STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 25 to 36 of 6831 threat reports

Government Administration1 day ago

When Allies Become Attackers: Belarus APT FrostyNeighbor Deploys Wiper Against Ukrainian Critical Infrastructure

In Q2–Q3 2026, ESET researchers documented the first confirmed destructive cyberattack by a Belarus-aligned advanced persistent threat group, tracked as FrostyNeighbor (also known as UNC1151), against a Ukrainian manufacturing company critical to the country's transportation sector. The threat actor deployed Chisel, UltraVNC, Cobalt Strike, and a VBScript-based wiper distributed via Group Policy Objects, combining espionage-grade remote access tooling with destructive payload delivery. This escalation marks a strategic shift: a historically espionage-focused actor has crossed into destructive operations, acting as a force multiplier for Russian cyber objectives across the European theater. This incident signals a broader geopolitical realignment in offensive cyber operations. Belarus-linked groups are no longer operating as peripheral actors—they are increasingly executing campaigns that mirror Russian intelligence priorities, expanding the threat surface for NATO-adjacent nations, transportation networks, defense supply chains, and critical infrastructure operators across Europe.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(high)

Read report

Information Technology/IT1 day ago

Low-Effort Anthropic Phishing Emails Are Slipping Past Enterprise Email Security—Here's How

Beginning in September 2026, an unidentified threat actor launched a credential-phishing campaign impersonating Anthropic, the AI company behind Claude, to steal Google and Microsoft account credentials. Attackers sent emails from a legitimate GoTo Webinar shared address, used Zapier URL shortening to obscure malicious links, and layered two CAPTCHAs—one Cloudflare-based to block automated scanners, one custom-built to filter out VPNs and Tor—to funnel victims to fake Zoom or spoofed Anthropic SSO pages. Despite obvious grammatical errors, typos, and absent brand assets, these emails bypassed Proofpoint SEG and Microsoft Defender for Office 365, underscoring persistent blind spots in perimeter email defenses. This campaign illustrates a widening gap between email security tool coverage and real-world phishing delivery. As threat actors increasingly abuse legitimate SaaS infrastructure and URL obfuscation to evade detection, organizations face mounting pressure to adopt identity-centric, layered defenses—including phishing-resistant MFA, least-privilege access, and domain-validation password managers—rather than relying solely on gateway filtering.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services1 day ago

Binance 2026: How North Korea's TraderTraitor Stole $6.4 Billion Through a Single Compromised Laptop

On October 30, 2026, Binance—the world's largest cryptocurrency exchange—disclosed a catastrophic security breach resulting in approximately $6.43 billion in stolen digital assets, surpassing the 2025 Bybit hack as the largest cryptocurrency theft in history. Attributed with high confidence to North Korea's TraderTraitor group, the attack began at least 36 hours prior with preparation involving a compromised DevOps engineer's laptop. Attackers gained access to a service container, pre-signed 50 batch authorizations against Binance's hot wallet signing system, and in a single transaction drained 167,464 ETH and 63 tokens including 1.615 billion USDT. Blockchain intelligence firms Chainalysis, TRM Labs, and Elliptic confirmed the DPRK link via fund commingling with the prior Bitget exploit and shared tradecraft signatures. This incident underscores a deepening trend of supply-chain and insider-endpoint attacks targeting cryptocurrency infrastructure, where adversaries compromise the human and DevOps layer rather than cryptographic keys themselves. North Korea's TraderTraitor group has now executed three mega-heists in under two years, demonstrating industrialized, automated laundering capabilities that outpace conventional freezing and tracing responses.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Computer Software/Engineering1 day ago

CISA KEV Alert: GitLab CVSS 10.0 RCE and Cisco ASA DoS Flaws Under Active Exploitation — What Cloud Security Teams Must Do Now

In late October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmed active exploitation. CVE-2026-97229, a CVSS 10.0 integer overflow in GitLab CE/EE, allowed unauthenticated remote code execution via malicious CI/CD configurations. An unknown threat actor targeted Alpine Linux's GitLab instance on October 20–21, crashing worker processes eight times before being blocked on October 25–26. CVE-2026-76418, a CVSS 8.6 null pointer dereference in Cisco ASA and FTD, enabled unauthenticated attackers to trigger denial-of-service reloads. FCEB agencies were given until November 1, 2026 to apply patches. These incidents highlight the growing attack surface in DevSecOps toolchains and network security appliances. Supply-chain targeting of CI/CD platforms like GitLab is accelerating, and firewall DoS vulnerabilities are being weaponized to disable perimeter defenses before follow-on intrusion. Unpatched infrastructure remains the most reliable initial access vector for nation-state and financially motivated actors alike.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(high)

Read report

Computer Software/Engineering1 day ago

Trojanized Claude Code Extension: How a Single Cursor Marketplace Update Backdoored 5,000 Developer Machines

On October 29, 2026, a trojanized version of Anthropic's official Claude Code extension (version 2.1.313) was distributed through Cursor's IDE marketplace under the legitimate publisher identity anthropic.claude-code. Between approximately 2:27 a.m. and 1:35 p.m. PT, up to 5,000 developers auto-updated to the malicious build, which injected a 66-line JavaScript loader to plant an attacker-controlled SSH key labeled "svc-telemetry," establish a reverse tunnel to 134.209.82.225, install cross-platform persistence, and beacon host reconnaissance data—including environment variable names referencing cloud credentials—over unencrypted HTTP to port 8099. This incident reflects a sharp escalation in software supply-chain attacks targeting AI developer tooling. As agentic AI extensions gain privileged access to developer workstations and cloud credential stores, attackers are exploiting marketplace trust relationships and auto-update mechanisms to achieve persistent footholds at the earliest stage of the software development lifecycle, compressing the window between initial compromise and credential exposure.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Retail Industry1 day ago

Critical Drupal Commerce Authorization Bypass (CVE-2026-118539) Under Active Exploitation: What Security Teams Must Do Now

In October 2026, Drupal disclosed active exploitation of CVE-2026-118539, a highly critical authorization bypass flaw in Commerce Core versions 0.0.0–2.41 and 3.0.0–3.3.13. The vulnerability stems from insufficiently protected routes and entity fields, allowing unauthenticated or low-privileged attackers to bypass access controls on shopping cart and checkout APIs. Threat actors are leveraging the flaw to financially impact vendors operating e-commerce storefronts built on Drupal, potentially manipulating orders, pricing, or payment flows without authorization. Drupal has issued patched releases and urges immediate upgrades to Commerce Core 8.x-2.41 or 3.3.13. This incident coincides with simultaneous active exploitation of PHP2Shell (CVE-2026-109618 and CVE-2026-109619), underscoring a broadening wave of web application attacks targeting open-source CMS and runtime ecosystems. The convergence of multiple critical CVEs in widely deployed platforms signals escalating attacker investment in opportunistic web exploitation chains.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services1 day ago

Inside the CryptoBilis Hardware Implant: How Attackers Turned Trusted Crypto Wallets Into Cellular Spies

In October 2026, Trezor issued an urgent warning after a customer in Indonesia reported discovering an unauthorized circuit board inside a Trezor Safe 5 hardware wallet purchased from authorized Southeast Asian reseller CryptoBilis via the Tokopedia marketplace. The implanted board, positioned between the device's main board and screen, contained a cellular module and antenna capable of reading and transmitting the wallet's recovery phrase over a mobile network whenever the device was powered. Trezor revoked CryptoBilis's reseller status on October 9 and advised all buyers since March 2026 to immediately transfer funds to a newly seeded wallet, as restoring the old seed phrase on a clean device provides no protection if the phrase was already exfiltrated. This incident follows a parallel hardware-implant discovery in Ledger wallets sourced from the same reseller, prompting a Singapore Police advisory and active criminal investigations. This supply-chain hardware implant attack represents a critical escalation in cryptocurrency theft tactics, moving beyond software exploits and phishing to physical interdiction of trusted devices before they reach end users. With multiple wallet brands and retail channels implicated across Southeast Asia, the campaign signals a sophisticated, organized threat actor willing to invest in hardware-level compromise—a trend that raises the security bar for any organization relying on hardware roots of trust.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Financial Services1 day ago

AI Is Now a Standard Weapon in North Korea's Cyber Arsenal—Here's What That Means for Your Cloud

Throughout 2026, Microsoft Threat Intelligence documented North Korean state-sponsored threat actors—including Jade Sleet, Coral Sleet, Onyx Sleet, Diamond Sleet, Sapphire Sleet, Pearl Sleet, Jasper Sleet, and Emerald Sleet—systematically embedding generative and agentic AI into every phase of their attack chains. AI accelerated reconnaissance, mass-produced spear-phishing lures (Onyx Sleet generated dozens of tailored PDF decoys within minutes), enabled supply-chain trojans built with AI-assisted development platforms, and supported large-scale fraudulent IT worker schemes. Jade Sleet launched campaigns across three fabricated front companies in a single week, while Sapphire Sleet likely used AI during an August 2026 Rust software supply-chain compromise. The operations advance regime goals: cryptocurrency theft, strategic intelligence collection, and sanctions evasion. This report signals a structural inflection point: AI is no longer an experimental add-on for nation-state actors—it is an operationalized force multiplier. Defenders face AI-generated lures, AI-accelerated retooling, and agentic penetration-testing frameworks (ARTEX) deployed in live operations, demanding equally automated, cloud-native defensive architectures to keep pace.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(medium)

Read report

Financial Services1 day ago

Amatera: The Professionalized Infostealer Dominating Latin America in 2026

Amatera is a sophisticated infostealer malware that emerged as the top infostealer detection in Latin America during the first half of 2026, according to ESET telemetry. The malware is distributed through malvertising campaigns, trojanized software installers, and phishing lures, targeting stored credentials, browser session tokens, cryptocurrency wallets, and sensitive files. Once executed, Amatera exfiltrates harvested data over encrypted channels to attacker-controlled command-and-control infrastructure, demonstrating a highly professionalized cybercrime supply chain model. Its modular architecture and stealth evasion techniques make it difficult to detect with signature-based tools alone, amplifying the risk to enterprise environments across financial services, retail, and healthcare sectors. Amatera exemplifies the growing commoditization of infostealer-as-a-service operations, where low-barrier access to advanced credential-theft tooling enables a broad range of threat actors to conduct high-impact campaigns. The rise of such professionalized malware families mirrors broader trends including the increased targeting of cloud-hosted identities, MFA bypass via stolen session tokens, and downstream ransomware deployment using harvested credentials.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(medium)

Read report

Government Administration1 day ago

Cisco Firewall Zero-Day CVE-2026-76418: What the SSL VPN DoS Attack Means for Your Network Security

In October 2026, Cisco disclosed an actively exploited zero-day vulnerability (CVE-2026-76418) in its Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. Unauthenticated remote attackers were found sending crafted requests to SSL VPN tunnel groups with secondary authentication configured, triggering logic errors that caused affected firewall devices to reload unexpectedly and enter a denial-of-service (DoS) condition. Cisco's PSIRT confirmed in-the-wild exploitation with no available workaround except disabling secondary authentication or patching immediately. Over 51,000 internet-exposed Cisco ASA SSL VPN devices were identified as potentially vulnerable via Shadowserver telemetry, representing significant operational risk for enterprises dependent on VPN availability. This incident is the latest in a sustained pattern of Cisco network appliance zero-days being weaponized in the wild—following CVE-2025-20362, CVE-2025-20333, and the ArcaneDoor campaign exploiting CVE-2024-20353 and CVE-2024-20359. Perimeter firewall and VPN devices remain high-value targets for nation-state and criminal actors, demanding faster patch cycles, compensating network controls, and reduced reliance on single-layer perimeter defenses.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(low)

LMLateral Movement(low)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(high)

Read report

Government Administration1 day ago

Fragnesia + PHP2Shell: How Attackers Are Chaining CVEs to Root Government Servers

In late October 2026, CISA issued an urgent warning after threat actors were observed chaining two critical PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619, collectively tracked as PHP2Shell) with a high-severity Linux kernel privilege escalation flaw (CVE-2026-46300, dubbed Fragnesia) to implant webshells and execute commands as root. Dream Security researchers documented a campaign that successfully compromised 25 servers across the US, Japan, Taiwan, and South Korea—including three in a US government-affiliated environment—using approximately 40 custom post-exploitation scripts. CISA added both vulnerability sets to its KEV Catalog and mandated patching deadlines for FCEB agencies under BOD 26-04. This exploit chain reflects a growing attacker playbook: combine an internet-facing application flaw for initial access with a local privilege escalation to achieve full root control. The campaign underscores how rapidly threat actors weaponize chained CVEs once proof-of-concept code is publicly available, compressing the window between disclosure and active exploitation to days.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(medium)

Read report

Information Technology/IT1 day ago

13.4 Million Users Exposed: How 319 Chrome Extensions Quietly Hijacked Every Search Query

In October 2026, security researchers at Socket uncovered a large-scale browser hijacking campaign involving 319 malicious Chrome extensions with a combined 13.4 million reported installations. These extensions—disguised as PDF converters, AI search tools, and safe-browsing utilities—silently replaced users' default search engines and routed queries through operator-controlled proxy servers before landing on Bing or Yahoo, generating fraudulent referral revenue. The extensions were unlisted on the Chrome Web Store and distributed via deceptive advertisements. Critically, the proxy destinations can be changed server-side at any time, meaning extensions already installed could pivot to delivering phishing pages or malicious downloads without any update to the extension itself. This campaign highlights a growing trend of supply-chain-style abuse of trusted browser extension ecosystems. As threat actors refine techniques to bypass platform review processes and leverage legitimate ad networks for distribution, organizations face escalating risk from endpoints compromised by seemingly benign productivity tools—underscoring urgent need for endpoint visibility, egress controls, and user-awareness programs.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

1 2 3 4 5...570

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

exec-13ea3b13-c046-4c3f-bdef-bfc6448ce51d

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Matt Snyder

Oct 26, 202610 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

When Allies Become Attackers: Belarus APT FrostyNeighbor Deploys Wiper Against Ukrainian Critical Infrastructure

Low-Effort Anthropic Phishing Emails Are Slipping Past Enterprise Email Security—Here's How

Binance 2026: How North Korea's TraderTraitor Stole $6.4 Billion Through a Single Compromised Laptop

CISA KEV Alert: GitLab CVSS 10.0 RCE and Cisco ASA DoS Flaws Under Active Exploitation — What Cloud Security Teams Must Do Now

Trojanized Claude Code Extension: How a Single Cursor Marketplace Update Backdoored 5,000 Developer Machines

Critical Drupal Commerce Authorization Bypass (CVE-2026-118539) Under Active Exploitation: What Security Teams Must Do Now

Inside the CryptoBilis Hardware Implant: How Attackers Turned Trusted Crypto Wallets Into Cellular Spies

AI Is Now a Standard Weapon in North Korea's Cyber Arsenal—Here's What That Means for Your Cloud

Amatera: The Professionalized Infostealer Dominating Latin America in 2026

Cisco Firewall Zero-Day CVE-2026-76418: What the SSL VPN DoS Attack Means for Your Network Security

Fragnesia + PHP2Shell: How Attackers Are Chaining CVEs to Root Government Servers

13.4 Million Users Exposed: How 319 Chrome Extensions Quietly Hijacked Every Search Query

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed.
Has your question changed with it?

Contain the Blast Radius

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

When Allies Become Attackers: Belarus APT FrostyNeighbor Deploys Wiper Against Ukrainian Critical Infrastructure

Low-Effort Anthropic Phishing Emails Are Slipping Past Enterprise Email Security—Here's How

Binance 2026: How North Korea's TraderTraitor Stole $6.4 Billion Through a Single Compromised Laptop

CISA KEV Alert: GitLab CVSS 10.0 RCE and Cisco ASA DoS Flaws Under Active Exploitation — What Cloud Security Teams Must Do Now

Trojanized Claude Code Extension: How a Single Cursor Marketplace Update Backdoored 5,000 Developer Machines

Critical Drupal Commerce Authorization Bypass (CVE-2026-118539) Under Active Exploitation: What Security Teams Must Do Now

Inside the CryptoBilis Hardware Implant: How Attackers Turned Trusted Crypto Wallets Into Cellular Spies

AI Is Now a Standard Weapon in North Korea's Cyber Arsenal—Here's What That Means for Your Cloud

Amatera: The Professionalized Infostealer Dominating Latin America in 2026

Cisco Firewall Zero-Day CVE-2026-76418: What the SSL VPN DoS Attack Means for Your Network Security

Fragnesia + PHP2Shell: How Attackers Are Chaining CVEs to Root Government Servers

13.4 Million Users Exposed: How 319 Chrome Extensions Quietly Hijacked Every Search Query

Security Research & Insights

Four Minutes to PHP2Shell Shaped Traffic: What an Internet Exposed PHP Honeypot Saw

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Market Perspectives

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

How CNSF Protects Cloud Workloads

With CNSF, enterprises can:

See Your Attack Paths. Close the Gaps with CNSF.

Your assessment delivers:

The threat landscape has changed. Has your question changed with it?

Contain the Blast Radius

The threat landscape has changed.
Has your question changed with it?