Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 433 to 444 of 5924
Critical Nvidia NemoClaw Flaw Exposes AI Agents to Persistent Poisoning Attacks
In August 2026, security researchers from Cyera's Oasis Identity Research discovered a critical vulnerability in Nvidia's NemoClaw tool that enables AI agent poisoning through DNS rebinding attacks. The flaw stems from improper network configuration of the Ollama API, which binds to 0.0.0.0:11434 instead of localhost, exposing an unauthenticated model server to browser-based attacks. Attackers can exploit this through malicious web pages to gain persistent control over local LLM instances, silently injecting hidden instructions into chat templates that corrupt AI agent behavior across all subsequent conversations. This represents a new class of AI infrastructure vulnerability where traditional networking flaws cascade into persistent model compromise, affecting organizations deploying autonomous AI agents with elevated system access. This incident highlights the emerging risks of agentic AI deployment where infrastructure misconfigurations can lead to persistent model corruption, demonstrating how traditional security concepts must evolve for AI-powered systems as organizations rapidly adopt autonomous agents.
3 weeks ago
Kill Chain
Forcepoint Exposes Critical AI Vulnerability: Hidden Prompts Manipulate Email Summarizers
In August 2026, Forcepoint X-Labs researchers demonstrated how attackers can manipulate AI-powered email summarizers through hidden HTML prompt injections. The proof-of-concept study showed that malicious instructions embedded in invisible text can cause AI assistants like Claude Haiku 4.5 to generate false summaries, altering critical information such as invoice amounts and meeting dates. The attack succeeded in all 10 test runs, with recipients receiving no indication that the AI-generated summaries contained corrupted data. This research validates OWASP's consistent ranking of prompt injection as the top risk for LLM applications since 2023. This incident highlights the growing urgency around AI security as organizations increasingly deploy autonomous AI agents with expanded capabilities beyond simple summarization, including email sending and meeting scheduling functions that could amplify attack impact.
3 weeks ago
Kill Chain
How Interpol's Jackal IV Exposed the Hidden Infrastructure Behind Global Cybercrime
Interpol's Operation Jackal IV concluded in August 2026 as a coordinated international law enforcement effort targeting West African cybercrime syndicates across 22 countries. The operation resulted in 58 arrests and identification of 263 additional suspects, focusing particularly on Black Axe and similar transnational organized crime networks responsible for business email compromise, romance scams, and cryptocurrency fraud. Unlike previous operations, Jackal IV emphasized intelligence gathering and infrastructure disruption over arrest numbers, targeting crime-as-a-service networks that provide domains and money laundering support to cybercriminal groups. Authorities seized $3.8 million in assets across Argentina, South Africa, Romania, and Italy, dismantling call center operations and shell company networks. This operation highlights the evolving sophistication of West African cybercrime infrastructure and the increasing reliance on specialized service providers. The emphasis on disrupting criminal support networks rather than individual operators reflects law enforcement's strategic shift toward degrading entire criminal ecosystems that enable large-scale cyber-enabled financial fraud.
3 weeks ago
Kill Chain
NovaCookies Phishing Service Commercializes Microsoft 365 Session Theft for $320/Month
In August 2026, researchers from Island discovered NovaCookies, a sophisticated adversary-in-the-middle (AitM) phishing-as-a-service platform targeting Microsoft 365 users for $320 per month. The service provides turnkey phishing infrastructure including domains, hosting, and real-time session theft capabilities that bypass multifactor authentication by stealing authenticated session cookies rather than just credentials. NovaCookies targets hundreds of organizations across multiple regions with over 755 dedicated domains, with more than half of targeted organizations located in the US. The platform combines trusted document platforms like DocuSign with legitimate Microsoft redirects and disposable infrastructure to create highly evasive campaigns that appear as ordinary sign-in events. This incident highlights the evolution of phishing attacks toward session hijacking techniques that render traditional MFA protections ineffective, representing a significant shift in the threat landscape that organizations must address with enhanced browser security and phishing-resistant authentication methods.
3 weeks ago
Kill Chain
How AI Voice Agents Are Revolutionizing Mobile Device Theft: The AnonyMousKIT Case Study
In 2026, cybersecurity researchers from SOCRadar discovered AnonyMousKIT, a sophisticated phishing-as-a-service (PhaaS) platform designed to bypass Apple's Activation Lock on stolen devices. The platform employs AI-powered voice agents that impersonate Apple Support representatives, calling theft victims to extract device passcodes, Apple ID credentials, and live two-factor authentication codes. Operating across five channels including email, SMS, WhatsApp, recorded calls, and AI voice agents, the service targets owners of recently stolen Apple devices with highly convincing lures that reference specific device identifiers and live Find My status. This incident demonstrates the concerning evolution of cybercriminal services, where AI technology is being weaponized to automate social engineering attacks at scale. The rise of AI-powered phishing platforms represents a significant escalation in threat sophistication, making device theft more profitable and highlighting the urgent need for enhanced user awareness and technical countermeasures against voice-based social engineering.
3 weeks ago
Kill Chain
Critical Gitea RCE Vulnerability Enables Widespread Cryptojacking Attacks
In August 2026, CISA warned of active exploitation targeting CVE-2026-60004, a critical remote code execution vulnerability in Gitea with a CVSS score of 9.8. Attackers leveraged Gitea's default open registration feature to create accounts and repositories, then exploited the diffpatch endpoint to execute arbitrary shell commands and deploy cryptocurrency mining malware. The vulnerability affects all Gitea versions from 1.17 onward and was patched in version 1.27.1. One documented case involved a hosting provider temporarily limiting a victim's CPU resources due to excessive processor usage from the cryptojacking payload. This incident highlights the growing trend of supply chain attacks targeting developer infrastructure platforms. As organizations increasingly rely on self-hosted development tools like Gitea, attackers are focusing on these environments to compromise source code repositories and deploy resource-intensive cryptojacking operations that can disrupt business operations.
3 weeks ago
Kill Chain
Critical Vulnerabilities in Ebyte Industrial IoT Gateways Expose Manufacturing and Energy Infrastructure
The Ebyte NE2-D11 industrial IoT gateway contains 12 critical and high-severity vulnerabilities (ICSA-26-237-06) that enable complete device compromise through multiple attack vectors. These flaws include missing authentication for critical functions, cleartext transmission of sensitive data, client-side authentication bypass, CSRF attacks, and insufficient credential protection. The vulnerabilities affect firmware version FW-9167-0-11 deployed worldwide in critical manufacturing and energy sectors, allowing remote attackers to gain administrative access, intercept communications, modify configurations, and disrupt operations without authentication. This advisory highlights the persistent security challenges in industrial IoT devices as critical infrastructure increasingly relies on connected systems. With Ebyte's limited response to coordination efforts and no confirmed patch timeline, organizations face immediate risks from devices that lack basic security controls essential for industrial environments.
3 weeks ago
Kill Chain
Critical Bendix EC80 Brake ECU Vulnerabilities Threaten Vehicle Safety Systems
In August 2026, CISA disclosed critical vulnerabilities in Bendix EC80 Brake ECU systems used across transportation infrastructure in the United States and Canada. The vulnerabilities include a stack-based buffer overflow (CVE-2026-67560), an out-of-bounds write (CVE-2026-68967), and hard-coded credentials (CVE-2026-71396). Successful exploitation could allow attackers to disable critical safety systems including ABS functions, steering assist, speedometer, automatic traction control, and shifting capabilities, potentially causing catastrophic vehicle safety failures. The vulnerabilities were discovered by Ben Gardiner of NMFTA and affect multiple EC80ESP+ and EC80ESP variants across different firmware versions. This incident highlights the growing threat landscape targeting industrial control systems and critical transportation infrastructure, as nation-state actors and cybercriminals increasingly focus on operational technology vulnerabilities that can cause physical harm and disrupt essential services.
3 weeks ago
Kill Chain
SLEEPWALKER Backdoor: The Invisible Threat That Waits for a Single Packet
In August 2026, security researchers documented SLEEPWALKER, a sophisticated Windows backdoor that remains dormant until activated by a specially crafted network packet. The 59,904-byte DLL impersonates Microsoft's dpapi.dll and side-loads into ESET Management Agent processes, executing commands through its own 23-instruction bytecode language across six transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI. The backdoor makes no outbound connections and leaves minimal forensic traces, consistent with advanced persistent threat operations. This discovery highlights the evolution of stealth backdoors toward packet-triggered activation mechanisms that bypass traditional network monitoring and endpoint detection systems.
3 weeks ago
Kill Chain
INTERPOL's Massive West African Cybercrime Takedown: What Operation Jackal IV Reveals About Modern Fraud Networks
INTERPOL's eight-month Operation Jackal IV resulted in 58 arrests and identification of 263 suspects across 22 countries, targeting West African organized crime groups including Black Axe. The operation disrupted romance scams, cryptocurrency fraud, business email compromise schemes, and money laundering networks that collectively stole over €988 million. Key raids included a South African syndicate targeting English-speaking retirees ($2.67 million seized, 257 accounts blocked) and a Romanian call center promising fake cryptocurrency returns (€143 million stolen globally, 11 arrests made). This latest crackdown represents the fourth iteration of Operation Jackal, demonstrating escalating international cooperation against West African cybercrime syndicates that have become increasingly sophisticated in their crime-as-a-service operations and cross-border financial fraud schemes. This incident highlights the growing threat of organized West African cybercrime groups that operate like legitimate businesses with specialized roles for conversion and retention agents, exploiting global financial systems through sophisticated social engineering and cryptocurrency laundering schemes.
3 weeks ago
Kill Chain
Critical Maritime Security Alert: FURUNO FA-50 AIS Transponder Vulnerabilities Expose Global Fleet
Critical vulnerabilities CVE-2026-59769 and CVE-2026-67578 were discovered in FURUNO FA-50 Class B AIS Transponder devices used worldwide in maritime transportation systems. The flaws include hardcoded credentials and missing authentication for critical functions, allowing attackers with network access to alter device settings and configurations. With CVSS scores of 9.1 and 7.5 respectively, these vulnerabilities affect all versions of the discontinued product, leaving thousands of vessels potentially exposed to navigation system manipulation. FURUNO ended production in October 2020 and will not provide security updates, recommending only physical security measures and network isolation as mitigations. This incident highlights the growing risks of legacy IoT/OT devices in critical infrastructure, where end-of-life products continue operating without security support, creating persistent attack vectors that threaten maritime safety and operational integrity.
3 weeks ago
Kill Chain
Critical ZoneMinder Vulnerability Exposes Video Surveillance Infrastructure to Remote Code Execution
ZoneMinder, a widely-deployed open-source video surveillance software, disclosed a critical OS command injection vulnerability (CVE-2026-76060) affecting versions 1.37.48 and 1.38.3. The vulnerability allows authenticated users with 'View Events' permissions to execute arbitrary operating system commands through unsanitized input in the exportFile parameter during event export operations. With a CVSS score of 8.8, successful exploitation grants full remote code execution as the web server user, potentially compromising entire surveillance infrastructure installations. This incident highlights the growing trend of supply chain vulnerabilities in critical infrastructure software, particularly as organizations increasingly rely on open-source solutions for security monitoring. The vulnerability's discovery through a public proof-of-concept demonstrates the escalating risk of weaponized research and the need for proactive vulnerability management in surveillance systems that often operate with elevated privileges across enterprise networks.
3 weeks ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
