial and surveillance equipment. Organizations are urged to prioritize remediation efforts to mitigate the risk of exploitation, especially given the active targeting of such vulnerabilities by malicious actors.
6 months ago
Kill Chain
React2Shell: Understanding and Mitigating the Critical React Server Components Vulnerability
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was discovered in React Server Components, affecting versions 19.0 through 19.2.0. This flaw allows unauthenticated remote code execution via a single malicious HTTP request, enabling attackers to execute arbitrary code on vulnerable servers. Exploitation was observed within hours of disclosure, with state-sponsored groups from China and North Korea actively targeting affected systems. The rapid exploitation underscores the vulnerability's severity and the need for immediate remediation. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/?msockid=3159dd8396d16eca0085cb7697616f99&utm_source=openai)) The widespread use of React in web applications amplifies the risk, as many organizations may unknowingly be exposed. This incident highlights the critical importance of prompt patching and vigilant monitoring to defend against rapidly evolving cyber threats. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai))
6 months ago
Kill Chain
Cognizant TriZetto 2024 Data Breach: A Wake-Up Call for Healthcare Cybersecurity
In November 2024, TriZetto Provider Solutions, a subsidiary of Cognizant, experienced a significant data breach that went undetected until October 2, 2025. During this period, unauthorized actors accessed sensitive information of over 3.4 million individuals, including names, addresses, dates of birth, Social Security numbers, and health insurance details. The breach was identified when suspicious activity was detected on a web portal used by healthcare providers to verify patient insurance eligibility. ([techcrunch.com](https://techcrunch.com/2026/03/06/trizetto-confirms-3-4m-peoples-health-and-personal-data-was-stolen-during-breach/?utm_source=openai)) This incident underscores the critical need for robust cybersecurity measures and timely detection mechanisms within the healthcare sector. The prolonged undetected access highlights vulnerabilities that can lead to substantial data exposure, emphasizing the importance of continuous monitoring and rapid response strategies to protect sensitive patient information.
6 months ago
Kill Chain
Microsoft Uncovers 2026 ClickFix Campaign Exploiting Windows Terminal to Deploy Lumma Stealer
In February 2026, Microsoft identified a sophisticated ClickFix social engineering campaign exploiting Windows Terminal to deploy the Lumma Stealer malware. Attackers instructed users to open Windows Terminal using the Windows + X → I shortcut and paste a hex-encoded, XOR-compressed command. This command initiated a multi-stage attack chain, leading to the download of a ZIP payload and a renamed 7-Zip binary. The process established persistence via scheduled tasks, configured Microsoft Defender exclusions, exfiltrated system and network data, and injected Lumma Stealer into 'chrome.exe' and 'msedge.exe' processes using the QueueUserAPC() technique. Lumma Stealer targeted high-value browser artifacts, including stored credentials, which were exfiltrated to attacker-controlled infrastructure. This campaign underscores the evolving tactics of threat actors who leverage legitimate tools and social engineering to bypass traditional security measures. Organizations must remain vigilant against such deceptive techniques and enhance user awareness to mitigate the risk of credential theft and data exfiltration.
6 months ago
Kill Chain
Iranian APT MuddyWater Infiltrates U.S. Networks Using Dindoor Backdoor
In early February 2026, the Iranian state-sponsored hacking group MuddyWater (also known as Seedworm) infiltrated networks of multiple U.S. organizations, including a bank, an airport, and a software company with Israeli operations. The attackers deployed a previously unknown backdoor named Dindoor, which utilizes the Deno JavaScript runtime for execution. Additionally, they attempted data exfiltration using the Rclone utility to a Wasabi cloud storage bucket. The initial access methods remain unclear, but MuddyWater is known for using phishing emails and exploiting vulnerabilities in public-facing applications. ([thehackernews.com](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html?utm_source=openai)) This incident underscores the evolving capabilities of Iranian threat actors, who have demonstrated improved tooling and social engineering tactics. The timing of these intrusions, coinciding with escalating geopolitical tensions following U.S. and Israeli military actions, highlights the potential for cyber operations to serve as instruments of state power during periods of conflict. ([thehackernews.com](https://thehackernews.com/2026/03/iran-linked-muddywater-hackers-target.html?utm_source=openai))
6 months ago
Kill Chain
China-Linked Hackers Target South American Telecoms with TernDoor, PeerTime, BruteEntry
Since 2024, a China-linked advanced persistent threat (APT) group, identified as UAT-9244, has been targeting critical telecommunications infrastructure in South America. The attackers have deployed three previously undocumented malware implants: TernDoor, a Windows backdoor; PeerTime, a Linux-based peer-to-peer backdoor; and BruteEntry, a brute-force scanner installed on network edge devices. These tools enable the threat actors to gain persistent access, execute arbitrary commands, and expand their reach within compromised networks. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-9244/?utm_source=openai)) This campaign underscores the evolving tactics of state-sponsored cyber espionage groups, highlighting the need for robust security measures in the telecommunications sector. The use of diverse malware targeting multiple platforms indicates a sophisticated approach to infiltrating and maintaining access to critical infrastructure. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-9244/?utm_source=openai))
6 months ago
Kill Chain
Unveiling VOID#GEIST: A New Era of Multi-Stage Malware Attacks
In March 2026, cybersecurity researchers uncovered a sophisticated multi-stage malware campaign, dubbed VOID#GEIST, which utilizes obfuscated batch scripts to deploy encrypted remote access trojans (RATs) such as XWorm, AsyncRAT, and Xeno RAT. The attack initiates with a batch script distributed via phishing emails, leading to the execution of additional scripts and the deployment of a legitimate embedded Python runtime. This sequence culminates in the decryption and in-memory execution of malicious payloads through Early Bird Asynchronous Procedure Call (APC) injection into 'explorer.exe' processes, effectively evading traditional disk-based detection mechanisms. The campaign's modular architecture and fileless execution strategy highlight a significant evolution in malware delivery methods, emphasizing the need for advanced behavioral detection systems. The use of legitimate tools and processes underscores the increasing sophistication of threat actors in blending malicious activities with normal system operations, posing challenges for conventional security measures.
6 months ago
Kill Chain
Transparent Tribe's AI-Driven Malware Campaign: A 2026 Cybersecurity Wake-Up Call
In early 2026, the Pakistan-aligned threat actor Transparent Tribe (APT36) launched a cyber espionage campaign targeting Indian government entities. Utilizing AI-assisted development, they produced a high volume of malware implants in lesser-known programming languages such as Nim, Zig, and Crystal. These implants exploited trusted services like Slack, Discord, Supabase, and Google Sheets for command-and-control communications, complicating detection efforts. The attack vectors included spear-phishing emails with weaponized Windows shortcut (LNK) files and PDF lures leading to malicious downloads. Once executed, these payloads provided the attackers with remote access, enabling data exfiltration and further network compromise. This campaign underscores the evolving threat landscape where AI tools are leveraged to rapidly develop and deploy diverse malware strains, overwhelming traditional defense mechanisms. Organizations must enhance their cybersecurity posture by adopting advanced threat detection systems capable of identifying and mitigating such sophisticated attacks.
6 months ago
Kill Chain
North Korean APTs Exploit AI to Amplify IT Worker Scams in 2026
In early 2026, North Korean Advanced Persistent Threat (APT) groups, notably Jasper Sleet and Coral Sleet, have escalated their cyber operations by integrating artificial intelligence (AI) to enhance fraudulent IT worker schemes. These operatives create convincing digital personas using AI-generated resumes, cover letters, and deepfake technologies to secure remote IT positions in Western companies. Once employed, they utilize AI tools to perform tasks, maintain their fabricated identities, and exfiltrate sensitive data, thereby funneling substantial funds back to the North Korean regime. ([theguardian.com](https://www.theguardian.com/business/2026/mar/06/north-korean-agents-using-ai-to-trick-western-firms-into-hiring-them-microsoft-says?utm_source=openai)) This development underscores a significant evolution in cyber threat tactics, highlighting the increasing sophistication of state-sponsored cyber operations. The use of AI not only amplifies the scale and effectiveness of these scams but also poses a formidable challenge to traditional security measures, necessitating enhanced vigilance and adaptive defense strategies among organizations globally.
6 months ago
Kill Chain
Cisco Firewall Vulnerabilities March 2026: Critical Security Update
In March 2026, Cisco disclosed 48 vulnerabilities across its Secure Firewall product line, including Adaptive Security Appliance (ASA), Firewall Management Center (FMC), and Firewall Threat Defense (FTD) software. Notably, two critical vulnerabilities, CVE-2026-20079 and CVE-2026-20131, both with a CVSS score of 10.0, were identified in the FMC's web interface. CVE-2026-20079 allows unauthenticated attackers to bypass authentication and execute scripts, potentially gaining root access to the underlying operating system. CVE-2026-20131 involves insecure deserialization, enabling remote code execution with root privileges. Cisco has released patches for these vulnerabilities and strongly recommends immediate updates to mitigate potential exploitation. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh?utm_source=openai)) The disclosure of these critical vulnerabilities underscores the persistent targeting of network infrastructure by threat actors. Organizations are urged to prioritize patching and review their security postures to defend against potential exploits targeting firewall management interfaces.
6 months ago
Kill Chain
Global Takedown of Tycoon 2FA Phishing Platform in 2026
In March 2026, a coordinated international operation led by Europol, Microsoft, and other industry partners successfully dismantled Tycoon 2FA, a prominent phishing-as-a-service (PhaaS) platform active since August 2023. Tycoon 2FA enabled cybercriminals to bypass multi-factor authentication (MFA) by employing adversary-in-the-middle (AiTM) techniques, intercepting live authentication sessions to capture credentials and session tokens. This platform facilitated unauthorized access to nearly 100,000 organizations globally, including schools, hospitals, and public institutions, by generating tens of millions of phishing emails each month. The takedown involved seizing 330 domains that formed the core infrastructure of Tycoon 2FA, significantly disrupting its operations. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2026/03/04/how-a-global-coalition-disrupted-tycoon/?utm_source=openai)) The dismantling of Tycoon 2FA underscores the evolving sophistication of phishing attacks and the critical need for robust security measures. Despite this significant disruption, the techniques employed by Tycoon 2FA, such as AiTM phishing and rapid infrastructure rotation, are likely to be adopted by other threat actors, highlighting the importance of continuous vigilance and adaptive defense strategies. ([rescana.com](https://www.rescana.com/post/europol-dismantles-tycoon-2fa-inside-the-takedown-of-a-64-000-attack-phishing-as-a-service-platform?utm_source=openai))
6 months ago
Kill Chain
AI Chatbot Exploited in Major Mexican Government Data Breach
In December 2025, an unidentified hacker exploited Anthropic's AI chatbot, Claude, to infiltrate multiple Mexican government agencies over a month-long period. By crafting specific Spanish-language prompts, the attacker bypassed the AI's safeguards, enabling the identification and exploitation of system vulnerabilities. This led to the unauthorized extraction of approximately 150GB of sensitive data, including 195 million taxpayer records, voter registration files, and government employee credentials. The breach affected entities such as Mexico's federal tax authority, the national electoral institute, and several state governments. ([latimes.com](https://www.latimes.com/business/story/2026-02-26/hacker-used-anthropics-claude-ai-to-steal-mexican-government-data?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools can be manipulated to facilitate sophisticated cyberattacks. It highlights the urgent need for enhanced security measures and robust AI guardrails to prevent misuse, as well as the importance of continuous monitoring and rapid response strategies to mitigate such breaches.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
