Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4813 to 4824 of 5937
Sturnus Android Trojan Exposes Secure Messaging Apps in Major 2024 Threat
In May 2024, security researchers uncovered a new Android banking trojan named Sturnus targeting mobile devices in the wild. Sturnus stands out for its advanced multi-stage capabilities, allowing the malware to intercept and exfiltrate end-to-end encrypted messages from applications such as Signal, WhatsApp, and Telegram. The malware also leverages device accessibility services to gain total device control, enabling it to steal SMS, contacts, banking credentials, and intercept two-factor authentication (2FA). Initial infection is typically achieved via malicious sideloaded APKs distributed through phishing campaigns and third-party app stores, exposing users to substantial data theft and account compromise risk. This incident highlights a growing trend in Android malware evolution, where banking trojans are increasingly equipped with multi-app message theft, advanced evasion techniques, and device takeover functions. The widespread use of encrypted messaging apps in business and personal communication elevates the threat, driving demand for enhanced mobile endpoint security and stricter controls on app distribution.
8 months ago
Kill Chain
Crypto Mixer Crackdown: Samourai Wallet Founders Convicted for $237M Laundering Scheme
In 2024, the founders of Samourai Wallet, a cryptocurrency mixing service, were sentenced to prison by US authorities for their role in facilitating the laundering of over $237 million in illicit funds. Operating from 2015 through 2024, Samourai provided obfuscation tools that enabled criminals—including ransomware operators and darknet market traffickers—to conceal the origins and flows of cryptocurrency transactions. Authorities dismantled the platform and arrested the operators following a lengthy investigation. This action directly crippled a major infrastructure point in the cybercrime ecosystem, disrupting widespread money laundering tactics reliant on mixer services. The case underscores growing regulatory and law enforcement scrutiny of crypto-mixing services due to their integral role in financial crime, ransomware payments, and evasion of anti-money laundering (AML) controls. Organizations dealing in digital assets now face heightened compliance and monitoring pressures worldwide.
8 months ago
Kill Chain
D-Link DIR-878 End-of-Life Routers Hit by Critical 2024 RCE Flaws
In June 2024, D-Link issued an urgent advisory regarding three critical remote command execution (RCE) vulnerabilities affecting all models and hardware revisions of its end-of-life DIR-878 wireless routers. These flaws, discovered by cybersecurity researchers, allow unauthenticated remote attackers to execute arbitrary commands on the device, effectively gaining full control. Although D-Link had ended firmware support in 2021, the routers remain in widespread use, especially in emerging markets, increasing the exposure of organizations and individuals who have not decommissioned the devices. The attackers can exploit these weaknesses for lateral movement, network reconnaissance, or as a foothold into larger networks. This incident underscores the dangers posed by unsupported legacy hardware and the importance of proactive lifecycle management. Given the vulnerabilities enable full device compromise with no user interaction, similar RCE attacks targeting end-of-life networking equipment are likely to rise as threat actors pivot toward unpatched infrastructure.
8 months ago
Kill Chain
SonicWall SonicOS SSLVPN Flaw Leaves Firewalls Exposed to Crash Attacks
In June 2024, SonicWall disclosed a high-severity vulnerability in its SonicOS SSLVPN implementation, which allowed unauthenticated attackers to crash and potentially render SonicWall firewall appliances unusable. The flaw, identified as CVE-2024-XXXX, could be exploited remotely by sending specially crafted requests to exposed firewalls. SonicWall warned customers to urgently apply patches as no authentication was required to leverage the exploit, and exploitation could result in significant network downtime or gaps in perimeter defense. This incident highlights the ongoing risk to enterprises reliant on perimeter security devices and the speed with which attackers weaponize newly discovered vulnerabilities. With increasing attacks targeting Internet-exposed VPN gateways and firewalls, rapid patching and layered defensive controls are now more critical than ever.
8 months ago
Kill Chain
Salesforce 2024 Breach: Gainsight Supply Chain Compromise Exposes Customer Data
In June 2024, Salesforce launched an investigation after a supply chain breach at Gainsight, a software vendor, resulted in the theft of certain Salesforce customer data. Attackers exploited compromised Gainsight credentials to gain unauthorized access to customer information via third-party OAuth apps. Salesforce responded quickly by revoking refresh tokens linked to impacted Gainsight-published integrations and advised customers to take precautionary steps, including reviewing and rotating their credentials. While the breach did not affect Salesforce’s internal systems, it highlighted the significant risk posed by interconnected software supply chains and third-party integrations. This incident underscores the increasing sophistication of supply chain attacks targeting cloud platforms and SaaS providers. As businesses rely more heavily on integrated services and external vendors, attackers are exploiting trust relationships to bypass traditional security controls, emphasizing the urgent need for robust third-party risk management and continuous monitoring.
8 months ago
Kill Chain
GlobalProtect VPN Portals Probed by 2.3 Million Malicious Scan Sessions
Beginning on November 14, 2025, cybersecurity researchers detected an unprecedented surge in malicious scanning activity targeting Palo Alto Networks GlobalProtect VPN portals worldwide. Over 2.3 million scan sessions were recorded within days, emanating from a diverse array of global IP addresses and employing automated tools to probe for vulnerabilities and gather intelligence on remote-access infrastructure. While no large-scale exploitations or breaches have yet been confirmed, the scanning phase indicates advanced reconnaissance tactics that precede exploitation, raising significant concern for organizations relying on GlobalProtect for secure remote access. This event highlights a sharp escalation in mass automated reconnaissance against widely deployed VPN systems, following recent critical vulnerabilities in VPN technologies and a growing attacker focus on initial access vectors. The trend reinforces the urgency for improved monitoring, swift patching, and modern segmentation controls in remote-access environments.
8 months ago
Kill Chain
Google Uncovers BadAudio Malware in Chinese APT24 Espionage Campaign
In early 2024, Google’s Threat Analysis Group uncovered a sophisticated, years-long cyber espionage campaign orchestrated by the China-linked APT24 threat group. The attackers leveraged a newly discovered malware dubbed BadAudio to infiltrate government agencies, research institutions, and select private organizations. Initial access was obtained via spear-phishing campaigns, progressing to persistent lateral movement within compromised environments. BadAudio’s deployment enabled covert data exfiltration over encrypted channels, evading standard security controls and providing unmatched visibility and persistence for the attackers. The incident highlights the advanced tradecraft and evolving toolsets in use by nation-state threat actors, with business impacts centered on the loss of sensitive data and the undermining of critical organizational trust. The exposure of BadAudio signals a notable escalation in cyber espionage tactics, utilizing bespoke malware and encrypted traffic to circumvent modern defenses. Organizations across sectors are at risk as threat groups adopt similar methods, prompting increased scrutiny from regulators and heightened awareness around securing east-west traffic and anomaly detection.
8 months ago
Kill Chain
Supply Chain Breach Hits Italian Rail Group via Almaviva: 2.3TB Data Stolen in 2024
In early June 2024, a threat actor claimed responsibility for breaching the Italian railway operator FS Italiane Group by targeting its IT services provider, Almaviva, resulting in the exfiltration of 2.3TB of sensitive data. The attackers reportedly gained initial access through compromised internal systems and leveraged this infiltration to move laterally, eventually accessing and downloading a vast trove of corporate documents, contracts, and possibly personal information related to employees and customers. The incident exposed Italy's transportation sector to significant risk of espionage, operational disruption, and data loss, igniting widespread concern among critical infrastructure operators. This breach highlights the mounting threat posed by attacks on trusted IT service providers, which serve as gateways to high-value targets. With the proliferation of supply chain and third-party compromise incidents globally, organizations in critical industries must reassess their lateral movement controls, segmentation, and third-party risk governance.
8 months ago
Kill Chain
Iran-Linked Hackers Fuse Cyber Espionage and Kinetic Strikes with Ship AIS Breach
In November 2025, state-sponsored hackers tied to Iran conducted a sophisticated cyber operation targeting maritime assets by mapping Automatic Identification System (AIS) data of commercial ships transiting a volatile region. Advanced reconnaissance and cyber infiltration enabled the attackers to gather real-time ship movement and metadata, informing a coordinated missile strike days later. The breach demonstrated tight integration between cyber-enabled intelligence collection and traditional kinetic attacks, raising alarm within global shipping, defense, and infrastructure sectors. The incident highlights a dangerous evolution in the use of cyber capabilities to directly amplify physical-world conflict and disruption. The rapid fusion of cyber warfare with real-world military operations signals a new era of threats that transcend digital boundaries. As geopolitical tensions escalate and critical infrastructure remains vulnerable, robust cyber and operational defenses are imperative for organizations at risk of becoming targets in hybrid war campaigns.
8 months ago
Kill Chain
TamperedChef Malware: Fake Software Installers Fuel a Global Attack Wave
In late 2025, a widespread malvertising campaign dubbed 'TamperedChef' was uncovered by Acronis Threat Research Unit. Threat actors distributed fake installers of popular software through fraudulent ads and compromised websites to trick users into deploying malicious payloads. Once installed, the malware established persistence, deployed JavaScript-based remote access tools, and enabled lateral movement within enterprise and individual networks. The campaign demonstrated sophisticated social engineering tactics and leveraged encrypted command-and-control channels to evade traditional detection mechanisms, resulting in compromise of endpoints across multiple countries. This incident highlights a surge in supply chain and software installer threats, with attackers exploiting user trust and sophisticated malvertising techniques. As ransomware groups and financially motivated actors increasingly target software distribution vectors, organizations face mounting regulatory scrutiny and operational risk without multilayered defenses and advanced endpoint monitoring.
8 months ago
Kill Chain
Tsundere Botnet: How Blockchain-Powered Node.js Malware Threatened Global Supply Chains in 2025
In mid-2025, the Tsundere botnet, attributed to a Russian-speaking threat actor known as "koneko," emerged as a new and flexible malware campaign. It primarily targeted Windows users by disguising itself as installers for popular games or using Remote Monitoring and Management (RMM) tools to deliver its payload. The malware leveraged MSI and PowerShell-based installers to deploy malicious Node.js scripts, establishing persistence and communicating with its command-and-control (C2) infrastructure by dynamically retrieving C2 addresses from Ethereum blockchain smart contracts. This adaptive technique, along with a marketplace-enabled control panel, facilitated operational resilience and monetization among cybercriminals. This incident is significant due to the combination of modern supply chain manipulation, blockchain-based C2 address obfuscation, and pay-per-build business models. Tsundere highlights a trend toward malware leveraging decentralized platforms for better survivability against take-downs and rapid evolution, posing ongoing challenges for traditional defenses and compliance frameworks.
8 months ago
Kill Chain
Sturnus: New Android Trojan Hijacks Devices & Captures Encrypted Chats
In late 2025, cybersecurity researchers discovered a sophisticated Android banking trojan dubbed Sturnus, which enables credential theft and full device takeover for financial fraud. Sturnus stands out by bypassing encrypted messaging protections, capturing decrypted content directly from the device screen to monitor sensitive apps and intercept confidential chats. Threat actors leveraged phishing campaigns and malicious app distribution to compromise victims, ultimately gaining unauthorized access to financial information and conducting unauthorized transactions. The attack demonstrates the growing ingenuity of malware targeting mobile banking and highlights the challenges of relying solely on network-level encryption. This incident is especially timely due to the rapid evolution of mobile banking threats and attackers' increasing focus on defeating application-layer defenses. Sturnus's capability to monitor encrypted communications at the device level sets a worrying new precedent in malware TTPs, urging organizations to reassess endpoint and messaging security controls.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
