Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3709 to 3720 of 5958
FBI Reports Surge in ATM Jackpotting Attacks in 2025
In 2025, the FBI reported a significant surge in ATM 'jackpotting' attacks across the United States, with over 700 incidents leading to more than $20 million in losses. These attacks involve cybercriminals exploiting physical and software vulnerabilities in ATMs to deploy malware, such as Ploutus, which forces machines to dispense cash without legitimate transactions. Attackers often gain access using generic keys to open ATM panels, then install malware that manipulates the ATM's operating system to execute unauthorized cash withdrawals. ([techcrunch.com](https://techcrunch.com/2026/02/19/fbi-says-atm-jackpotting-attacks-are-on-the-rise-and-netting-hackers-millions-in-stolen-cash/?utm_source=openai)) This trend underscores the evolving tactics of cybercriminals who blend physical intrusion with sophisticated malware to exploit financial systems. The rise in such attacks highlights the urgent need for financial institutions to enhance ATM security measures, including updating software, implementing robust physical security protocols, and educating staff on emerging threats to prevent substantial financial losses and maintain customer trust.
6 months ago
Kill Chain
North Korean IT Workers Exploit Remote Work to Infiltrate U.S. Companies in 2025
In 2025, U.S. authorities uncovered a sophisticated scheme where North Korean IT workers, using stolen or fabricated identities, secured remote positions within over 300 U.S. companies. These operatives, often based in China and Russia, infiltrated organizations by posing as legitimate American employees, thereby accessing sensitive corporate data and systems. The illicit earnings, estimated at over $88 million, were funneled back to North Korea to support its weapons programs. ([forbes.com](https://www.forbes.com/sites/alonzomartinez/2025/04/25/north-korean-hackers-pose-as-remote-workers-to-infiltrate-us-firms/?utm_source=openai)) This incident underscores the escalating threat of nation-state actors exploiting remote work vulnerabilities to bypass traditional security measures. The use of advanced tactics, including AI-generated profiles and deepfake technologies, highlights the need for enhanced identity verification processes and continuous monitoring of remote access points to safeguard organizational assets. ([fortune.com](https://fortune.com/2025/08/04/north-korean-it-worker-infiltrations-exploded/?utm_source=openai))
6 months ago
Kill Chain
UMMC Ransomware Attack Disrupts Healthcare Services in Mississippi
In February 2026, the University of Mississippi Medical Center (UMMC) experienced a significant ransomware attack that led to the closure of all its clinics statewide and the cancellation of elective procedures. The cyberattack compromised multiple IT systems, including the Epic electronic medical records platform, necessitating the implementation of downtime procedures to maintain patient care. Emergency services remained operational, but the disruption affected numerous outpatient services and appointments. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/university-of-mississippi-medical-center-closes-clinics-after-ransomware-attack/?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting healthcare institutions, highlighting the critical need for robust cybersecurity measures to protect sensitive patient data and ensure the continuity of medical services.
6 months ago
Kill Chain
PayPal's 2025 Data Breach: A Cautionary Tale in Financial Data Security
In 2025, PayPal experienced a significant data breach due to a code change in its Working Capital application, which inadvertently exposed sensitive customer information, including Social Security numbers and dates of birth, for nearly six months. The breach was discovered on December 12, 2025, but had been active since July 1, 2025. Approximately 100 customers were affected by this incident. ([cybernews.com](https://cybernews.com/security/paypal-six-month-breach-ssn-working-capital-app/?utm_source=openai)) This incident underscores the critical importance of rigorous code review processes and robust access controls in financial applications. The prolonged exposure period highlights the necessity for continuous monitoring and rapid response mechanisms to detect and mitigate unauthorized access to sensitive data.
6 months ago
Kill Chain
Credential Theft Leads to Massive Data Breach at French Ministry of Finance
In late January 2026, the French Ministry of Finance reported a significant data breach involving unauthorized access to the national bank account registry, FICOBA. A threat actor exploited stolen credentials from a government official to access sensitive information on approximately 1.2 million bank accounts. The compromised data included bank account details (RIBs/IBANs), account holder identities, physical addresses, and, in some cases, taxpayer identification numbers. Upon detection, the Ministry promptly restricted the unauthorized access and initiated measures to notify affected individuals and financial institutions. This incident underscores the critical importance of robust access controls and credential management within governmental systems. The breach highlights the escalating risks associated with credential theft and the necessity for enhanced cybersecurity measures to protect sensitive financial data. Organizations are urged to reassess their security protocols to mitigate similar threats.
6 months ago
Kill Chain
Google Engineers Indicted for Trade Secret Theft to Iran
In February 2026, three Silicon Valley engineers—Samaneh Ghandali, her sister Soroor Ghandali, and her husband Mohammadjavad Khosravi—were indicted for allegedly stealing trade secrets from Google and other technology companies and transferring them to unauthorized locations, including Iran. The trio exploited their positions to access sensitive data related to processor security and cryptography, transferring hundreds of confidential files to personal devices and third-party platforms. Their actions were detected by Google's internal security systems in August 2023, leading to an internal investigation and subsequent legal action. This incident underscores the persistent threat of insider attacks in the tech industry, highlighting the need for robust internal security measures and vigilant monitoring to protect intellectual property. The case also reflects broader concerns about the exfiltration of sensitive technologies to foreign entities, emphasizing the importance of safeguarding national security interests in the face of evolving cyber threats.
6 months ago
Kill Chain
BeyondTrust 2026 RCE Vulnerability Exploited in Ransomware Attacks
In early February 2026, BeyondTrust disclosed a critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-1731, affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. This flaw allows unauthenticated attackers to execute arbitrary operating system commands by sending specially crafted requests to vulnerable endpoints. Despite the release of patches, active exploitation began almost immediately, with threat actors deploying ransomware and exfiltrating data. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 13, 2026, emphasizing the urgency for organizations to apply the necessary updates. The rapid exploitation of CVE-2026-1731 underscores a concerning trend where attackers swiftly leverage newly disclosed vulnerabilities to launch ransomware campaigns. This incident highlights the critical need for organizations to implement robust patch management processes and maintain vigilant monitoring to detect and respond to such threats promptly.
6 months ago
Kill Chain
Advantest 2026 Ransomware Attack: A Wake-Up Call for Semiconductor Cybersecurity
In February 2026, Advantest Corporation, a leading Japanese semiconductor test equipment manufacturer, detected unauthorized access within its IT environment, indicating a ransomware attack. The company promptly activated incident response protocols, isolated affected systems, and engaged third-party cybersecurity experts to investigate and contain the incident. Preliminary findings suggest that an unauthorized third party may have gained access to portions of the company's network and deployed ransomware. The full extent of the impact, including potential compromise of customer or employee data, is under active investigation. ([advantest.com](https://www.advantest.com/en/news/2026/20260219.html?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting critical infrastructure within the semiconductor industry. As adversaries increasingly focus on high-value targets, organizations must enhance their cybersecurity measures to protect sensitive data and maintain operational continuity.
6 months ago
Kill Chain
FBI Reports Surge in ATM Jackpotting Attacks in 2025
In 2025, the FBI reported a significant surge in ATM jackpotting incidents across the United States, with over 700 attacks resulting in more than $20 million in losses. These attacks involve cybercriminals exploiting physical and software vulnerabilities in ATMs, often deploying malware like Ploutus to force machines to dispense cash without legitimate transactions. Criminals typically gain access by using generic keys to open ATM fronts and then install malware to control the machines remotely. This alarming trend underscores the evolving tactics of cybercriminals and highlights the urgent need for financial institutions to bolster their ATM security measures. The rise in such sophisticated attacks calls for enhanced vigilance and the implementation of robust security protocols to protect against these threats.
6 months ago
Kill Chain
Ukrainian National Sentenced for Facilitating North Korean IT Worker Fraud
In February 2026, Ukrainian national Oleksandr Didenko was sentenced to five years in U.S. federal prison for orchestrating a scheme that enabled North Korean IT workers to fraudulently secure employment at 40 U.S. companies. Didenko operated the website Upworksell.com, facilitating the sale of stolen U.S. citizen identities to these workers, who then funneled their earnings back to North Korea to support its weapons programs. He also managed multiple 'laptop farms' in the U.S. to create the illusion of domestic employment locations. This case underscores the persistent threat of nation-state actors exploiting identity theft to infiltrate and financially exploit U.S. businesses. The incident highlights the evolving tactics of North Korean operatives, who now leverage authentic LinkedIn profiles to enhance the credibility of their fraudulent job applications, posing ongoing risks to corporate security and compliance.
6 months ago
Kill Chain
ClickFix Campaign 2026: Unveiling the MIMICRAT Malware Threat
In February 2026, a sophisticated cyber campaign known as ClickFix was identified, leveraging compromised legitimate websites to distribute a custom remote access trojan (RAT) named MIMICRAT. The attack initiated through a legitimate Bank Identification Number (BIN) validation service, bincheck.io, which was breached to inject malicious JavaScript. This script redirected users to a fake Cloudflare verification page, prompting them to execute a PowerShell command that ultimately deployed MIMICRAT. The RAT featured capabilities such as Windows token impersonation, SOCKS5 tunneling, and a suite of 22 commands for extensive post-exploitation activities. Victims spanned multiple geographies, including a U.S.-based university and various Chinese-speaking users, indicating broad opportunistic targeting. This incident underscores the evolving nature of cyber threats, where attackers exploit trusted websites to deliver sophisticated malware. The use of multi-stage PowerShell scripts and the deployment of custom RATs like MIMICRAT highlight the increasing complexity of attack vectors. Organizations must remain vigilant, ensuring robust security measures are in place to detect and mitigate such advanced threats.
6 months ago
Kill Chain
Cline CLI Supply Chain Attack: Lessons in Software Security
In February 2026, the Cline CLI, a widely used AI coding assistant, was compromised through a supply chain attack. An unauthorized party exploited a stolen npm publish token to release version 2.3.0 of Cline CLI, which included a modified package.json file. This modification added a postinstall script that silently installed OpenClaw, an unrelated open-source package, on developers' systems upon installation. The malicious version was available for approximately eight hours before being deprecated, during which it was downloaded around 4,000 times. The Cline team responded by revoking the compromised token, publishing a corrected version (2.4.0), and enhancing their release pipeline security. This incident underscores the escalating threat of supply chain attacks targeting developer tools. The unauthorized installation of OpenClaw, while not inherently malicious, highlights the potential for more harmful payloads in future attacks. Organizations are urged to audit their development environments and enforce stringent security measures to mitigate such risks.
6 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
