Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5341 to 5352 of 5935
International SIM Box Fraud Network Dismantled in Major 2024 Sting Operation
In June 2024, law enforcement agencies from multiple countries executed a coordinated operation that dismantled a large-scale SIM box fraud network. This criminal enterprise facilitated the use of SIM boxes—devices housing dozens or hundreds of SIM cards—to provide fake phone numbers from over 80 countries to criminals. The network enabled anonymous communications for threat actors, facilitating various cybercrimes such as phishing, scams, and the circumvention of telecommunication safeguards. The takedown targeted both the technical infrastructure and the operators, disrupting ongoing fraudulent operations and preventing further abuse. This operation underscores an increased focus among law enforcement on telecom fraud infrastructure, which has proliferated alongside the rise in organized cybercrime and financial scams leveraging global communications. Recent trends show cybercriminals rapidly adopting new tools like SIM farms for voice spoofing, making such police action both timely and necessary.
8 months ago
Kill Chain
ColdRiver Malware Surge: 2024 Espionage Attack Analysis
In early 2024, the Russia-linked threat group ColdRiver launched a fresh cyber espionage campaign targeting Western government entities, research institutions, and non-governmental organizations. Exploiting spear-phishing emails laden with custom-designed malware, the attackers accessed sensitive emails and files by leveraging well-crafted lures and technical evasion methods. The operation showcased ColdRiver’s rapid adaptation: when prior campaign tactics were exposed, the group swiftly pivoted to deploy new malware strains and infrastructure, signifying a high level of technical agility. The impact included unauthorized data access, intelligence gathering, and operational disruptions for targeted organizations. This incident stands out due to its demonstration of how quickly sophisticated espionage actors can update their tactics in response to detection. With global instability rising and state-aligned groups escalating campaigns, the rapid agility in threat activity puts extra pressure on organizations to strengthen detection and incident response protocols.
8 months ago
Kill Chain
'PassiveNeuron' SQL Server Attacks Expose Global Sectors to Espionage
In early 2024, a cyber-espionage campaign attributed to the 'PassiveNeuron' threat group targeted organizations in government, industrial, and financial sectors across Asia, Africa, and Latin America. Attackers exploited vulnerable SQL servers as entry points, deploying custom malware to stealthily exfiltrate sensitive data and facilitate lateral movement within compromised environments. The adversaries demonstrated a high degree of operational security, leveraging encrypted channels and bespoke tooling to evade conventional detection, resulting in significant data exposure and operational disruptions for affected entities. This incident reflects the increasing sophistication of cyber-espionage actors leveraging less-monitored databases and novel malware. It highlights a shift toward stealthy, persistent attacks against critical sectors—signaling the need for robust internal monitoring, segmentation, and east-west traffic controls to counter evolving threats.
8 months ago
Kill Chain
MuddyWater Hits Middle East Governments: Phishing, Phoenix Backdoor & VPN Abuse
In early 2024, the Iranian state-sponsored group MuddyWater orchestrated a large-scale spear-phishing campaign targeting over 100 government entities across the Middle East and Africa. Attackers leveraged a compromised mailbox and NordVPN to distribute phishing emails enticing recipients to enable malicious macros. This led to the deployment of the Phoenix backdoor, providing attackers with persistent access and the ability to move laterally within targeted organizations’ networks, thereby raising concerns over significant data exposure and long-term espionage. The MuddyWater incident exemplifies the growing sophistication and scale of nation-state phishing campaigns. Recent trends show attackers are rapidly adapting credential theft and post-exploitation tactics to bypass traditional defenses. Government entities face mounting regulatory and operational pressure to address advanced persistent threats exploiting email and remote access.
8 months ago
Kill Chain
Blue Angel Suite Faces 2024 Webctrl.cgi OS Command Injection Attempts
In October 2024, threat actors attempted to exploit an OS command injection vulnerability targeting the Blue Angel Software Suite's web interface on embedded Linux devices. Attackers issued crafted POST requests to the '/cgi-bin/webctrl.cgi' endpoint, aiming to inject arbitrary shell commands via the 'ipaddress' parameter. These attacks, detected by honeypots, mirror previous vulnerabilities such as CVE-2025-34033, which allows authenticated attackers to execute code as root by manipulating input passed to system commands like 'ping'. The incidents highlight persistent risks across IoT and broadband equipment, potentially providing attackers with full system control. This incident underscores a growing trend in targeting network appliances and IoT infrastructure for initial access and lateral movement. As regulatory attention increases and attackers shift toward exploiting device misconfigurations and weak input validation, robust segmentation and up-to-date patch management are even more critical.
8 months ago
Kill Chain
Scattered LAPSUS$ Hunters Target Encrypted Traffic in 2024 Hybrid Cloud Breach
In early 2024, the cybercrime group Scattered LAPSUS$ Hunters was observed launching a series of attacks targeting high-performance encrypted traffic between enterprise environments. Leveraging advanced tactics such as packet sniffing and lateral movement across hybrid and multicloud networks, the group exploited weak internal segmentation and gaps in east-west traffic controls. The attackers circumvented some organizations’ use of line-rate encryption by targeting less-protected internal flows and using sophisticated threat detection evasion techniques. Operational impacts included service disruptions, potential data exfiltration, and compromised cloud environments. This incident underscores the evolution of cybercrime actors as they adopt more advanced methods to breach environments assumed to be protected by conventional encryption or traditional network segmentation. The trend highlights growing risks for enterprises relying on hybrid and multicloud infrastructure, and illustrates the urgent need for zero trust approaches and enhanced east-west traffic security.
8 months ago
Kill Chain
Jingle Thief: A 2024 Look at Cloud Gift Card Fraud in Retail
In early 2024, security researchers uncovered "Jingle Thief," a sophisticated cybercriminal campaign targeting major retail organizations through coordinated phishing and smishing attacks. The attackers leveraged credential harvesting to gain unauthorized, persistent access to enterprise cloud environments and exploited multicloud weaknesses to orchestrate large-scale, automated gift card fraud. This activity resulted in the theft of significant monetary value from targeted retailers and demonstrated the evolving tactics of financially motivated threat groups seeking to exploit cloud infrastructure and weak east-west security controls. Jingle Thief underscores an alarming trend: attackers increasingly exploit cloud misconfigurations and multifactor authentication gaps to maintain post-compromise access for extended periods. The campaign exemplifies the need for enterprises to adopt Zero Trust strategies and rigorous east-west segmentation as criminals shift focus toward cloud-native targets.
8 months ago
Kill Chain
Remote Code Execution Flaw in Abandoned Rust Library Exposes Global Supply Chain
In August 2024, Edera researchers discovered CVE-2025-62518, a high-severity remote code execution vulnerability in the abandoned async-tar library for the Rust programming language. This logic flaw, named "TARmageddon," was unwittingly propagated to millions of users through downstream forks like tokio-tar and widely used build tools such as uv and testcontainers. The systemic risk arises because the vulnerability was replicated across a deep lineage of forks, making it very difficult to detect and patch comprehensively. Exploitation allows attackers to achieve remote code execution by overwriting files via malicious tar archives—a threat amplified by the lack of direct visibility into indirect dependencies in modern supply chains. The incident is especially impactful as it highlights the persistent risks of open-source abandonware and insufficient maintenance of foundational software libraries. It underscores growing industry focus on supply-chain security, indirect dependency management, and the need for rapid, coordinated vulnerability disclosure and remediation.
8 months ago
Kill Chain
Stealit Malware Abuses Node.js SEA in 2025 Infostealer Supply Chain Campaign
In October 2025, cybersecurity experts uncovered an active malware campaign involving Stealit, an advanced infostealer that exploits Node.js' Single Executable Application (SEA) feature to deliver its malicious payloads. The campaign also utilized the Electron framework and disguised its distribution through popular but trojanized game and VPN installers. Once executed, Stealit exfiltrated sensitive data from victims—such as credentials, browser information, and cryptocurrency wallets—using stealthy techniques while evading detection. The attack led to significant risks of account compromise and potential financial loss, particularly for organizations relying on affected software supply chains. This incident highlights a broader trend of attackers weaponizing modern development frameworks (like Node.js and Electron) to bypass traditional endpoint defenses. The use of legitimate-looking installers and supply chain manipulation signal an evolution in infostealer delivery tactics, making vigilance and advanced network segmentation crucial for organizational resilience.
8 months ago
Kill Chain
Velociraptor Misused: LockBit Ransomware & Storm-2603 Weaponize DFIR Tools in 2025 Attacks
In October 2025, cybersecurity researchers uncovered that threat actors associated with Storm-2603 (also known as Gold Salem or CL-CRI-1040) leveraged Velociraptor, a legitimate open-source digital forensics and incident response (DFIR) tool, to facilitate a series of LockBit ransomware attacks. Adversaries exploited Velociraptor’s capabilities to gather intelligence and move laterally within target environments, evading detection by blending in with regular security operations. The attacks led to significant data encryption events and operational disruptions, primarily impacting organizations with insufficient internal security segmentation and monitoring. This incident marks a significant evolution in attacker tradecraft, as it demonstrates that widely trusted security tools—often present for defensive use—can be repurposed as offensive weapons. Increased regulatory scrutiny and the recurrent rise of double extortion ransomware attacks highlight the urgent need for organizations to monitor tool usage and improve east-west visibility.
8 months ago
Kill Chain
SonicWall VPN Breach 2025: Over 100 Customer Accounts Compromised via Stolen Credentials
In October 2025, a widespread compromise targeted SonicWall SSL VPN devices, enabling attackers to gain unauthorized access to at least 100 customer accounts across various organizations. Security firm Huntress noted that threat actors rapidly authenticated using valid credentials on multiple devices, suggesting credential theft or data leaks rather than brute-force attacks. Attackers leveraged VPN access to infiltrate corporate environments, enabling lateral movement and potentially exfiltrating sensitive data. This campaign demonstrates the heightened risk posed by stolen credentials, especially when VPN infrastructure is directly exposed to the internet. This incident is highly relevant as credential-focused attacks and VPN compromises continue to surge, exploiting weaknesses in remote access systems. The event underscores the urgent need for zero trust strategies and stronger authentication measures to defend against evolved attacker tactics targeting perimeter defenses.
8 months ago
Kill Chain
Oracle E-Business Suite Hit by Critical Unauthenticated Data Exposure Vulnerability
In October 2025, Oracle disclosed a high-severity vulnerability (CVE-2025-61884) affecting E-Business Suite versions 12.2.3 through 12.2.14. This flaw allows unauthenticated attackers to access sensitive data without login, leveraging a network-exploitable bug rated CVSS 7.5. Organizations running impacted Oracle EBS versions are at risk of data compromise, business disruption, and regulatory exposure if left unpatched. Oracle issued a security alert and urgent patch to address the issue as exploitation attempts in the wild are anticipated. This disclosure underscores the growing trend of unauthenticated, remote data access flaws targeting ERP platforms. Critical business applications present attractive targets for threat actors, especially as organizations expand interconnectivity. Prompt detection and segmentation of east-west traffic remain essential as ERP vulnerabilities increasingly underpin large-scale, compliance-relevant breaches.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
