Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4561 to 4572 of 5948
Kubernetes NodeLogQuery (CVE-2024-9042): Command Injection Exploit Hits Windows Nodes
In late 2024, a command injection vulnerability in Kubernetes' NodeLogQuery feature (CVE-2024-9042) was actively exploited, primarily impacting clusters running Windows nodes with log read permissions enabled. Attackers leveraged the '/logs/' API endpoint, injecting operating system commands via GET parameters or path elements to gain unauthorized system access. Victims included enterprise environments utilizing the beta NodeLogQuery feature, which was not enabled by default. The exploit techniques involved turning Kubernetes' logging capabilities into a remote code execution avenue, exposing sensitive workloads to further compromise and potential lateral movement. This incident underscores a broader trend in targeting Kubernetes clusters at the API layer, as adversaries evolve their exploitation of cloud-native misconfigurations and insecure default settings. The attack highlights the need for enhanced east-west traffic controls, static analysis of cluster policies, and real-time anomaly detection to intercept emerging exploitation patterns in cloud and hybrid infrastructure.
8 months ago
Kill Chain
React2Shell: 2025’s Supply Chain Cyberattack Shocks 50+ Organizations
In June 2025, a surge of attacks leveraging the critical React2Shell vulnerability (CVE-2025-55182) swept across more than 50 organizations globally. The flaw, located in React Server Components and derivatives like Next.js, enabled diverse threat actors ranging from nation-states (notably North Korean and Chinese groups), cybercriminals, and botnets to achieve remote code execution. Attackers exploited unpatched instances, deploying a range of malware—including cryptominers, ransomware, and backdoors such as Mirai, XMRIG, and BPFDoor—affecting entities in finance, tech, education, government, and more. The incident’s rapid expansion was facilitated by the widespread availability of public proof-of-concept exploits and slow organizational patching. The React2Shell crisis highlights the fragility of the software supply chain and the speed at which novel exploits can be adapted by a wide array of adversaries. Security and regulatory scrutiny is intensifying, with urgent patching deadlines and increased concern due to the vulnerability’s ease of exploitation, high automation, and ability to evade traditional controls, reminiscent of the earlier Log4Shell incident.
8 months ago
Kill Chain
Ashen Lepus Strikes: 2025 APT Breach Unveils Advanced Espionage Across Middle Eastern Diplomatic Targets
In late 2025, a Hamas-affiliated APT group known as Ashen Lepus (also referred to as WIRTE) executed a sophisticated cyber-espionage campaign targeting governmental and diplomatic organizations across multiple Middle Eastern countries. The attackers leveraged a novel modular malware suite called AshTag, delivered through decoy documents, DLL sideloading, and a carefully staged infection chain. The campaign made extensive use of in-memory payload delivery, advanced encryption, legitimate-themed subdomains for C2 communications, and the abuse of widely used file transfer tools like Rclone to exfiltrate sensitive, often diplomacy-related data. This incident marks a notable evolution in the operational security and technical sophistication of Middle Eastern espionage campaigns. It highlights the rising use of modular malware, infrastructure blending, and legitimate protocol abuse by regionally motivated threat actors, underscoring a trend where state-linked groups continue cyber operations despite geopolitical turmoil or ceasefires.
8 months ago
Kill Chain
Microsoft Patches Critical Zero-Day in Windows: December 2025 Security Update
In December 2025, Microsoft issued patches for 57 vulnerabilities across its product suite as part of its final Patch Tuesday of the year. Notably, the release addressed an actively exploited zero-day vulnerability, CVE-2025-62221, impacting the Windows Cloud Files Mini Filter Driver. This use-after-free flaw, with a CVSS score of 7.8, allowed attackers to potentially gain system-level privileges when chained with code execution bugs. Affecting all supported versions of Windows, the vulnerability drew immediate attention from CISA and the cybersecurity community due to its presence in production environments and ongoing exploitation. The incident underscores a persistent trend of attackers targeting foundational Windows components through privilege escalation and memory management bugs. With the rising complexity of Microsoft’s ecosystem and a continued increase in vulnerabilities—especially as AI-related issues proliferate—organizations face growing pressure to rapidly deploy patches and strengthen monitoring against sophisticated exploits.
8 months ago
Kill Chain
Supply Chain Malware Infects VS Code, Go, npm & Rust: 2025 Developer Data Breach
In December 2025, cybersecurity researchers uncovered a sophisticated supply chain attack where malicious extensions on the Visual Studio Code Marketplace, along with booby-trapped Go, npm, and Rust packages, stealthily harvested sensitive developer data. Threat actors disguised two VS Code extensions as a popular dark theme and an AI-powered coding assistant, which, upon installation, downloaded stealer malware to exfiltrate screenshots, code, Wi-Fi passwords, clipboard content, and browser session data. Complementary attacks leveraged typosquatting in open-source package ecosystems, including npm, Go, and Rust, to hijack credentials and upload them to attacker-controlled infrastructure. This incident underscores the growing wave of software supply chain threats specifically targeting developer environments. As attackers increasingly exploit trusted dev tool repositories and package managers to gain initial access and exfiltrate enterprise credentials, organizations must urgently reevaluate their security posture around code dependencies and third-party extensions.
8 months ago
Kill Chain
Ukrainian Hacker Charged: Russian Hacktivist Attacks Underscore U.S. Critical Infrastructure Risks
In 2024, U.S. authorities charged a Ukrainian national for collaborating with Russian state-sponsored hacktivist groups in a series of high-profile cyberattacks against critical infrastructure. The targeted sectors included U.S. water systems, election infrastructure, and nuclear facilities. Leveraging advanced intrusion tools and lateral movement tactics, the attacker contributed to sophisticated campaigns aimed at espionage, disruption, and potential sabotage. These efforts underscore the persistent threat posed by coordinated state-aligned cyber actors and the increasing risk to essential public services worldwide. This case highlights how modern threat actors are expanding their focus from traditional targets to critical infrastructure with geo-political motives. The intersection of hacktivism, nation-state support, and escalating global tensions demands greater cyber defense readiness and robust compliance from both private and public sectors.
8 months ago
Kill Chain
STAC6565 & Gold Blade Exploit Recruitment Platforms in Canadian Ransomware Assault (2025)
Between February 2024 and August 2025, a financially-motivated threat group tracked as STAC6565 (with strong overlaps to the Gold Blade/RedCurl actor cluster) orchestrated a series of nearly 40 targeted cyberattacks, predominantly on Canadian organizations. The attackers utilized spear-phishing campaigns, delivering weaponized resumes via legitimate recruitment platforms to HR staff to gain initial access. Once inside, the group deployed a multi-stage attack chain using custom loaders and tools like RedLoader, RPivot, and Chisel, culminating in QWCrypt ransomware deployment on high-value endpoints including hypervisors. Data theft and extortion were observed, with a clear pattern of operational sophistication and periods of dormancy followed by refined attack waves. This incident highlights the increasing adoption of "hack-for-hire" models, hybrid attacks combining espionage and ransomware, and the innovative abuse of legitimate business platforms to sidestep conventional email security. Organizations globally—particularly those with HR exposures and reliance on virtualized infrastructure—face heightened risk as attackers rapidly iterate on TTPs to maximize impact and evade detection.
8 months ago
Kill Chain
Google Chrome 2025: AI Browsing Defenses Raise the Bar Against Indirect Prompt Injection
In December 2025, Google implemented new layered defenses in the Chrome browser to counter indirect prompt injection attacks following the introduction of agentic AI features. Attackers exploited weaknesses inherent in large language model-powered browser agents, attempting to override user intent, exfiltrate data from other sites, or execute rogue actions by injecting malicious prompts via untrusted web content. Google's updated architecture introduced components like the User Alignment Critic and Agent Origin Sets, isolating agent actions from attacker-controlled data and enforcing origin-based access controls. These measures aim to prevent data leaks and unauthorized automation that could compromise user accounts, sensitive information, or browser integrity. This incident highlights the rising risk of AI-driven browsing, where automated agents interacting with multiple web origins are exposed to sophisticated prompt-based attacks. The move reflects a broader industry push for deterministic (non-LLM) safeguards and ongoing regulatory and organizational scrutiny over rapidly evolving AI systems in end-user applications.
8 months ago
Kill Chain
Storm-0249 Orchestrates Precision Ransomware Attacks with ClickFix and Advanced Endpoint Exploits
In December 2025, threat actors identified as Storm-0249 escalated their cybercriminal operations, shifting from initial access brokerage to hands-on ransomware deployment using advanced techniques. Leveraging the ClickFix social engineering tactic, they convinced victims to execute malicious commands via spoofed domains leading to fileless PowerShell execution and DLL side-loading attacks. The attackers exploited legitimate security software processes to deploy trojanized DLLs, establish persistent and encrypted communications, and use living-off-the-land binaries to evade detection. These sophisticated methods enabled Storm-0249 to lay the groundwork for ransomware payloads tied to unique system identifiers, bolstering their ability to monetize enterprise footholds with minimal exposure. This incident reflects a broader trend toward precision, low-noise endpoint exploitation using fileless methods and trusted process abuse. Cybersecurity teams must adapt quickly to shifting tactics that exploit endpoint trust, social engineering, and advanced lateral movement, as similar methodologies are rapidly proliferating among ransomware and initial access threat groups.
8 months ago
Kill Chain
GrayBravo's CastleLoader: 2025’s Multicluster MaaS Campaign Hits the Logistics Sector
In early to late 2025, the threat actor known as GrayBravo (formerly TAG-150) orchestrated multiple large-scale cyberattacks leveraging CastleLoader, a sophisticated malware loader distributed under a malware-as-a-service (MaaS) model. Four coordinated threat clusters exploited CastleLoader to compromise organizations—particularly in logistics—via phishing, malvertising, and credential harvesting. Attackers used fraudulent accounts on freight-matching platforms to enhance deception, delivering a range of information stealers and remote access trojans, including CastleRAT, RedLine Stealer, and NetSupport RAT. Multi-tiered infrastructure supported resilient operations and facilitated rapid malware deployment, leading to significant business and security disruption for targeted sectors. This incident illustrates an escalating threat trend: advanced MaaS tooling like CastleLoader rapidly proliferates across the cybercrime ecosystem, enabling both seasoned and novice criminals to launch complex, high-impact attacks. The campaign underscores attackers’ increasing industry expertise, adaptation to detection, and exploitation of legitimate business platforms to maximize credibility and impact.
8 months ago
Kill Chain
Docker Hub Credential Leak: How Over 10,000 Containers Exposed the Supply Chain
In early June 2024, security researchers discovered that over 10,000 publicly available Docker Hub container images were leaking sensitive credentials, authentication keys, and API secrets. The exposed data included valid keys for production systems, CI/CD pipelines, cloud services, and large language models. Attackers could potentially use these secrets to compromise cloud infrastructure, move laterally within enterprise environments, exfiltrate data, or execute supply chain attacks. The incident highlights the risks associated with supply chain components and improper secrets management in application build processes. This event is highly relevant as containerized workloads and DevOps toolchains continue to proliferate, making the exposure of embedded credentials a fast-growing avenue for cyberattacks. Increased regulatory scrutiny and high-profile breaches are raising awareness of the urgent need to secure supply chain assets.
8 months ago
Kill Chain
Spiderman Phishing Service: A 2024 Wakeup Call for European Banks
In early 2024, a sophisticated phishing-as-a-service platform known as Spiderman emerged, targeting customers of more than 50 European banks and cryptocurrency holders. The perpetrators leveraged pixel-perfect cloned websites and credential harvesting techniques to deceive users into divulging sensitive financial information. Attackers used advanced phishing kits capable of bypassing two-factor authentication and dynamically generating legitimate-looking web pages, resulting in significant financial losses and heightened concern among European financial institutions. This incident underscores a growing trend of increasingly accessible and effective phishing services, enabling even low-skill cybercriminals to launch large-scale, targeted attacks. Regulatory scrutiny and the evolving threat landscape demand that organizations bolster defenses against phishing service operations leveraging social engineering and real-time site cloning.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
