Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5269 to 5280 of 5935
Amazon AWS 2024 Outage: What the DNS Infrastructure Failure Reveals
On June 13, 2024, Amazon Web Services (AWS) suffered a widespread outage attributed to a major DNS (Domain Name System) infrastructure failure. This disruption impacted numerous high-traffic websites and mission-critical online services, causing downtime and service degradation for businesses relying on AWS. While the outage was not caused by a cyberattack, the critical nature of DNS infrastructure meant that service availability and operational continuity were significantly affected. Amazon engineers quickly identified the root cause as an internal DNS misconfiguration and implemented remediation protocols to restore operations within hours. This incident highlights growing concerns about cloud infrastructure dependencies and the cascading business impact of DNS and network-layer disruptions. As digital ecosystems become more interlinked, organizations must consider both cyberattacks and operational failures in their risk management and compliance strategies.
8 months ago
Kill Chain
WordPress Mass Exploitation 2024: The Risks of Outdated Plugin Vulnerabilities
In June 2024, a mass exploitation campaign targeted thousands of WordPress websites worldwide by abusing known critical vulnerabilities in the GutenKit and Hunk Companion plugins. Attackers leveraged outdated versions lacking essential security patches to achieve remote code execution (RCE), enabling full control over affected sites. The campaign's automated exploits installed malicious payloads, manipulated website content, and frequently enabled further lateral movement or data theft. Organizations relying on vulnerable plugins faced significant reputational and operational disruption, with site defacements, malware delivery, and potential customer data exposure as key impacts. The incident highlights the persistent security challenge posed by unpatched plugins in popular web platforms. Amid a surge in mass web exploitation and supply chain attacks against CMS ecosystems, adversaries are rapidly weaponizing public proof-of-concept exploits, putting organizations at immediate risk from even dated vulnerabilities.
8 months ago
Kill Chain
GlassWorm Worm Spreads via VS Code Extensions in Massive 2025 Supply Chain Attack
In October 2025, cybersecurity researchers uncovered a major supply chain attack involving a self-spreading worm dubbed 'GlassWorm' that compromised Visual Studio Code (VS Code) extensions distributed via the Open VSX Registry and Microsoft Extension Marketplace. The threat actors leveraged malicious extensions to automatically propagate the worm among developer environments, enabling it to execute unauthorized code, exfiltrate credentials, and embed backdoors in developer toolchains. This incident resulted in widespread risk to organizations whose software supply chains depend on the integrity of these popular extension repositories, forcing rapid incident response across the global developer community. The GlassWorm incident highlights the escalating targeting of developers and DevOps pipelines by sophisticated cyber adversaries. As attackers evolve to exploit trust relationships in software ecosystems, organizations must strengthen supply chain security controls and increase vigilance around third-party code dependencies.
8 months ago
Kill Chain
WSUS Windows Server Vulnerability Exploited: What Organizations Need to Know in 2024
In June 2024, attackers began actively exploiting a critical-severity vulnerability in Microsoft’s Windows Server Update Services (WSUS), allowing unauthenticated remote code execution on unpatched Windows Server instances. Public proof-of-concept exploit code enabled threat actors to target organizations’ update infrastructure, potentially granting attackers elevated privileges and control over networked endpoints. The attack vector leverages unencrypted or weakly secured WSUS communication endpoints, risking malware delivery or the propagation of malicious updates across enterprise environments. Immediate business impacts can include system compromise, lateral movement, and potential data exfiltration. This exploitation reflects a recent trend where attackers leverage highly impactful remote code execution bugs in widely deployed software with public exploits, underscoring the need for rapid patch management and improved east-west traffic visibility. Organizations using legacy or unpatched WSUS deployments are most at risk as targeted attacks continue to rise.
8 months ago
Kill Chain
YouTube Malware Network: Over 3,000 Malicious Videos Unleashed in 2025 Campaign
In 2025, a coordinated cybercriminal network leveraged YouTube to distribute malware by uploading over 3,000 malicious videos disguised as legitimate content. The actors abused the platform’s trusted reputation and sophisticated SEO tactics to trick users into downloading harmful payloads linked from these videos. First detected in 2021, the operation escalated throughout 2025, with the volume of malicious uploads tripling and impacting thousands of unsuspecting viewers worldwide. The campaign has demonstrated the persistent risk posed by seemingly trustworthy public platforms being subverted for large-scale malware distribution, resulting in significant data compromise and potential financial losses for both individuals and organizations. This incident reflects a broader trend where threat actors exploit popular social media and video platforms to evade conventional perimeter defenses and reach wider audiences. The proliferation of such tactics underscores the urgent need for organizations and users to increase vigilance and adopt security controls that emphasize east-west traffic security, anomaly detection, and robust egress monitoring.
8 months ago
Kill Chain
APT36 Exploits Golang-Based Malware to Compromise Indian Government in 2025
In August and September 2025, the state-sponsored hacking group APT36 (also known as Transparent Tribe) launched a spear-phishing campaign targeting Indian government entities. The campaign delivered a new variant of a Golang-based remote access trojan, DeskRAT, which allowed attackers to gain persistent access, conduct reconnaissance, and exfiltrate sensitive information. The phishing emails, likely crafted to impersonate trusted sources, succeeded in infecting victim networks, enabling APT36 to conduct espionage activities against high-profile targets, further compromising Indian national security interests. This incident underscores the persistent risk posed by well-resourced, nation-state threat actors using continuously evolving malware families and novel programming languages like Golang. The rise of such campaigns highlights an urgent need for improved east-west traffic monitoring, zero trust network segmentation, and advanced user awareness against targeted phishing techniques.
8 months ago
Kill Chain
Microsoft WSUS 2025: Critical RCE Vulnerability Exploited in the Wild
In October 2025, Microsoft disclosed and urgently patched a critical remote code execution vulnerability (CVE-2025-59287) impacting the Windows Server Update Services (WSUS) framework. Following the public release of a proof-of-concept exploit, threat actors began actively targeting vulnerable WSUS deployments to execute malicious code, gain unauthorized access, and potentially compromise large segments of enterprise environments. The flaw, assigned a CVSS score of 9.8, allowed unauthenticated attackers to leverage exposed update services, posing significant risk to organizations’ patch management infrastructures before the emergency fix was implemented. This incident highlights the continuing trend of sophisticated adversaries exploiting zero-day and n-day vulnerabilities in widely used systems with available PoCs. It also underscores growing urgency for proactive patch management, real-time anomaly detection, and adoption of Zero Trust models to protect against rapidly weaponized threats.
8 months ago
Kill Chain
Smishing Triad’s 2024 US SMS Phishing Campaign: Government Impersonation Goes Mainstream
In early 2024, a threat group known as the 'Smishing Triad' launched a wave of phishing attacks targeting American mobile phone users through fake government-related SMS messages. The group impersonated federal and state agencies, primarily sending texts about unpaid toll fees and penalties to lure recipients into clicking malicious links. These links redirected victims to counterfeit payment portals to steal personal and financial information. The campaign used low-frequency, highly targeted smishing tactics which significantly increased trust and subsequent victim engagement, resulting in a notable uptick in credential theft and financial fraud. This incident is part of a broader trend where cybercriminal organizations leverage sophisticated social engineering and government impersonation at a time of regulatory scrutiny around SMS-based phishing (smishing). Its evolving tactics show how attackers adapt to increase impact, highlighting the urgent need for layered, identity- and zero-trust-driven defenses.
8 months ago
Kill Chain
Global Smishing Triad Campaign: 194,000 Malicious Domains Power Massive Phishing Surge
In 2024, security researchers attributed a global smishing campaign to a threat group known as the Smishing Triad, which registered more than 194,000 malicious domains since January 1. Utilizing infrastructure predominantly registered through Hong Kong-based providers with Chinese nameservers, the actors orchestrated widespread phishing via SMS attacks targeting banking, logistics, and other sectors. Victims received highly targeted text messages that redirected them to credential-harvesting sites, leading to financial fraud and data compromise. The campaign’s scale and global reach underline the adversaries’ operational sophistication and heavy use of automation. This incident reflects a broader surge in phishing tactics leveraging SMS and vast domain infrastructure, bypassing traditional email security. The growing adoption of QR and mobile-first communication further widens the threat surface, putting regulatory and compliance emphasis on new vectors.
8 months ago
Kill Chain
SessionReaper in the Wild: How a 2025 Adobe Commerce Flaw Fueled E-Commerce Breaches
In early 2025, a critical security vulnerability (CVE-2025-54236) was discovered in Adobe Commerce, formerly known as Magento. This flaw, actively exploited in the wild as 'SessionReaper,' enables remote attackers to hijack user sessions on e-commerce sites, bypassing authentication controls. Attackers leveraged this weakness to compromise sensitive customer data, manipulate transactions, and disrupt online sales operations for affected merchants. The exploitation led to significant financial and reputational risks, prompting rapid incident response and emergency patching. This incident highlights the growing trend of sophisticated web application attacks targeting popular e-commerce platforms. As threat actors increasingly weaponize session hijacking techniques and exploit critical flaws pre-patch, organizations must prioritize timely vulnerability management and layered defenses to protect customer trust and regulatory compliance.
8 months ago
Kill Chain
2024 Android Infostealer Attack: How Termux and Telegram Fueled Stealthy Mobile Data Breaches
In October 2024, researchers identified a novel Android infostealer undetected by antivirus engines, leveraging Termux—a legitimate terminal emulator app—to collect sensitive data from mobile devices. The attacker deployed a Python-based stealer designed to extract user contacts, SMS, call logs, location data, and app-specific files, including those for Facebook, WhatsApp, and banking. Exfiltration occurred via Telegram API integration, and a persistent backdoor was installed for continued access. The operation showcased clever abuse of legitimate utilities, with initial device compromise mechanics still unclear, though social engineering leading to the installation of Termux is likely. This incident highlights the evolving landscape in which infostealers now aggressively target mobile platforms as device usage and data stored on them surge. With sophisticated yet undetectable malware exploiting legitimate tools and APIs, organizations and users face heightened risks from threats previously confined mostly to Windows environments.
8 months ago
Kill Chain
Former L3Harris Executive Charged with Selling Cyber Trade Secrets to Russia
In August 2025, U.S. federal prosecutors charged Peter Williams, a former executive at L3Harris Technologies’ cyber division, with stealing and selling sensitive trade secrets to an undisclosed Russian buyer. Williams, the former general manager of specialized hacking group Trenchant, allegedly misappropriated eight proprietary technologies from two companies between April 2022 and August 2025, totaling $1.3 million in illicit gains. The Department of Justice seeks forfeiture of assets derived from the scheme. Neither L3Harris nor Trenchant is accused of direct wrongdoing. This incident underscores the growing threat posed by insiders with privileged access to highly sensitive cyber capabilities. As governments and critical industries bolster defenses, advanced techniques to detect, monitor, and mitigate insider risk are essential to prevent breaches that could have national security consequences.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
