Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3577 to 3588 of 5982
Critical Vulnerabilities in Hitachi Energy RTU500 Series Require Immediate Attention
In February 2026, Hitachi Energy disclosed multiple vulnerabilities affecting its RTU500 series products, including CVE-2026-1772, CVE-2026-1773, CVE-2024-8176, and CVE-2025-59375. These vulnerabilities, if exploited, could lead to unauthorized access to user management information and potential device outages. The affected firmware versions range from 12.7.1 to 13.8.1. Hitachi Energy has released firmware updates to address these issues and recommends users implement the provided mitigations to secure their systems. This incident underscores the critical importance of timely vulnerability management in industrial control systems, especially within the energy sector. Organizations are urged to stay vigilant and apply security patches promptly to mitigate potential risks associated with such vulnerabilities.
6 months ago
Kill Chain
Coruna Exploit Kit: Unveiling the First Mass-Scale iOS Attack
In early 2026, security researchers uncovered the 'Coruna' exploit kit, a sophisticated suite of hacking tools capable of compromising iPhones running older iOS versions. Initially identified in February 2025 during a surveillance vendor's attempt to deploy spyware on behalf of a government client, Coruna was later observed in attacks targeting Ukrainian users by a Russian espionage group and subsequently by financially motivated hackers in China. The exploit kit chains together multiple vulnerabilities, allowing attackers to bypass iOS defenses and gain full control over targeted devices. ([techcrunch.com](https://techcrunch.com/2026/03/03/a-suite-of-government-hacking-tools-targeting-iphones-is-now-being-used-by-cybercriminals/?utm_source=openai)) The proliferation of Coruna underscores the risks associated with the leakage of advanced cyber tools originally developed for government use. Similar to the EternalBlue exploit that fueled the WannaCry and NotPetya attacks in 2017, Coruna's widespread availability has enabled various threat actors to conduct mass-scale attacks on iOS devices, affecting at least 42,000 devices to date.
6 months ago
Kill Chain
Perplexity Comet Browser's 'PleaseFix' Vulnerabilities Expose Critical Security Flaws
In March 2026, Zenity Labs disclosed critical vulnerabilities in Perplexity's AI-powered Comet browser, collectively termed 'PleaseFix.' These flaws allowed attackers to exploit indirect prompt injections, enabling unauthorized access to local files and credential theft without user interaction. By embedding malicious prompts in trusted content, such as calendar invites, attackers could manipulate the AI agent to perform unauthorized actions, including exfiltrating sensitive data and compromising password managers like 1Password. Perplexity addressed these vulnerabilities following responsible disclosure, implementing fixes to prevent autonomous access to local file systems and unauthorized credential manipulation. This incident underscores the inherent security challenges in agentic AI systems, highlighting the need for robust safeguards against prompt injection attacks and the importance of continuous monitoring and updating of AI-driven applications to mitigate emerging threats.
6 months ago
Kill Chain
CyberStrikeAI: The AI Tool Empowering Hackers in 2026
In early 2026, cybersecurity researchers identified that threat actors had adopted CyberStrikeAI, an open-source AI-native security testing platform, to automate and enhance their cyberattacks. This tool integrates over 100 security tools with an intelligent orchestration engine, enabling end-to-end automation from vulnerability discovery to attack-chain analysis. Notably, the same infrastructure used in a campaign that breached over 500 Fortinet FortiGate firewalls was observed running CyberStrikeAI, indicating its role in facilitating these attacks. The adoption of AI-powered tools like CyberStrikeAI by cybercriminals signifies a shift towards more sophisticated and automated attack methodologies. This trend underscores the urgent need for organizations to bolster their defenses against AI-driven threats, as traditional security measures may become increasingly inadequate.
6 months ago
Kill Chain
Android 2026 Security Update Addresses Exploited Qualcomm Zero-Day
In March 2026, Google released a security update addressing 129 vulnerabilities in Android devices, notably including CVE-2026-21385—a high-severity zero-day flaw in Qualcomm's display component. This integer overflow vulnerability allows local attackers to cause memory corruption, potentially leading to unauthorized control over affected devices. The flaw impacts 234 Qualcomm chipsets, and there are indications of its limited, targeted exploitation in the wild. ([cyberscoop.com](https://cyberscoop.com/android-security-update-march-2026/?utm_source=openai)) The active exploitation of CVE-2026-21385 underscores the persistent threat posed by zero-day vulnerabilities in widely used hardware components. Organizations must prioritize timely patch management and maintain robust security protocols to mitigate risks associated with such vulnerabilities.
6 months ago
Kill Chain
University of Hawaiʻi Cancer Center's 2025 Ransomware Attack: A Wake-Up Call for Research Institutions
In August 2025, the University of Hawaiʻi Cancer Center's Epidemiology Division experienced a ransomware attack that encrypted and potentially exfiltrated sensitive data. The breach affected approximately 1.24 million individuals, exposing personal information such as Social Security numbers, driver's license numbers, and health-related data. The university engaged with cybersecurity experts and the attackers to obtain a decryption tool and secure assurances that the stolen data was destroyed. There was no impact on clinical operations, patient care, or student records. ([hawaii.edu](https://www.hawaii.edu/news/2026/02/27/notice-of-cyberattack-uh-cancer-center/?utm_source=openai)) This incident underscores the growing threat of ransomware attacks targeting research institutions and the critical importance of robust cybersecurity measures to protect sensitive personal and health information. Organizations must remain vigilant and proactive in implementing comprehensive security protocols to mitigate such risks.
6 months ago
Kill Chain
Cloud Imperium Games Data Breach: A Wake-Up Call for the Gaming Industry
In January 2026, Cloud Imperium Games (CIG), the developer behind 'Star Citizen,' experienced a sophisticated cyberattack resulting in unauthorized access to backup systems containing user data. The breach, discovered on January 21, exposed personal information including names, contact details, usernames, and dates of birth. Notably, financial information and passwords remained secure. CIG addressed the intrusion promptly, implementing enhanced security measures to prevent further incidents. ([theregister.com](https://www.theregister.com/2026/03/03/brit_games_studio_cloud_imperium/?utm_source=openai)) This incident underscores the critical importance of timely breach disclosure and robust data protection practices in the gaming industry. The delayed notification has raised concerns about transparency and user trust, highlighting the need for companies to adhere to regulatory requirements and maintain open communication with their user base. ([scworld.com](https://www.scworld.com/brief/cloud-imperium-faces-backlash-over-delayed-data-breach-disclosure?utm_source=openai))
6 months ago
Kill Chain
AWS Data Centers in Middle East Damaged by Drone Strikes
In early March 2026, Amazon Web Services (AWS) experienced significant disruptions after drone strikes targeted its data centers in the Middle East. Two facilities in the United Arab Emirates (UAE) were directly hit, while a third in Bahrain sustained damage from a nearby strike. These attacks resulted in structural damage, power outages, and water damage due to fire suppression efforts, leading to elevated error rates and degraded availability for services such as Amazon EC2, Amazon S3, and Amazon DynamoDB. AWS is collaborating with local authorities to restore services, but recovery is expected to be prolonged due to the extent of the physical damage. This incident underscores the vulnerability of critical cloud infrastructure to physical attacks, especially in regions experiencing geopolitical tensions. Organizations relying on cloud services are reminded of the importance of robust disaster recovery plans and the need to consider geographic redundancy to mitigate risks associated with localized disruptions.
6 months ago
Kill Chain
LexisNexis Data Breach: A Wake-Up Call for Third-Party Platform Security
In December 2024, LexisNexis Risk Solutions experienced a data breach when an unauthorized party accessed data stored on GitHub, a third-party platform used for software development. The breach, discovered in April 2025, exposed personal information of over 364,000 individuals, including names, contact details, Social Security numbers, driver's license numbers, and dates of birth. The company has since notified affected individuals and offered two years of complimentary identity protection and credit monitoring services. This incident underscores the critical importance of securing third-party platforms and the potential risks associated with their use. Organizations must ensure robust security measures are in place to protect sensitive data, especially when utilizing external services for development purposes.
6 months ago
Kill Chain
The Rising Threat of Compromised cPanel Credentials in Cybercrime Markets
In March 2025, a cybercriminal known as "miya" advertised for sale compromised SSH, cPanel, Mail, and WebHost Manager (WHM) credentials belonging to a Canadian car dealership on a dark web forum, pricing the access at $400. These credentials provided potential attackers with privileged access to the dealership's critical systems, including remote command-line server control via SSH, administrative capabilities through WHM and cPanel, and access to sensitive communications via the mail server. The breach underscored the escalating cybersecurity risks faced by automotive retailers, who increasingly rely on interconnected digital systems to manage sales, customer data, and backend infrastructure. ([cyberpress.org](https://cyberpress.org/cybercriminal-miya-stolen/?utm_source=openai)) This incident highlights a broader trend of cybercriminals targeting cPanel and other site management credentials to facilitate unauthorized access to web servers and associated services. The sale of such credentials on underground forums has become increasingly common, with prices ranging from $3 to $5, depending on the target and level of access provided. ([documents.trendmicro.com](https://documents.trendmicro.com/assets/wp/wp-north-american-underground.pdf?utm_source=openai))
6 months ago
Kill Chain
Chrome's 2026 Vulnerability: A Wake-Up Call for Browser Security
In January 2026, a high-severity vulnerability (CVE-2026-0628) was identified in Google Chrome's WebView component, allowing attackers to escalate privileges via malicious extensions. This flaw, present in versions prior to 143.0.7499.192, enabled unauthorized script or HTML injection into privileged pages, potentially granting access to sensitive resources. Google promptly addressed the issue by releasing a patch on January 7, 2026. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-0628?utm_source=openai)) The incident underscores the critical importance of timely software updates and vigilant extension management. As browser vulnerabilities continue to be a prime target for cyber threats, organizations must prioritize regular patching and educate users on the risks associated with unverified extensions to mitigate potential security breaches.
6 months ago
Kill Chain
Microsoft 2026 OAuth Redirection Abuse: A New Phishing Threat
In early March 2026, Microsoft identified a sophisticated phishing campaign targeting government and public-sector organizations. Attackers exploited the OAuth 2.0 redirection mechanism to bypass traditional email and browser defenses, redirecting users from legitimate authentication pages to malicious sites. This technique involved crafting OAuth authorization requests with parameters designed to trigger authentication errors, leading to redirects that facilitated malware delivery or credential harvesting. The campaign underscores the evolving tactics of threat actors in leveraging trusted authentication flows to compromise user accounts and deliver malicious payloads. This incident highlights a growing trend in the abuse of OAuth mechanisms for phishing and malware distribution. Organizations must remain vigilant, as attackers continue to refine their methods to exploit authentication protocols, emphasizing the need for robust security measures and user education to mitigate such threats.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
