Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4405 to 4416 of 5948
HPE OneView 2025: CVE-2025-37164 Remote Code Execution Threat
In June 2025, Hewlett Packard Enterprise (HPE) patched a critical vulnerability (CVE-2025-37164) in its OneView infrastructure management software, allowing unauthenticated remote code execution via network exposure. Rated CVSS 10.0, the flaw enabled threat actors to gain full control over affected systems by exploiting improper input validation in OneView’s remote management interfaces. This vulnerability posed immediate risk to critical infrastructure across industries relying on OneView for centralized management, potentially resulting in disruption, unauthorized access, or lateral movement within enterprise environments. The discovery highlights ongoing concerns around enterprise software supply chain security and the elevated threats facing privileged IT management tools. Increasingly, sophisticated threat actors target such infrastructure software to bypass traditional security controls, emphasizing the urgency for timely patching and advanced east-west traffic controls.
8 months ago
Kill Chain
North Korea’s $2 Billion Crypto Heist: 2025’s Largest Nation-State Cyber Attack
In 2025, threat actors closely tied to North Korea orchestrated a record-breaking $2.02 billion in cryptocurrency thefts, representing over half of the global digital asset losses for the year. These attackers leveraged sophisticated intrusion techniques, advanced persistent threat (APT) operations, and exploited vulnerabilities in decentralized finance (DeFi) platforms and exchanges from January through early December. High-value thefts were often facilitated by exploiting weak internal controls, compromised credentials, and security gaps in cross-chain bridges, resulting in severe financial losses for both exchanges and their clients. This incident marks a significant escalation in nation-state cybercrime and highlights evolving attacker sophistication in targeting cryptocurrency infrastructure. It underscores escalating regulatory scrutiny and the necessity for organizations to bolster east-west traffic controls, threat detection, and zero trust architectures in response to persistent, financially-motivated adversaries.
8 months ago
Kill Chain
2025 Multi-Vector Breach: WhatsApp Hijacks, MCP Leaks & AI Threats Signal New Era of Cyber Attacks
In December 2025, adversaries leveraged multiple cyberattack vectors—including WhatsApp account hijacking, major control plane (MCP) data leaks, generative AI reconnaissance, and the React2Shell exploit—to target organizations worldwide. Attackers combined social engineering, exploitation of unpatched vulnerabilities, and east-west traffic movement for lateral compromise. The orchestration of these tactics led to large-scale credential theft, successful ransomware deployment, and significant data exfiltration across cloud and on-premise environments. Notably, sophisticated evasion and automation tools hindered early detection and response, increasing operational disruption and risk exposure for affected enterprises. This incident exemplifies how weaponized AI, hybrid cloud vulnerabilities, and multi-vector attacks are converging. Organizations face growing urgency for zero trust segmentation, improved encrypted traffic controls, and comprehensive threat detection as attackers exploit interconnected infrastructure weaknesses and automation gaps.
8 months ago
Kill Chain
University of Sydney 2024 Data Breach Exposes Student and Staff Details
In June 2024, the University of Sydney disclosed a data breach following unauthorized access to an online coding repository. Attackers exfiltrated files containing personal information of students and staff by exploiting weak access controls on the system. The breach was identified after suspicious activity was detected, prompting immediate investigation and containment steps by the university. Impacted data reportedly includes names, contact details, and university credentials, potentially exposing the affected individuals to heightened phishing and identity theft risks. This breach underscores increasing attacks on educational institutions using supply chain and cloud repository vectors. With universities under pressure to rapidly digitize, protecting developer and collaboration tools has become critical amid surging credential-based attacks and regulatory scrutiny of personally identifiable information (PII) handling.
8 months ago
Kill Chain
Sha1-Hulud 2025: The Multi-Vector Threat Campaign that Redefined Cloud Security
In December 2025, security researchers observed a sophisticated multi-vector attack campaign, dubbed 'Sha1-Hulud,' targeting organizations across North America, Europe, and Asia. The campaign leveraged vulnerabilities in remote management tools such as ScreenConnect and MacSync to gain initial access, then proceeded laterally using encrypted traffic, zero trust segmentation evasion, and cloud-native pivoting. Attackers deployed covert remote access tools and exploited gaps in cloud firewall and egress controls to move data out, leaving organizations grappling with data theft, systems downtime, and regulatory exposure. This incident is notable for its integration of advanced encryption bypass, multicloud movement, and the blending of traditional and cloud-native evasion tactics. The convergence of infrastructure and cloud threats highlights the need for ubiquitous visibility, modern segmentation, and coordinated policy enforcement in response to increasingly diverse and distributed attacks.
8 months ago
Kill Chain
Axis Communications 2025: Critical Camera System Vulnerabilities Threaten OT Security
In December 2025, Axis Communications disclosed multiple critical vulnerabilities affecting their Camera Station Pro, Camera Station, and Device Manager products. The issues, discovered by cybersecurity researchers from Claroty Team82, include flaws such as deserialization of untrusted data, improper certificate validation, authentication bypass, and local privilege escalation. These vulnerabilities could allow an attacker to remotely execute arbitrary code, intercept communications via man-in-the-middle attacks, or bypass authentication mechanisms, significantly compromising the security posture of organizations using these systems globally. Patches are now available and users are urged to upgrade immediately. This incident highlights a growing trend in targeting surveillance and control infrastructure, reflecting the increased attention threat actors are placing on operational technology and critical manufacturing environments. The convergence of IT and OT risks, as well as heightened regulatory expectations, make robust security controls for IoT and camera systems more critical than ever.
8 months ago
Kill Chain
CISA Flags Critical ICS Flaws Threatening National Infrastructure in 2025
In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) released nine advisories covering serious vulnerabilities discovered in multiple industrial control systems (ICS) from vendors including Inductive Automation, Schneider Electric, Siemens, Mitsubishi Electric, Advantech, National Instruments, Rockwell Automation, and Axis Communications. These vulnerabilities potentially allow attackers to gain unauthorized access, move laterally, and disrupt or manipulate key operations in sectors such as energy, manufacturing, and transportation. Many of the issues arise from insecure configurations, insufficient encryption, outdated software components, and lack of segmentation between critical assets. This incident highlights the alarming persistence of security gaps across ICS environments. As operational technology (OT) converges with IT, attackers increasingly exploit these systems to launch ransomware, disrupt supply chains, or conduct cyber-physical sabotage, emphasizing the urgent need for robust controls, patching, and increased network visibility in critical infrastructure.
8 months ago
Kill Chain
Critical OS Command Injection Vulnerability Hits Mitsubishi Electric Iconics Products (2025)
In December 2025, Mitsubishi Electric Iconics Digital Solutions and Mitsubishi Electric Products disclosed a critical vulnerability (CVE-2025-11774) affecting GENESIS64, ICONICS Suite, MobileHMI, and MC Works64 software. This OS command injection flaw resides in the software keyboard (keypad) function, enabling local attackers to execute arbitrary executable files (.EXE) by tampering with configuration files. If successfully exploited, adversaries could trigger denial-of-service (DoS), information tampering, and unauthorized information disclosure or destruction on systems running these products. A fix is available for most products by upgrading to GENESIS64 v10.97.3 or higher, but MC Works64 users must migrate as no patch is planned. The incident is significant for the critical manufacturing sector, highlighting persistent risks tied to ICS software supply chains. As attackers increasingly exploit software flaws in operational technology, prompt patching and network segmentation remain vital. This vulnerability’s disclosure underscores the necessity for maintaining robust controls on critical infrastructure endpoints and monitoring for lateral movement threats.
8 months ago
Kill Chain
Rockwell Automation PLC Flaws Put Industrial Control Systems at Risk in 2025
In December 2025, Rockwell Automation disclosed multiple vulnerabilities affecting its Micro820, Micro850, and Micro870 programmable logic controllers (PLCs). The most critical issues (CVE-2025-13823, CVE-2025-13824) were found in the IPv6 stack and improper handling of malformed CIP packets, potentially allowing unauthenticated attackers to cause denial-of-service conditions. Successful exploitation could lead to systems becoming unresponsive and requiring physical intervention to restore operation. Affected product versions are widely deployed across critical manufacturing sectors worldwide, increasing the risk of operational disruptions. This incident highlights the growing exposure of operational technology (OT) devices to network-borne threats and the importance of promptly securing ICS environments. The prevalence of fuzzing-based vulnerability discovery and dependency on third-party components heighten the urgency to apply vendor-recommended mitigations and adopt defense-in-depth strategies.
8 months ago
Kill Chain
Critical LabVIEW 2025 Vulnerabilities Expose Industrial Control Systems to Code Execution Risk
In December 2025, multiple critical vulnerabilities (CVE-2025-64461 through CVE-2025-64469) were disclosed in National Instruments LabVIEW, a widely used industrial control software. The flaws, which include out-of-bounds write, out-of-bounds read, use-after-free, and stack-based buffer overflow, enable attackers to execute arbitrary code or exfiltrate information when a user opens a specially crafted VI file. Impacted versions span from LabVIEW 2021 up to 2025 Q3, affecting sectors such as critical manufacturing, defense, IT, and transportation globally. National Instruments released patches addressing these flaws, with older versions receiving limited or no support. Though there have been no reports of active exploitation, this incident highlights the persistent risk of supply chain and software vulnerabilities in critical ICS environments. Recent trends show a rise in sophisticated attacks leveraging user interaction and file-based exploits, emphasizing the growing need for robust patch management and secure software usage.
8 months ago
Kill Chain
Schneider Electric 2025: Critical WSUS Flaw Threatens Global Industrial Networks
In December 2025, Schneider Electric disclosed a critical vulnerability—CVE-2025-59287—in its EcoStruxure Foxboro DCS Advisor, an industrial automation component used worldwide across critical manufacturing and energy sectors. The vulnerability, rooted in untrusted data deserialization within Microsoft WSUS, could allow unauthenticated remote code execution with system-level privileges if exploited, threatening core operational networks. The exposure prompted Schneider Electric and CISA to issue urgent advisories urging immediate patching via provided Microsoft updates and to isolate control networks from business operations to prevent exploitation. Despite official advisories, any systems running unpatched software remain at high risk. The incident highlights the persistent challenges in securing dependencies within operational technology (OT) environments. With critical infrastructure increasingly targeted by sophisticated threat actors leveraging software supply chain and remote execution flaws, this case underscores the importance for organizations to proactively patch, segment networks, and reinforce incident response capabilities tailored for industrial control systems.
8 months ago
Kill Chain
Inductive Automation Ignition Vulnerability Exposes Critical Infrastructure to Privilege Escalation in 2025
In December 2025, Inductive Automation disclosed a privilege escalation vulnerability (CVE-2025-13911) in its Ignition SCADA platform widely used across critical manufacturing, energy, and IT sectors. The flaw arises from inadequate controls in the Python scripting environment, enabling authenticated administrators to execute arbitrary code with SYSTEM-level privileges on affected Windows hosts. Attackers can upload malicious project files to the Ignition Gateway, potentially leading to complete host compromise if exploited. Although there are currently no reports of public exploitation, this issue underscores growing risks associated with misconfigured automation platforms and the importance of adhering to least-privilege principles. Recent trends in supply chain and ICS-targeted attacks have increased regulatory pressure on critical infrastructure operators to address privilege escalation vectors.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
