Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 3757 to 3768 of 5957
Microsoft 365 Copilot Bug Leads to Exposure of Confidential Emails
In early 2026, Microsoft identified a critical bug in its Microsoft 365 Copilot AI assistant, which allowed the system to process and summarize emails labeled as 'Confidential' despite existing Data Loss Prevention (DLP) policies designed to prevent such actions. This vulnerability, reported by customers on January 21, 2026, and acknowledged by Microsoft in early February, specifically affected emails stored in the Sent Items and Drafts folders. The flaw enabled Copilot Chat to access and summarize sensitive content, potentially exposing confidential information to unauthorized users. Microsoft has since rolled out a fix to address this issue. ([techcrunch.com](https://techcrunch.com/2026/02/18/microsoft-says-office-bug-exposed-customers-confidential-emails-to-copilot-ai/?utm_source=openai)) This incident underscores the challenges in securing AI-driven tools within enterprise environments. As organizations increasingly integrate AI assistants into their workflows, ensuring that these systems adhere to established data protection policies becomes paramount. The Copilot bug highlights the necessity for continuous monitoring and updating of security measures to prevent unintended data exposure.
7 months ago
Kill Chain
Figure Technology Solutions Data Breach: A 2026 Case Study
In January 2026, Figure Technology Solutions, a blockchain-based fintech lender, suffered a data breach exposing the personal information of approximately 967,200 customers. The breach was executed by the cybercriminal group ShinyHunters through a social engineering attack that deceived an employee into granting unauthorized access. The compromised data includes full names, email addresses, phone numbers, physical addresses, and dates of birth. ShinyHunters subsequently published 2.5GB of this data online after Figure declined to meet their ransom demands. This incident underscores the increasing prevalence of social engineering tactics targeting financial institutions, highlighting the critical need for robust employee training and advanced security measures to prevent unauthorized access. Organizations must remain vigilant against such sophisticated attacks to protect sensitive customer information and maintain trust.
7 months ago
Kill Chain
Critical SmarterMail Vulnerabilities Exploited in 2026
In January 2026, SmarterTools' SmarterMail software was found to have two critical vulnerabilities: CVE-2026-24423, an unauthenticated remote code execution flaw, and CVE-2026-23760, an authentication bypass issue. These vulnerabilities allowed attackers to execute arbitrary code and reset administrator passwords without authentication, leading to full system compromise. Exploitation began shortly after disclosure, with threat actors sharing exploit code and compromised credentials on underground forums. ([scworld.com](https://www.scworld.com/news/smartermail-vulnerabilities-exploited-in-ransomware-campaigns?utm_source=openai)) The rapid weaponization of these vulnerabilities underscores the increasing speed at which attackers exploit newly disclosed flaws. Organizations must prioritize timely patching and enhance monitoring of email infrastructure to prevent similar breaches. ([scworld.com](https://www.scworld.com/news/smartermail-vulnerabilities-exploited-in-ransomware-campaigns?utm_source=openai))
7 months ago
Kill Chain
CISA Adds Four Vulnerabilities to KEV Catalog - January 2026
In January 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation evidence. The vulnerabilities include CVE-2025-68645 affecting Synacor Zimbra Collaboration Suite, CVE-2025-34026 in Versa Concerto SD-WAN platform, CVE-2025-31125 in Vite Vitejs, and CVE-2025-54313 in eslint-config-prettier. These flaws span email platforms, SD-WAN infrastructure, development tools, and package managers, posing significant risks across various sectors. ([isec.news](https://www.isec.news/2026/01/24/cisa-adds-four-vulnerabilities-to-kev-catalog-and-sets-federal-patch-deadline/?utm_source=openai)) The inclusion of these vulnerabilities underscores the escalating threat landscape, with attackers increasingly targeting diverse software components. Organizations are urged to prioritize patching by the February 12, 2026 deadline to mitigate potential breaches and maintain operational security. ([cyberpress.org](https://cyberpress.org/cisa-adds-four-critical-vulnerabilities-to-kev-catalog-following-active-exploitation/?utm_source=openai))
7 months ago
Kill Chain
Notepad++ 2025 Supply Chain Attack: A Deep Dive into the Lotus Panda Breach
Between June and December 2025, the popular text editor Notepad++ experienced a significant supply chain attack. State-sponsored actors, identified as the Chinese group Lotus Panda, compromised the software's update infrastructure by infiltrating its shared hosting provider. This breach allowed them to intercept and redirect update requests, delivering malicious installers to targeted users. The attackers employed sophisticated techniques, including DLL side-loading and the deployment of a custom backdoor named Chrysalis, to gain unauthorized access to systems. The campaign was highly selective, focusing on organizations in sectors such as telecommunications, finance, and government across regions including East Asia, the Philippines, and Vietnam. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/kaspersky-great-uncovers-hidden-attack-chains-in-notepad-supply-chain-compromise?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks, where trusted software distribution channels are exploited to infiltrate systems. The Notepad++ compromise highlights the necessity for organizations to implement stringent software update verification processes and to remain vigilant against potential vulnerabilities in third-party software components.
7 months ago
Kill Chain
AI Assistants: The New Frontier for Stealthy Malware Communication
In February 2026, cybersecurity researchers from Check Point Research identified a novel method by which AI assistants with web browsing capabilities, such as Microsoft Copilot and xAI's Grok, can be exploited to facilitate covert command-and-control (C2) communications for malware. By manipulating these AI platforms to fetch attacker-controlled URLs, threat actors can establish stealthy communication channels that blend seamlessly into legitimate enterprise traffic, thereby evading traditional detection mechanisms. This technique underscores the evolving landscape of cyber threats, where everyday AI tools are repurposed for malicious activities. The discovery highlights a significant shift in cyberattack methodologies, emphasizing the need for organizations to reassess their security postures in the context of AI integration. As AI assistants become more prevalent in enterprise environments, the potential for their misuse in cyberattacks increases, necessitating enhanced monitoring and adaptive defense strategies to mitigate such risks.
7 months ago
Kill Chain
Dell RecoverPoint Zero-Day Exploited by UNC6201
In mid-2024, a critical zero-day vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines was exploited by the China-linked cyberespionage group UNC6201. This flaw, involving hardcoded credentials, allowed unauthenticated remote attackers to gain root-level access, facilitating lateral movement, persistent access, and deployment of malware such as BRICKSTORM and the newer GRIMBOLT backdoor. The attackers also employed 'ghost NICs' to stealthily pivot within virtualized environments, complicating detection and response efforts. The exploitation of this vulnerability underscores the persistent threat posed by state-sponsored actors targeting critical infrastructure. Organizations are urged to apply Dell's remediation measures promptly to mitigate potential risks associated with this exploit.
7 months ago
Kill Chain
Critical Vulnerability in Honeywell CCTV Products Exposes Unauthorized Access Risks
In February 2026, a critical vulnerability (CVE-2026-1670) was discovered in multiple Honeywell CCTV products, allowing unauthenticated attackers to remotely change the 'forgot password' recovery email address. This flaw enables unauthorized access to camera feeds and potential account hijacking. The affected models include I-HIB2PI-UL 2MP IP (version 6.1.22.1216), SMB NDAA MVO-3, PTZ WDR 2MP 32M, and 25M IPC, all running firmware version WDR_2MP_32M_PTZ_v2.0. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/critical-infra-honeywell-cctvs-vulnerable-to-auth-bypass-flaw/?utm_source=openai)) The vulnerability underscores the importance of securing IoT devices, especially those deployed in critical infrastructure. Organizations are advised to minimize network exposure of such devices, isolate them behind firewalls, and use secure remote access methods like updated VPN solutions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/critical-infra-honeywell-cctvs-vulnerable-to-auth-bypass-flaw/?utm_source=openai))
7 months ago
Kill Chain
Critical Flaws in Popular VS Code Extensions Put Millions at Risk
In February 2026, critical vulnerabilities were discovered in four widely used Visual Studio Code (VS Code) extensions—Live Server, Code Runner, Markdown Preview Enhanced, and Microsoft Live Preview—collectively installed over 125 million times. These flaws could allow attackers to steal local files and execute remote code by exploiting weaknesses in the extensions' handling of web content and local server configurations. Notably, CVE-2025-65717 in Live Server enables file exfiltration via malicious websites, while CVE-2025-65716 in Markdown Preview Enhanced permits arbitrary code execution through crafted markdown files. Despite disclosure in June 2025, three of these vulnerabilities remained unpatched as of February 2026, leaving developers exposed to significant security risks. ([thehackernews.com](https://thehackernews.com/2026/02/critical-flaws-found-in-four-vs-code.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting development environments. The exploitation of trusted tools like VS Code extensions highlights the need for developers to exercise caution when installing and updating extensions, and for maintainers to prioritize timely security patches to mitigate potential compromises.
7 months ago
Kill Chain
Critical Vulnerability in Grandstream GXP1600 VoIP Phones: CVE-2026-2329
In February 2026, a critical vulnerability (CVE-2026-2329) was discovered in Grandstream's GXP1600 series VoIP phones, affecting models GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630. This unauthenticated stack-based buffer overflow in the HTTP API endpoint "/cgi-bin/api.values.get" allows remote attackers to execute arbitrary code with root privileges. Exploitation could lead to unauthorized access, interception of VoIP communications, and potential eavesdropping on sensitive conversations. ([rapid7.com](https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed/?utm_source=openai)) The incident underscores the importance of promptly applying security patches and monitoring VoIP infrastructure for vulnerabilities. Organizations using these devices should update to firmware version 1.0.7.81 to mitigate the risk. ([rapid7.com](https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed/?utm_source=openai))
7 months ago
Kill Chain
Kenyan Activist's Phone Compromised by Cellebrite Extraction
In July 2025, Kenyan pro-democracy activist Boniface Mwangi was arrested, and his personal devices were confiscated by authorities. Upon their return in September 2025, Mwangi discovered that his Samsung phone's password protection had been removed. Forensic analysis by Citizen Lab revealed with high confidence that Kenyan authorities utilized Cellebrite's forensic extraction tools on his device during its custody, enabling full access to sensitive information including messages, personal files, financial data, and passwords. This incident underscores the potential misuse of advanced surveillance technologies by government entities to target civil society members. The case highlights the growing concerns over digital privacy and the ethical implications of deploying such tools without proper oversight, emphasizing the need for stringent regulations to prevent abuse and protect individual rights.
7 months ago
Kill Chain
KongTuke's CrashFix Campaign: Exploiting DNS to Deliver ModeloRAT
In early 2026, the threat actor known as KongTuke launched an evolved ClickFix campaign, dubbed 'CrashFix,' targeting corporate environments. The attack began with users installing a malicious Chrome extension named NexShield, masquerading as a legitimate ad blocker. After a delay, the extension deliberately crashed the browser, displaying a fake 'CrashFix' security warning. This prompt instructed users to run a command that executed a custom DNS lookup, leading to the download and execution of ModeloRAT, a Python-based remote access trojan. This sophisticated social engineering tactic exploited user trust and system utilities to gain unauthorized access to corporate systems. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/?utm_source=openai)) This incident underscores a growing trend of attackers leveraging social engineering combined with native system tools to bypass traditional security measures. The use of DNS queries for payload delivery highlights the need for enhanced monitoring of network traffic and user education to recognize and resist such deceptive tactics.
7 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
