Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4309 to 4320 of 5957
RondoDox Botnet Weaponizes Critical React2Shell Flaw: Lessons from a Global IoT Hijack
From March to December 2025, the RondoDox botnet orchestrated a widespread campaign by exploiting the critical React2Shell (CVE-2025-55182) vulnerability to compromise over 90,000 Internet of Things (IoT) devices and web servers globally, with a major concentration in the U.S. Attackers conducted phased operations, ranging from reconnaissance and mass scanning to the automated deployment of advanced Mirai-based payloads and cryptocurrency miners. Capable of remote code execution, RondoDox’s malware loader established persistence, eliminated rival threats, and enabled command-and-control operations for further lateral movement and resource hijacking. This breach highlights an alarming trend of botnets swiftly weaponizing zero-day vulnerabilities in widely used frameworks like React and Next.js, amplifying both organizational and regulatory risk across hybrid and IoT environments. Growing sophistication in persistence mechanisms and targeted east-west attacks underscores the urgent need for robust segmentation, continuous monitoring, and zero trust advances.
8 months ago
Kill Chain
GhostAd Drain 2026: How Multi-Vector Malware and Botnets Are Redefining Cyber Risk
In early January 2026, a sophisticated cyber campaign dubbed "GhostAd Drain" targeted organizations across multiple sectors with a blend of malware, proxy botnets, and cloud service exploits. Attackers deployed malicious payloads primarily via phishing emails and poisoned advertisements, leveraging advanced evasion tactics such as encrypted east-west traffic, dynamic segmentation bypass, and multicloud movement. The campaign quickly compromised endpoint devices—including macOS systems—establishing proxy botnets for command-and-control while siphoning sensitive data through encrypted channels. As a result, affected organizations faced operational disruptions, data exfiltration, and heightened recovery costs. This incident underscores a marked escalation in threat actor capability, blending classic malware with adaptive, multi-vector Tactics, Techniques, and Procedures (TTPs) to evade traditional controls. The campaign’s success highlights the pressing need for organizations to adopt zero trust segmentation, enhance multicloud visibility, and enforce robust east-west traffic controls to mitigate modern, polymorphic attack patterns.
8 months ago
Kill Chain
Unleash Protocol Breach: $3.9M Stolen in 2024 DeFi Multisig Contract Hijack
In May 2024, decentralized intellectual property platform Unleash Protocol suffered a major security breach in which hackers exploited a vulnerability within its multisignature governance contract. Threat actors successfully assumed control of the protocol’s multisig wallet to execute an unauthorized smart contract upgrade, granting them illicit withdrawal rights. As a result, approximately $3.9 million in cryptocurrency assets were drained from the platform. The incident forced Unleash Protocol to suspend operations to assess damage control, freezing its ecosystem and raising questions about the security of decentralized financial infrastructure. This breach highlights the persistent risks facing DeFi platforms, particularly surrounding contract governance and multisig controls. Threat actors continue to target decentralized protocols using sophisticated social engineering and smart contract exploitation methods, emphasizing fintech’s urgent need for comprehensive, proactive security measures.
8 months ago
Kill Chain
DarkSpectre Espionage Wave: 8.8 Million Impacted by Malicious Browser Extensions
Between 2018 and 2025, a sophisticated Chinese threat actor known as DarkSpectre orchestrated a series of malicious browser extension campaigns that compromised over 8.8 million users globally across Google Chrome, Microsoft Edge, Mozilla Firefox, and Opera. The group leveraged deceptive add-ons disguised as productivity, conferencing, and media tools to harvest sensitive data, hijack web sessions, and facilitate massive corporate espionage. Through delayed activation tactics and compromised legitimate extensions, attackers exfiltrated confidential meeting details, user credentials, and organizational intelligence in real time. Much of the operation leveraged trusted marketplaces, building user bases over years before weaponizing extensions via silent code updates. The scale, persistence, and supply-chain focus of this campaign highlight a shift toward data-centric, espionage-motivated browser attacks. As hybrid work and cloud platforms proliferate, organizations face heightened supply chain and insider risk pressure—and regulators increasingly expect stringent controls on extension governance and data privacy.
8 months ago
Kill Chain
Trust Wallet Chrome Extension Breach: $8.5M Lost in Shai-Hulud Supply Chain Attack
In December 2025, Trust Wallet suffered a major supply chain attack targeting its Google Chrome browser extension. Attackers exploited leaked GitHub secrets to gain unauthorized access to Trust Wallet's source code and Chrome Web Store API keys, bypassing the firm’s standard release reviews. Malicious actors then uploaded a trojanized extension update that harvested user wallet mnemonic phrases and exfiltrated them to attacker-controlled infrastructure. The breach led to a rapid compromise of at least 2,520 digital wallets and the theft of approximately $8.5 million in cryptocurrency, prompting a large-scale reimbursement and investigation effort by Trust Wallet. This incident highlights the escalating trend of supply chain attacks exploiting trusted software dependencies and underscores the urgent need for rigorous release controls and key management in the software lifecycle.
8 months ago
Kill Chain
Thousands Breached: The 2024 Ivanti EPMM Zero-Day APT Campaign
In April and May 2024, thousands of organizations worldwide were compromised after a Chinese state-sponsored advanced persistent threat (APT) group exploited multiple previously unknown zero-day vulnerabilities in Ivanti’s Endpoint Manager Mobile (EPMM) platform. The attackers used these flaws as entry points to gain administrative control, move laterally, and deploy persistent malware, leading to widespread data exfiltration and operational disruption. The campaign targeted government, critical infrastructure, and private sector entities, exploiting unpatched systems at scale before public disclosure, prompting rapid security advisories and emergency patching. This Ivanti EPMM incident underscores the growing sophistication of nation-state campaigns leveraging zero-day vulnerabilities for large-scale compromise. It highlights the urgent industry need for rigorous vulnerability management, zero trust architectures, and rapid detection in light of escalating APT tactics.
8 months ago
Kill Chain
OpenAI Battles Prompt Injection Risk in ChatGPT Atlas Browser Agent (2024)
In mid-2024, OpenAI reported a significant security challenge involving prompt injection attacks targeting its ChatGPT Atlas browser agent. Internal automated red teaming uncovered advanced prompt injection techniques that manipulated the agent into executing unauthorized actions when it encountered maliciously crafted content, such as emails or web pages. The incident highlighted the potential for agents with access to sensitive workflows—like email or documents—to become high-value targets, with attackers abusing their autonomous capabilities to exfiltrate data or perform unintended tasks. OpenAI responded by updating the agent with an adversarially trained model and enhanced safeguards. This incident draws attention to the growing security risks associated with AI/ML agents operating within user workflows, as such attacks are becoming increasingly sophisticated and persistent. The event underscores a broader pattern of rising concern from regulators and security agencies regarding AI-driven exploits, especially as generative AI becomes deeply integrated into enterprise environments.
8 months ago
Kill Chain
ErrTraffic ClickFix: The 2024 Malware Campaign Exploiting Fake Browser Glitches
In March 2024, security researchers uncovered a large-scale cybercriminal campaign leveraging a service named ErrTraffic to automate 'ClickFix' attacks via fake browser glitches. Threat actors compromised legitimate websites, deploying scripts to simulate error pop-ups and glitches that tricked users into downloading malicious payloads or executing harmful actions. The attackers utilized advanced social engineering, presenting credible browser dialog impersonations, and used the campaign to rapidly distribute information-stealing malware across multiple geographies. The impact included significant compromises of user credentials and personal information, highlighting growing risk to businesses reliant on web applications. This incident is particularly notable as it demonstrates both evolving infostealer TTPs and the increasing sophistication of social engineering through browser-manipulation. The widespread adoption of automated 'glitch' services like ErrTraffic signals a broader shift towards commoditizing web-based attacks targeting both enterprises and individuals.
8 months ago
Kill Chain
CISA Warns of Critical 2025 ICS Vulnerabilities in WHILL C2 and AzeoTech DAQFactory
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) publicly released advisories highlighting multiple serious vulnerabilities in two industrial control systems: the WHILL C2 Wheelchairs and AzeoTech DAQFactory software. These advisories outlined critical flaws that could permit unauthorized access, remote code execution, or control manipulation within industrial and healthcare environments if left unmitigated. Attackers exploiting these gaps could compromise patient safety with wheelchairs or disrupt automation and process monitoring within industrial facilities, directly impacting operational continuity and patient care. This disclosure underscores intensifying cybersecurity scrutiny of industrial and medical control systems, which are increasingly targeted due to digitization and legacy design shortcomings. The rapid emergence of similar threats and increased regulatory focus make swift mitigation and robust ICS security controls more vital than ever.
8 months ago
Kill Chain
SmarterMail 2025: Critical Pre-Auth File Upload Flaw Threatens Global Email Servers
In December 2025, Singapore's Cyber Security Agency (CSA) issued an alert concerning a critical pre-authentication vulnerability (CVE-2025-52691) in SmarterTools SmarterMail email servers. The flaw allows unauthenticated remote attackers to upload arbitrary files to any location on the server, leveraging an unvalidated GUID parameter for path traversal via the '/api/upload' endpoint. An attacker could exploit this for remote code execution, potentially resulting in full compromise of the server, with malicious files executed under system privileges. Although no in-the-wild exploitation has been confirmed, more than 16,000 vulnerable public-facing servers were identified globally. This incident underscores growing risks from exposed infrastructure and rapid exploitation of high-severity application flaws. With threat actors increasingly targeting business-critical communication platforms, organizations face mounting pressure to quickly remediate vulnerabilities and bolster segmentation and detection capabilities in line with zero trust frameworks.
8 months ago
Kill Chain
Kimwolf Botnet 2025: The Largest IoT Attack Forces Rethink of DDoS and Proxy Security
In 2025, a record-shattering wave of distributed denial-of-service (DDoS) and proxy attacks targeted high-profile websites including KrebsOnSecurity.com, Google, and Cloudflare. Initial attribution pointed to the Aisuru botnet, but subsequent investigation by XLab and others revealed the underlying infrastructure was largely driven by the Kimwolf botnet, comprising over 1.8 million compromised Internet-of-Things (IoT) devices. The attackers leveraged vulnerable connected devices worldwide, harnessing them not only for disruptive DDoS campaigns but also for proxy rental services that enabled cybercriminal anonymity, exposing widespread insecurity in IoT ecosystems. This incident underscores a concerning shift: major botnets are evolving from sporadic attacks to persistent, multi-purpose criminal platforms. It highlights the urgent need for enterprises to address IoT security gaps and for cloud providers to enforce robust countermeasures against residential proxy abuse and large-scale botnet activity.
8 months ago
Kill Chain
ESA 2024 External Server Breach: Lessons on Third-Party and Perimeter Security
In June 2024, the European Space Agency (ESA) confirmed a cybersecurity incident involving unauthorized access to external servers outside its core corporate IT network. These servers contained 'unclassified' information tied to ESA's collaborative engineering activities. The breach was detected and announced on June 24, with the agency rapidly taking down the compromised servers to contain the incident and beginning an internal investigation. No critical or classified ESA infrastructure was reportedly affected, and mission operations remained unaffected. This breach underscores persistent risks facing organizations collaborating with external partners and utilizing externally accessible infrastructure. Similar methodologies targeting non-core systems and lateral movements are increasing, highlighting the importance of robust segmentation, external system monitoring, and continuous risk assessment for third-party assets.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
