Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4513 to 4524 of 5948
2025 Advanced Phishing Kits Exploit AI and MFA Bypass to Steal Credentials at Scale
In August 2025, cybersecurity firms identified four sophisticated phishing kits—BlackForce, GhostFrame, InboxPrime AI, and Spiderman—leveraging advanced AI and multi-factor authentication (MFA) bypass tactics to automate credential theft at massive scale. These kits use capabilities like Man-in-the-Browser (MitB) attacks to capture one-time passwords, impersonate legitimate brands, evade detection, and target both enterprise and individual platforms. Attackers deploy these toolkits to orchestrate widespread phishing campaigns, resulting in unauthorized account access, data loss, and potential downstream breaches for affected organizations. This incident illustrates a significant escalation in the complexity of phishing operations, combining AI-powered evasion with real-time MFA bypass. The rise of such modular, scalable phishing kits demonstrates the evolving challenge for organizations to safeguard user credentials and the urgent need for adaptive defenses.
8 months ago
Kill Chain
CISA Adds Google Chromium CVE-2025-14174 to Exploited Vulnerabilities List
In December 2025, CISA added CVE-2025-14174—a Google Chromium out-of-bounds memory access vulnerability—to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. This vulnerability enables threat actors to execute arbitrary code or potentially escalate privileges via unauthorized memory access within affected Chromium browser instances. Attackers exploited this flaw as an entry vector for malware and credential theft, increasing risks for both federal agencies and organizations relying on Chromium-based browsers. Federal Civilian Executive Branch agencies were directed, under BOD 22-01, to remediate this vulnerability by a strict deadline to mitigate ongoing risks. The rapid inclusion of CVE-2025-14174 in the KEV Catalog highlights persistent challenges posed by zero-day and n-day browser vulnerabilities. Recent increases in browser-based exploitation and strict regulatory mandates underscore the growing urgency to address software supply chain threats and prioritize swift vulnerability management across all industry sectors.
8 months ago
Kill Chain
Fake OSINT and GPT GitHub Repos Used to Spread PyStoreRAT in Supply Chain Attack
In late 2025, cybersecurity researchers uncovered a supply chain attack involving malicious repositories on GitHub impersonating open-source Python utilities themed around OSINT and GPT automation. These repos covertly delivered a previously unseen JavaScript-based Remote Access Trojan dubbed PyStoreRAT, using minimal code to retrieve and execute a remote HTA file. Unsuspecting developers and security professionals, lured by the project's legitimate appearance, risked compromise when cloning or running the code, resulting in unauthorized remote access and potential data exfiltration. The campaign highlights the growing sophistication of attacks abusing trusted developer platforms and open-source supply chains. This incident underscores the urgent need for organizations to audit third-party code sources, bolster code supply chain security, and monitor for emerging malware targeting developer ecosystems. The tactic reflects broader trends in social engineering, weaponized open-source projects, and the exploitation of generative AI themes by threat actors.
8 months ago
Kill Chain
FBI Delivers 630 Million Compromised Passwords to HIBP: 2024 Credential Exposure
In June 2024, the FBI provided Have I Been Pwned (HIBP) with approximately 630 million compromised passwords uncovered during multiple cybercrime investigations. The credentials were amassed from seized devices linked to a criminal suspect and sourced from the open web, Tor-based marketplaces, Telegram channels, and infostealer malware logs. Notably, about 46 million of these passwords were new to HIBP's repository, enabling organizations and individuals to proactively block use of these widely circulated credentials and bolster account security. The addition further expands the scale and utility of accessible credential hygiene tools worldwide. This incident underscores the ongoing and massive prevalence of credential compromise in the cybercrime landscape, as password data continually proliferates across threat actors and dark markets. It highlights the urgent need for organizations to adopt robust password exposure monitoring and zero trust authentication policies.
8 months ago
Kill Chain
Critical Gogs Zero-Day Exploited in Ongoing Supply-Chain Attacks
In early 2024, security researchers revealed that attackers had actively exploited a zero-day vulnerability in Gogs, a popular self-hosted Git service, for several months. The flaw, which allowed remote code execution (RCE), bypassed a previously disclosed patch, enabling unauthorized actors to compromise software supply chains by injecting code and potentially exfiltrating sensitive repositories. This sustained exploitation remained undetected until a disclosure by Wiz, highlighting that a patch was still unavailable at the time of reporting, therefore leaving many self-hosted Gogs deployments exposed and at risk. This incident underscores the increasingly sophisticated nature of supply-chain attacks and the challenges organizations face in managing security across open-source dependencies. With the rapid rise in software supply-chain exploits targeting CI/CD platforms, organizations are under mounting pressure to adopt stringent internal controls and layered defenses.
8 months ago
Kill Chain
2025 Surge in Supply Chain Attacks Hits GitHub Actions: What Every DevSecOps Leader Must Know
In 2025, a surge in supply chain attacks targeted GitHub Actions, leveraging insecure workflows and misconfigured secrets to inject malicious code into the software development pipeline. Attackers exploited open source dependencies and automation gaps, enabling lateral movement and data theft across multiple organizations using compromised CI/CD environments. The incident, revealed through coordinated research at Black Hat Europe, highlighted how adversaries can escalate privileges and bypass traditional defenses by targeting both public and private repositories, resulting in widespread risk for organizations with weak DevSecOps controls. This incident underscores a pronounced trend: attackers are increasingly focusing on automated development environments and supply chains, not just production workloads. With more organizations adopting GitHub Actions and similar platforms, visibility, zero trust segmentation, and secure automation practices are now critical to thwart sophisticated threat actors targeting the software supply chain.
8 months ago
Kill Chain
CISA Flags Exploited Vulnerability in Sierra Wireless AirLink ALEOS (CVE-2018-4063)
On December 12, 2025, CISA added CVE-2018-4063, a vulnerability impacting Sierra Wireless AirLink ALEOS, to its Known Exploited Vulnerabilities (KEV) Catalog, citing evidence of active exploitation. This vulnerability allows unrestricted upload of potentially malicious files, granting attackers the ability to gain remote control over affected network devices. Such vulnerabilities in network infrastructure expose organizations—including federal agencies—to heightened risks of unauthorized access, lateral movement, and disruption of operations. Federal Civilian Executive Branch agencies are mandated to remediate this issue promptly under Binding Operational Directive 22-01, and CISA encourages all enterprises to act urgently in their own environments. This incident highlights the persistent targeting of edge network infrastructure by threat actors, a trend accelerated by increased reliance on remote and distributed operations. The rapid inclusion of this vulnerability in CISA’s KEV Catalog underscores the growing regulatory and operational pressure on organizations to adopt proactive vulnerability and network segmentation controls.
8 months ago
Kill Chain
Hamas Espionage Malware Hits Middle East Diplomats: 2024 Breach Analysis
In early 2024, state-sponsored threat actors linked to Hamas intensified cyber-espionage campaigns targeting Middle Eastern diplomatic entities. Attackers leveraged tailored malware and advanced phishing schemes to infiltrate networks, harvest intelligence, and gain persistent access to government communications. The campaign utilized unpatched vulnerabilities, abused encrypted and lateral east-west traffic, and bypassed conventional perimeter defenses. These intrusions aimed to gather political intelligence and undermine regional security, impacting the operational confidentiality of affected governments and creating heightened diplomatic tensions. This incident reflects a broader escalation in politically motivated cyber-espionage across the region, as Hamas and allied groups continue to innovate with more sophisticated tooling and tactics. The evolving threat landscape underscores the urgency for robust east-west segmentation, encrypted traffic controls, and real-time threat detection among critical infrastructure and state agencies.
8 months ago
Kill Chain
How Salt Typhoon Infiltrated US Telecoms: Lessons from the 2024 Nation-State Attack
In early 2024, multiple major US telecommunications providers were targeted in a sophisticated nation-state attack attributed to Salt Typhoon, a Chinese-affiliated APT group. The attackers exploited unencrypted and east-west traffic flows within provider networks, bypassing conventional perimeter defenses to gain persistent access to sensitive infrastructure and intercept data in transit. Salt Typhoon leveraged advanced lateral movement and covert exfiltration techniques, enabling them to collect confidential communications and network architecture details. The incident led to significant operational risks, regulatory scrutiny, and concern within the telecom and national security sectors. This breach highlights a surge in highly targeted attacks on critical infrastructure, as nation-state actors exploit unencrypted traffic and insufficient internal segmentation. Current attacks reflect a broader strategic trend, with organizations facing pressure to modernize controls to address evolving threat vectors and international cyber-risk dynamics.
8 months ago
Kill Chain
Malware’s New Trick: Abusing the DLL EntryPoint in Windows (2024)
In December 2024, security researchers identified a Windows malware technique that leverages the DLL entry point (DllMain) to execute malicious code automatically upon DLL loading, even if no exported function is invoked. By embedding harmful operations—such as launching other processes—directly within DllMain, threat actors can evade typical detection methods that focus primarily on analyzing exported functions. This technique often harnesses trusted Windows utilities, like rundll32.exe or regsvr32.exe, as the initial execution vectors, making attacks stealthy and difficult to detect. The result is an elevated risk for lateral movement within environments and increased potential for undetected code execution. This method highlights a broader trend in which attackers abuse overlooked aspects of Windows internals to persist and evade controls. As adversaries continue to evolve, the need for better anomaly detection, code inspection, and zero trust segmentation becomes ever more critical for organizations defending against sophisticated malware delivery approaches.
8 months ago
Kill Chain
LockBit Ransomware: Why Reputation Now Drives RaaS Attacks and Ransom Payments (2025 Analysis)
In early 2025, research into the LockBit ransomware-as-a-service (RaaS) gang revealed the pivotal role of reputation in both attacker and victim circles. At its peak, LockBit utilized a vast network of nearly 200 affiliates to gain initial access, exfiltrate sensitive data, and negotiate ransoms, with over half achieving payout settlements after system encryption and data theft. The incident highlights the attackers’ emphasis on trust during ransom negotiations and the widespread operational and financial disruptions suffered by targeted organizations, including critical recovery costs, business downtime, and severe reputational impact stemming from media coverage. The increasing maturity and professionalization of RaaS operations, typified by LockBit, have made sophisticated extortion tactics more common. As law enforcement and insurers adapt, companies face heightened risk not just from technical compromise, but from strategic reconnaissance that monetizes cyber insurance intelligence, further escalating the urgency for advanced protection and segmentation of sensitive data.
8 months ago
Kill Chain
AI-Powered Attacks Break Smart Contracts: A 2025 Blockchain Breach Analysis
In late 2025, advanced AI models including Anthropic's Claude Opus 4.5, Claude Sonnet 4.5, and OpenAI's GPT-5 autonomously exploited vulnerabilities across a new smart contract benchmark (SCONE-bench) comprising 405 blockchain contracts. These AIs collectively discovered and weaponized vulnerabilities leading to $4.6 million in simulated or actual economic loss, proving AI-driven cyber capabilities have reached critical new thresholds. Further, simulations against nearly 2,850 newly deployed smart contracts with no previously known vulnerabilities resulted in successful zero-day discoveries and profitable exploits, despite only modest operational costs for the threat actors. This fundamentally changed the risk calculus for decentralized finance and blockchain-based businesses. These findings underscore a turning point, where the integration of conversational and agentic AI with offensive security tools directly translates to scalable, profitable cyberattacks. The incident highlights an urgent risk landscape: AI-driven exploitation is no longer theoretical, driving increased pressure for automated AI defensive strategies and regulatory focus in sectors reliant on smart contracts.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
