Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3553 to 3564 of 5982
FBI Dismantles LeakBase Cybercrime Forum in Coordinated International Operation
In early March 2026, the FBI, in collaboration with international law enforcement agencies, dismantled LeakBase, a major cybercriminal forum with over 142,000 members. LeakBase facilitated the trade of stolen data and hacking tools, hosting an extensive archive of compromised databases containing hundreds of millions of account credentials. The coordinated operation, known as 'Operation Leak,' involved synchronized actions across 14 countries, including domain seizures, arrests, and evidence collection. This takedown underscores the escalating global efforts to combat cybercrime networks and disrupt platforms that enable the proliferation of stolen data and cyberattack tools. The seizure of LeakBase serves as a stark warning to cybercriminals about the increasing reach and effectiveness of international law enforcement collaborations.
6 months ago
Kill Chain
Coruna iOS Exploit Kit: A 2025 Cybersecurity Threat Analysis
In 2025, the Coruna iOS exploit kit emerged as a sophisticated tool targeting iPhone users across multiple campaigns. Initially identified in February 2025, it was deployed by a surveillance vendor's customer. By summer, the same exploit kit was utilized by the Russian espionage group UNC6353 in watering hole attacks on Ukrainian websites. Later in the year, the financially motivated Chinese threat actor UNC6691 employed Coruna to compromise fake Chinese gambling and cryptocurrency sites. The kit comprises 23 exploits forming five full exploit chains, affecting iOS versions 13.0 through 17.2.1. These exploits enable remote code execution, sandbox escapes, and kernel privilege escalation, leading to unauthorized access and data exfiltration. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks/?utm_source=openai)) The proliferation of Coruna underscores a concerning trend: advanced exploit kits, possibly originating from state-sponsored entities, are increasingly accessible to a broader range of threat actors. This shift highlights the urgent need for organizations to stay vigilant, update their systems promptly, and implement robust security measures to mitigate the risks posed by such sophisticated tools. ([wired.com](https://www.wired.com/story/coruna-iphone-hacking-toolkit-us-government/?utm_source=openai))
6 months ago
Kill Chain
Critical Cisco Firewall Vulnerabilities Disclosed in 2026
In March 2026, Cisco disclosed two critical vulnerabilities in its Secure Firewall Management Center (FMC) software: an authentication bypass flaw (CVE-2026-20079) and a remote code execution (RCE) vulnerability (CVE-2026-20131). Both vulnerabilities allow unauthenticated, remote attackers to gain root access to affected devices. CVE-2026-20079 enables attackers to execute scripts and commands by sending crafted HTTP requests, while CVE-2026-20131 allows execution of arbitrary Java code through crafted serialized Java objects. These flaws affect both on-premises FMC installations and Cisco's Security Cloud Control (SCC) Firewall Management. Cisco has released patches to address these issues and recommends immediate updates to mitigate potential risks. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-fmc-rce-NKhnULJh?utm_source=openai)) The disclosure of these vulnerabilities underscores the ongoing challenges in securing network management interfaces. Organizations are urged to review their security postures, especially concerning remote access and authentication mechanisms, to prevent potential exploitation of similar flaws in the future.
6 months ago
Kill Chain
LastPass Users Targeted in Sophisticated Phishing Attack
In early March 2026, LastPass users were targeted by a sophisticated phishing campaign. Attackers sent emails impersonating LastPass support, claiming unauthorized attempts to change users' account email addresses. These emails included links labeled 'report suspicious activity' and 'disconnect and lock vault,' directing recipients to a counterfeit LastPass login page designed to harvest credentials. The phishing emails often appeared as forwarded internal conversations to create a sense of urgency and legitimacy. LastPass confirmed that their systems remained uncompromised and emphasized that they would never request users' master passwords via email. This incident underscores the evolving tactics of cybercriminals who exploit trust in established brands to deceive users. The use of realistic email threads and urgent security alerts highlights the need for continuous vigilance and user education to recognize and resist such social engineering attacks.
6 months ago
Kill Chain
Critical Unauthenticated Command Injection Vulnerability in VMware Aria Operations
In February 2026, a critical command injection vulnerability (CVE-2026-22719) was identified in VMware Aria Operations, allowing unauthenticated attackers to execute arbitrary commands during support-assisted product migrations. This flaw, with a CVSS score of 8.1, could lead to remote code execution, potentially compromising the entire system. Broadcom released patches to address this issue, but reports indicate active exploitation in the wild. ([thehackernews.com](https://thehackernews.com/2026/03/cisa-adds-actively-exploited-vmware.html?utm_source=openai)) The inclusion of CVE-2026-22719 in CISA's Known Exploited Vulnerabilities catalog underscores the urgency for organizations to apply the provided patches promptly. Delayed remediation increases the risk of unauthorized access and system compromise, especially during migration processes. ([securityweek.com](https://www.securityweek.com/vmware-aria-operations-vulnerability-exploited-in-the-wild/?utm_source=openai))
6 months ago
Kill Chain
Silver Dragon APT41 Targets Governments with Cobalt Strike and Google Drive C2
Silver Dragon, an advanced persistent threat (APT) group linked to China's APT41, has been actively targeting government entities in Europe and Southeast Asia since mid-2024. The group gains initial access by exploiting vulnerabilities in public-facing servers and through phishing emails containing malicious attachments. To maintain persistence, Silver Dragon hijacks legitimate Windows services, allowing their malware to blend seamlessly into normal system activity. Notably, they employ Cobalt Strike beacons for persistence and utilize Google Drive for command-and-control (C2) communications, effectively evading traditional detection mechanisms. ([thehackernews.com](https://thehackernews.com/2026/03/apt41-linked-silver-dragon-targets.html?utm_source=openai))This incident underscores a concerning trend where threat actors increasingly leverage legitimate cloud services for C2 operations, complicating detection and mitigation efforts. The use of tools like Cobalt Strike and Google Drive in cyber-espionage campaigns highlights the need for enhanced monitoring of both inbound and outbound network traffic to identify and thwart such sophisticated attacks. ([research.checkpoint.com](https://research.checkpoint.com/2026/silver-dragon-targets-organizations-in-southeast-asia-and-europe/?utm_source=openai))
6 months ago
Kill Chain
Critical Zero-Click RCE Vulnerability in FreeScout: Immediate Action Required
In March 2026, a critical zero-click remote code execution (RCE) vulnerability, identified as CVE-2026-28289, was discovered in FreeScout, an open-source help desk platform. This flaw allows unauthenticated attackers to execute arbitrary code on servers by sending a specially crafted email to a FreeScout-configured mailbox. The vulnerability arises from a Time-of-Check to Time-of-Use (TOCTOU) flaw in the filename sanitization function, enabling the upload of malicious .htaccess files with zero-width space characters to bypass security checks. Exploitation can lead to full server compromise, data breaches, and potential lateral movement within networks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/mail2shell-zero-click-attack-lets-hackers-hijack-freescout-mail-servers/?utm_source=openai)) The emergence of CVE-2026-28289 underscores the evolving sophistication of cyber threats, particularly those requiring no user interaction. Organizations utilizing FreeScout are urged to update to version 1.8.207 immediately to mitigate this risk. This incident highlights the critical need for continuous monitoring and prompt patch management to defend against rapidly developing vulnerabilities.
6 months ago
Kill Chain
2025 Mobile Malware Surge: Key Threats and Protective Measures
In 2025, Kaspersky's analysis revealed a significant surge in mobile malware attacks, with over 14 million incidents involving malicious, advertising, or unwanted software targeting mobile devices. Notably, adware constituted 62% of these detections, while the number of new Trojan banker installation packages for Android escalated to 255,090, marking a 271% increase from the previous year. This sharp rise underscores the growing profitability of such attacks for cybercriminals. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai)) The proliferation of preinstalled backdoors like Triada and Keenadu, embedded during device manufacturing, presents a formidable challenge, granting attackers extensive control over compromised devices. Additionally, the emergence of the Kimwolf IoT botnet, which exploits Android TV boxes for DDoS attacks and as reverse proxies, highlights the expanding threat landscape. These developments necessitate heightened vigilance and robust security measures to safeguard mobile users. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/the-number-of-trojan-banker-attacks-on-smartphones-increased-by-56-in-2025?utm_source=openai))
6 months ago
Kill Chain
Malicious Laravel Packages Deploy PHP RAT
In March 2026, cybersecurity researchers identified malicious PHP packages on Packagist, masquerading as Laravel utilities, which deployed a cross-platform remote access trojan (RAT) functional on Windows, macOS, and Linux systems. The packages—nhattuanbl/lara-helper, nhattuanbl/simple-queue, and nhattuanbl/lara-swagger—were published by the user 'nhattuanbl' and contained obfuscated code that, once installed, connected to a command-and-control server, granting attackers full remote access to compromised hosts. This access allowed for execution of shell commands, file manipulation, and system reconnaissance, posing significant security risks to affected applications. ([thehackernews.com](https://thehackernews.com/2026/03/fake-laravel-packages-on-packagist.html?utm_source=openai)) This incident underscores the growing threat of supply chain attacks targeting open-source ecosystems. Developers are urged to exercise caution when incorporating third-party packages, especially from less-known sources, and to implement rigorous security audits to detect and mitigate such vulnerabilities.
6 months ago
Kill Chain
Surge in Hacktivist DDoS Attacks Amid Middle East Tensions
Between February 28 and March 2, 2026, a surge of 149 hacktivist-driven distributed denial-of-service (DDoS) attacks targeted 110 organizations across 16 countries. This wave of cyber assaults was primarily in response to the U.S.-Israel coordinated military campaign against Iran, codenamed Epic Fury and Roaring Lion. The attacks predominantly focused on government entities, financial institutions, and telecommunications sectors, with the majority occurring in the Middle East, particularly in Kuwait, Israel, and Jordan. Notably, two hacktivist groups, Keymous+ and DieNet, were responsible for nearly 70% of the attack activity during this period. ([thehackernews.com](https://thehackernews.com/2026/03/149-hacktivist-ddos-attacks-hit-110.html?utm_source=openai)) This incident underscores the escalating trend of cyber retaliation in geopolitical conflicts, highlighting the need for organizations to bolster their cybersecurity defenses against ideologically motivated threat actors. The concentrated nature of these attacks emphasizes the importance of proactive threat intelligence and robust incident response strategies to mitigate potential disruptions to critical infrastructure and services.
6 months ago
Kill Chain
Understanding the Coruna iOS Exploit Kit: Implications and Protections
In early 2026, Google’s Threat Intelligence Group identified 'Coruna,' a sophisticated iOS exploit kit targeting devices running iOS versions 13.0 through 17.2.1. The kit comprises five full exploit chains utilizing 23 vulnerabilities, enabling attackers to execute remote code and escalate privileges. Initially observed in February 2025 within a surveillance vendor's operations, Coruna was subsequently employed by Russian espionage groups in mid-2025 and later by financially motivated Chinese cybercriminals by December 2025. The exploit kit facilitates the deployment of malware capable of exfiltrating sensitive data, including cryptocurrency wallets and personal information. ([thehackernews.com](https://thehackernews.com/2026/03/coruna-ios-exploit-kit-uses-23-exploits.html?utm_source=openai)) The emergence of Coruna underscores a concerning trend where advanced cyber tools, potentially developed by nation-states, proliferate into the hands of various threat actors. This incident highlights the critical need for organizations and individuals to maintain up-to-date software and implement robust security measures to mitigate the risks posed by such sophisticated exploits. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai))
6 months ago
Kill Chain
Iranian Cyber Retaliation in March 2026: A Wake-Up Call for Critical Infrastructure Security
In March 2026, following coordinated US-Israeli military strikes on Iran, Iranian state-sponsored cyber actors launched retaliatory cyber operations targeting critical infrastructure across the Middle East and the United States. These operations included Distributed Denial-of-Service (DDoS) attacks, phishing campaigns, and attempts to compromise surveillance systems. Notably, a malicious replica of the Israeli Home Front Command's RedAlert application was distributed to deliver surveillance malware, and internet-connected surveillance cameras in multiple countries were targeted to support operational planning and battle damage assessment. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/?utm_source=openai)) The escalation underscores the persistent cyber threat posed by Iranian actors, who have demonstrated the capability to exploit geopolitical tensions to conduct disruptive cyber activities. Organizations, especially those in critical infrastructure sectors, should remain vigilant and enhance their cybersecurity measures to mitigate potential risks associated with such state-sponsored cyber operations.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
