Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 4957 to 4968 of 5935
Rockwell Automation FactoryTalk DataMosaix: 2025 ICS Cloud Vulnerabilities Expose Industrial Risk
In November 2025, Rockwell Automation disclosed two critical vulnerabilities in its FactoryTalk DataMosaix Private Cloud platform, widely used across critical manufacturing sectors. The flaws include a weak authentication mechanism (CVE-2025-11084) that enables attackers to bypass MFA and gain unauthorized access, and a persistent cross-site scripting bug (CVE-2025-11085) that could facilitate account takeover, credential theft, or redirecting users to malicious sites. Rockwell and CISA jointly warned that attackers could exploit these remotely and potentially take control of sensitive ICS data or operations globally, demanding urgent updates. These vulnerabilities underscore rising risks tied to identity-driven attacks and web-based threats targeting industrial control environments. With Ransomware-as-a-Service and supply chain attacks escalating, organizations in critical sectors face mounting pressure to implement multi-layered controls and update legacy authentication practices.
8 months ago
Kill Chain
Siemens Solid Edge 2025: Improper Certificate Validation Exposes Critical Manufacturing to MITM Attacks
In November 2025, Siemens disclosed a critical vulnerability in its Solid Edge SE2025 product, identified as CVE-2025-40744. This software flaw, stemming from improper certificate validation in the License Service endpoint, allows unauthenticated remote attackers to perform man-in-the-middle (MITM) attacks by intercepting or manipulating encrypted traffic. The issue, rated 8.7 (CVSS v4), affects all versions of Solid Edge SE2025 prior to V225.0 Update 11, putting global critical manufacturing environments at risk of credential interception and data exposure. This incident reflects increasing attacker focus on exploiting certificate validation weaknesses in supply chain and industrial environments. With industrial control systems often at the core of large enterprises' operations, such vulnerabilities demand swift patching and ongoing vigilance in authentication and encrypted traffic controls.
8 months ago
Kill Chain
AVEVA Edge 2025: Cryptographic Weakness Leaves Critical Manufacturing at Risk
In November 2025, AVEVA disclosed a critical vulnerability (CVE-2025-9317) in its Edge HMI/SCADA software (versions 2023 R2 and prior), stemming from the use of a broken or risky cryptographic algorithm. The flaw allows local attackers with read access to Edge project or cache files to reverse engineer both application-native and Active Directory passwords via brute-force techniques. This security gap exposes organizations using AVEVA Edge in the critical manufacturing sector to unauthorized credential recovery, potentially impacting operational technology environments on a global scale. The incident highlights increased scrutiny of industrial control software security, especially against a backdrop of escalating supply chain and OT attacks. Regulatory and compliance pressures are intensifying, and organizations are urged to prioritize cryptographic hygiene, proactive patching, and strict access controls to mitigate insider and lateral threat risks.
8 months ago
Kill Chain
Critical Flaws in General Industrial Controls Lynx+ Gateway Threaten Manufacturing Security (2025)
In November 2025, critical vulnerabilities were discovered in General Industrial Controls' Lynx+ Gateway devices deployed worldwide across the critical manufacturing sector. The exposed flaws—included weak password requirements, missing authentication for critical functions, and cleartext transmission of sensitive information—allowed attackers to remotely access devices, obtain sensitive information, and, in some cases, potentially cause denial-of-service conditions. Multiple CVEs (CVE-2025-55034, CVE-2025-58083, CVE-2025-59780, CVE-2025-62765) were assigned, with the highest CVSS v4 base score reaching 9.2. Despite coordinated disclosure efforts, the vendor did not respond, leaving organizations reliant on their own layered defense measures. This incident is highly relevant as it highlights persistent challenges in secure authentication and encrypted traffic within operational technology environments. The surge in attacks exploiting similar unauthenticated remote access and cleartext weaknesses continues to drive regulatory pressure for zero trust and encryption controls within industrial networks.
8 months ago
Kill Chain
Siemens Altair Grid Engine 2025: Local Privilege Escalation and OT Vulnerability Risks
In November 2025, Siemens disclosed two local privilege escalation vulnerabilities affecting all versions of Altair Grid Engine prior to V2026.0.0. These flaws, identified as CVE-2025-40760 (Generation of Error Message Containing Sensitive Information) and CVE-2025-40763 (Uncontrolled Search Path Element), could allow attackers with local access to extract password hashes or execute arbitrary code with superuser permissions by manipulating environment variables or error handling processes. Although there has been no evidence of exploitation in the wild, the vulnerabilities required only low attack complexity and affected critical manufacturing environments globally. This incident highlights ongoing risks posed by improper input validation and error handling in operational technology (OT) environments, especially as attackers increasingly target privilege escalation vectors. Regulatory bodies emphasize swift detection, patching, and IT/OT segmentation to reduce attack surface, as local escalation flaws remain a persistent threat vector in critical infrastructure.
8 months ago
Kill Chain
Siemens 2025: Critical DLL Hijacking Flaw Exposes Manufacturing Software
In November 2025, Siemens disclosed a vulnerability (CVE-2025-40827) in its Software Center and Solid Edge products, affecting versions prior to 3.5 and V225.0 Update 10, respectively. The flaw, rooted in uncontrolled search path element (CWE-427), allows local attackers to execute arbitrary code via DLL hijacking—placing crafted DLLs on vulnerable systems. Although exploitation requires local access and some user interaction, compromise could lead to full system takeover in manufacturing environments globally. Siemens responded by advising immediate updates and enhanced network protections. This incident underscores the ongoing risks posed by software supply chain vulnerabilities and underscores the importance of timely patching in industrial environments. It highlights how attackers continue targeting widely deployed engineering software with low-complexity, high-impact exploits, especially as operational technology environments see increased convergence with IT infrastructures.
8 months ago
Kill Chain
Google Targets Smishing Triad: 2025 Lawsuit Disrupts Phishing-as-a-Service Operations
In November 2025, Google filed a landmark lawsuit in the Southern District of New York targeting the so-called "Smishing Triad," a China-based phishing-as-a-service group responsible for operating the Lighthouse phishing kit. This kit empowers cybercriminals to impersonate over 400 brands and conduct high-volume SMS attacks, luring victims worldwide into divulging payment information and one-time passcodes. Attackers leveraged the compromised data to enroll payment cards in mobile wallets on Apple and Google devices, allowing them to transact and cash out at scale. Google identified over a million victims in 120 countries, with Smishing Triad operators rotating up to 25,000 phishing domains in an eight-day window. The case highlights an increasing sophistication and industrialization of mobile phishing schemes, where threat actors utilize automation, rapid domain turnover, and collaboration across specialized roles. Legal escalation by a major tech company reflects growing efforts to disrupt cross-border cybercrime ecosystems that evade technical and regulatory countermeasures.
8 months ago
Kill Chain
Siemens COMOS 2025: Critical Software Vulnerabilities in Industrial Control Systems
In November 2025, Siemens disclosed critical software vulnerabilities affecting its COMOS platform, widely used in the industrial and critical manufacturing sectors. The flaws—specifically, an incomplete list of disallowed inputs and cleartext transmission of sensitive information—enabled remote attackers with low attack complexity to execute arbitrary code or intercept data. The affected versions were COMOS releases prior to 10.4.5, with potential for unauthorized access, data infiltration, or broader operational disruptions across global deployments. Siemens ProductCERT identified and reported the vulnerabilities, issuing patches and urging immediate upgrades and network protections. This incident is highly relevant given the increasing threats to industrial control systems and the persistent exploitation of software supply chain vulnerabilities. The convergence of IT and OT environments means that unresolved vulnerabilities like these present heightened risks in critical infrastructure, drawing attention from regulators and advanced cyber attackers alike.
8 months ago
Kill Chain
Critical ICS Vulnerabilities in Siemens SICAM P850/P855 Devices Impact Energy Sector
In November 2025, Siemens disclosed vulnerabilities affecting their SICAM P850 and P855 industrial control device families. Specifically, these products were susceptible to a Cross-Site Request Forgery (CSRF) flaw and incorrect permission assignment for critical resources, allowing attackers to execute unauthorized actions or impersonate users. The weaknesses impacted devices globally deployed in energy-critical infrastructure, with the main risk being attackers exploiting web sessions to modify device configuration or gain prolonged unauthorized access. Siemens ProductCERT identified the issues, which could be exploited remotely with low attack complexity, scoring up to 5.5 CVSS. This incident highlights growing concerns over ICS (Industrial Control Systems) vulnerabilities due to their essential role in critical infrastructure and the rising sophistication of exploitation tactics targeting web interfaces. The disclosure underscores the need for proactive patch management and access restrictions amid evolving regulatory and threat environments.
8 months ago
Kill Chain
Rockwell Automation SIS Workstation Vulnerability Exposes Critical Manufacturing
In November 2025, Rockwell Automation disclosed a critical path traversal vulnerability (CVE-2024-48510) in its AADvance-Trusted SIS Workstation software, impacting versions 2.00.00 to 2.00.04. The flaw stems from improper validation in the DotNetZip component, enabling remote attackers to execute arbitrary code if a victim opens a malicious file. This issue poses significant risks to critical manufacturing systems worldwide, potentially allowing adversaries to compromise safety instrumented system environments. Rockwell has released a patch in version 2.01.00 to address the flaw. This vulnerability is particularly noteworthy due to its low attack complexity, remote exploitability, and potential for widespread impact across global critical infrastructure. The incident underscores ongoing supply chain risks in industrial software and the urgent need for timely patching, robust endpoint security, and defense-in-depth strategies for operational technology (OT) environments.
8 months ago
Kill Chain
Critical Siemens LOGO! 8 Vulnerabilities Put Global ICS at Risk
In November 2025, Siemens disclosed multiple critical vulnerabilities affecting its LOGO! 8 BM Devices, widely deployed in global commercial facilities and transportation systems. Security researchers from Thales Cybersecurity Services Australia identified flaws enabling unauthenticated remote attackers to exploit classic buffer overflow and missing authentication vulnerabilities. These flaws could allow malicious actors to execute arbitrary code, disrupt device operations via denial-of-service, or modify critical device parameters such as IP address and time settings, potentially impacting industrial operations. The incident underscores growing concerns about the security posture of industrial control systems (ICS), as attackers increasingly target remote management features lacking modern authentication. With regulatory scrutiny intensifying and attackers exploiting similar flaws in operational technology, organizations must prioritize ICS security and proactive patch management to reduce exposure.
8 months ago
Kill Chain
Akira Ransomware 2025: How Edge Device Vulnerabilities Fueled Infrastructure Attacks
In November 2025, the Akira ransomware group and affiliates such as Storm-1567 and Howling Scorpius intensified attacks on critical infrastructure sectors by exploiting edge device and backup server vulnerabilities. Threat actors leveraged techniques including authentication bypass, brute-force credential attacks, and the deployment of new Akira_v2 malware for rapid encryption. Their sophisticated methods involved lateral movement through RDP/SSH, defense evasion with remote tools (Anydesk, LogMeIn), disabling security controls, and stealthy data exfiltration via FTP/SFTP/cloud channels. Impacted sectors ranged from Manufacturing and Education to Healthcare and Finance, resulting in encrypted systems, data theft, and serious operational disruption. This incident underscores the persistent evolution of ransomware tactics and the growing threat to organizations of all sizes. The prevalence of supply chain risks, rapid malware adaptation, and exploitation of misconfigured or outdated security perimeters demand continuous vigilance and investment in advanced detection, rapid patching, and segmentation strategies.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
