Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5461 to 5472 of 5924
Massive Multi-Country Botnet Launches RDP Attacks Against US Organizations
In October 2025, a massive botnet composed of devices spanning over 100 countries launched coordinated attacks targeting Remote Desktop Protocol (RDP) services in the United States. Security researchers first spotted a spike in unusual RDP traffic originating from Brazil, with further malicious activity quickly spreading globally. Attackers leveraged two primary techniques: RD Web Access timing attacks to infer valid usernames, and RDP web client login enumeration to access accounts through analysis of server response behaviors. The campaign utilized over 100,000 unique IP addresses sharing a similar TCP fingerprint, indicating a highly organized cluster-based operation. The attacks put both government and enterprise systems at risk of brute-force intrusion and potential credential compromise. This incident underlines the persistent and evolving threat posed by botnets against remote access services. With increasing remote work reliance and exposed RDP endpoints, such sophisticated, multi-geography attacks exploit common authentication weaknesses and call for urgent upgrades in defense, including MFA and network segmentation.
8 months ago
Kill Chain
Microsoft 2025: Zero-Day Exploit Prompts Emergency IE Mode Restrictions
In October 2025, Microsoft announced urgent restrictions on Internet Explorer (IE) mode within the Edge browser following the discovery of active zero-day exploits targeting the Chakra JavaScript engine. Threat actors leveraged sophisticated social engineering tactics to lure users to spoofed sites, where a previously unknown vulnerability in Chakra enabled remote code execution. Attackers combined this with a privilege escalation flaw to escape the browser sandbox and seize complete device control. Microsoft responded by removing easy methods to activate IE mode in Edge for consumer users, instead requiring manual configuration limited to explicit, approved sites, and urged migration from legacy technologies. This incident underscores the persistent risks associated with maintaining legacy web compatibility features such as IE mode, especially as threat actors increasingly exploit these pathways with sophisticated chains of zero-day vulnerabilities and social engineering. It highlights heightened urgency for organizations to migrate from deprecated software and rigorously manage legacy access points.
8 months ago
Kill Chain
SimonMed Data Breach Exposes Over 1.2 Million Patient Records in 2024
In January 2024, SimonMed Imaging, a major U.S. provider of diagnostic medical imaging, disclosed a data breach impacting over 1.2 million patients. The incident involved unauthorized access to internal systems, which allowed attackers to exfiltrate sensitive health and personal information—including names, birthdates, contact information, health insurance and medical data. The breach was discovered during routine security monitoring, after which SimonMed implemented containment measures and engaged third-party forensics. Regulatory authorities and affected individuals were promptly notified, with the company offering support and identity protection services where relevant. This breach underscores the persistent targeting of healthcare organizations due to the high value of medical data, as well as regulatory scrutiny around the protection of patient information. It highlights the growing sophistication of data exfiltration tactics, emphasizing the critical need for robust east-west security controls, encrypted traffic, and rapid anomaly detection within healthcare IT environments.
8 months ago
Kill Chain
Spain Shuts Down GXC Team: Crime-as-a-Service Powerhouse Busted in 2025
In May 2025, Spanish authorities dismantled the "GXC Team" cybercrime syndicate, arresting its alleged leader, a 25-year-old Brazilian known as "GoogleXcoder." Operating as a Crime-as-a-Service (CaaS) provider, the group developed and sold AI-powered phishing kits, multiple Android malware strains, and social engineering voice-scam tools, primarily via Telegram and Russian-speaking hacker forums. Their phishing operations targeted financial, transport, and e-commerce institutions in Spain, Slovakia, the UK, the US, and Brazil, facilitating large-scale credential theft through more than 250 spoofed sites. Law enforcement recovered stolen cryptocurrency, seized electronic evidence, and shut down illicit channels. The investigation, enabled by forensic analysis of devices and crypto transactions, remains ongoing, with further arrests anticipated. This incident highlights the rise of CaaS platforms using automation, AI, and malware-as-a-service approaches to accelerate phishing and fraud at scale. The GXC Team case underscores the evolving sophistication and reach of these criminal ventures, which now target numerous sectors globally and leverage encrypted communications to obfuscate operations.
8 months ago
Kill Chain
Fake Inflation Refund Phishing Texts Target New Yorkers in 2025 Smishing Attack
In October 2025, a coordinated smishing campaign targeted New York State residents with fraudulent text messages purporting to be from the Department of Taxation and Finance. The attackers claimed recipients were eligible for an 'Inflation Refund' and directed them to a phishing site impersonating an official state portal, where victims were prompted to submit sensitive personal data—name, address, email, phone number, and Social Security Number—under the guise of processing their refund. This malicious operation seeks to steal identities and facilitate extensive financial fraud. Government officials swiftly issued warnings, clarifying that legitimate refunds required no action from residents and urging vigilance. This incident is a stark reminder of the increasing sophistication of SMS phishing (smishing) attacks, which blend timely government programs with social engineering techniques. The campaign highlights the persistent risk posed by identity-centric attacks, especially as digital fraudsters exploit widespread economic uncertainty and official-sounding initiatives.
8 months ago
Kill Chain
Qantas 2025 Data Breach: Scattered LAPSUS$ Defies Legal Barriers
In October 2025, Australian airline Qantas suffered a major data breach when threat actor group Scattered LAPSUS$ released sensitive customer and employee data following an extortion attempt. Despite Qantas obtaining a legal injunction aimed at stopping the dissemination of the information, the attackers proceeded to publish the stolen data, rendering legal intervention ineffective. The incident exposed personal records and travel information, spotlighting ongoing organizational vulnerabilities to data extortion and public leaks driven by sophisticated attackers exploiting access. The breach prompted widespread media coverage and concern over enforcement power in digital incidents. This attack underscores the growing trend of double extortion tactics, where attackers threaten to release stolen data for leverage, outpacing regulatory or legal controls. The event exemplifies the surge in ransomware and extortion methods targeting aviation and critical infrastructure, reinforcing the urgent need for proactive, technical mitigations and incident preparedness planning.
8 months ago
Kill Chain
Bling Libra’s 2024 Extortion: Lessons from a Modern Ransomware Attack
In early 2024, a cybercriminal alliance known as Bling Libra—aligned with the notorious Scattered Spider and Lapsus$—launched coordinated extortion campaigns targeting retail and hospitality organizations worldwide. Using a mixture of credential theft, social engineering, and advanced lateral movement, attackers bypassed security controls to gain privileged access to sensitive systems, disrupted operations, and exfiltrated confidential data. Victims faced steep ransom demands and public threats of data disclosure if payments were not met, resulting in loss of business continuity, reputational harm, and regulatory scrutiny. This incident highlights the mounting prevalence of extortion-based tactics that leverage both data theft and operational disruption. Organizations across multiple industries are now seeing an increase in sophisticated, multi-stage attacks fueled by agile, loosely affiliated threat actor groups determined to exploit gaps in cyber defenses.
8 months ago
Kill Chain
Russian ClayRat Android Spyware Masquerades as Popular Apps, Spreads Rapidly in 2024
In mid-2024, security researchers at Zimperium discovered ClayRat, a rapidly evolving Android spyware campaign targeting users in Russia. Disguised as trusted apps like TikTok and YouTube, ClayRat was spread via phishing websites and Telegram channels, infecting over 600 devices in just three months. Once installed, the spyware leverages Android’s SMS handler permissions to bypass typical security prompts, allowing attackers to covertly access messages, call logs, device information, and even remotely control infected phones. The highly orchestrated campaign abused social engineering, web deception, and obfuscation techniques to remain undetected, and can turn each compromised device into a new attack vector. The threat’s evolution signals rising global risks, as the campaign’s tactics can easily adapt to new payloads and regions. With increasing use of mobile malware, organizations globally should reassess mobile security controls and user awareness programs to defend against sophisticated, evasive spyware attacks exploiting trust in well-known apps.
8 months ago
Kill Chain
FBI Disrupts BreachForums Data Extortion Portal Tied to Salesforce Attacks
In October 2025, the FBI, in collaboration with French authorities, seized the BreachForums portal used by the ShinyHunters and associated groups as a data leak extortion site in the wake of major Salesforce data theft attacks. The cybercriminals, operating as Scattered Lapsus$ Hunters, leveraged the platform to pressure prominent organizations—including FedEx, Disney, Google, and others—by threatening to leak over a billion customer records unless ransom demands were met. While the clearnet site is now under law enforcement control, the attackers continue extortion efforts via their dark web presence, asserting that Salesforce campaign leaks will proceed for non-compliance. This incident underscores evolving methods of data extortion and the resilience of threat actors despite law enforcement crackdowns. It highlights the growing trend of targeting SaaS providers, the strategic use of underground forums for large-scale data extortion, and the ongoing cat-and-mouse dynamic between cybercriminals and authorities.
8 months ago
Kill Chain
Apple Bug Bounty Shatters Records: $2M Now Offered for Zero-Click RCE Vulnerabilities
In June 2024, Apple significantly enhanced its bug bounty program, now offering up to $2 million for zero-click Remote Code Execution (RCE) vulnerabilities — the highest payout in the industry to date. This expansion includes new research categories and a more transparent reward structure aimed at encouraging security researchers to responsibly disclose critical flaws, particularly those enabling attackers to compromise devices without user interaction. The move comes amid heightened concerns over sophisticated exploits, such as NSO Group’s Pegasus, which have targeted Apple’s platforms using zero-click attack chains that can bypass traditional security controls, threatening the confidentiality and security of end-users and enterprise data. The immediate relevance of Apple's program expansion is twofold: it recognizes the rapid evolution of threat actor capabilities and underscores the urgent need for robust vulnerability disclosure programs. As zero-click exploits gain momentum among both state actors and cybercriminals, organizations face increased regulatory and reputational risks from unpatched, high-impact vulnerabilities.
8 months ago
Kill Chain
Gladinet CentreStack & Triofox Zero-Day Leads to Chain Exploit and Remote Code Execution
In October 2025, threat actors exploited a zero-day vulnerability (CVE-2025-11371) in Gladinet’s CentreStack and Triofox file sharing solutions, used by thousands of businesses worldwide. The flaw, a local file inclusion (LFI) bug present in all current product versions, was leveraged to extract sensitive configuration data and trigger a previously known deserialization vulnerability (CVE-2025-30406), resulting in remote code execution (RCE). At least three organizations have confirmed exploitation as attackers gained unauthorized access before Gladinet issued a patch, forcing emergency mitigations that affected platform functionality. This incident highlights how chained vulnerabilities and rapid exploitation of zero-days continue to threaten cloud-based file sharing services. With attackers escalating LFI into full RCE, organizations face heightened pressure to improve visibility, patch agility, and enforce Zero Trust controls, especially amid growing regulatory scrutiny.
8 months ago
Kill Chain
Aisuru Botnet’s Record DDoS Assaults Expose IoT Weaknesses in US ISPs
In October 2025, the Aisuru botnet orchestrated the largest recorded distributed denial-of-service (DDoS) attacks to date, leveraging over 300,000 compromised IoT devices primarily hosted on major U.S. ISPs such as AT&T, Comcast, and Verizon. The botnet, evolved from Mirai code, exploited insecure or outdated IoT firmware, driving attack volumes to nearly 30 terabits per second. Recurrent DDoS waves severely disrupted online gaming infrastructure and collateral users, overwhelming both DDoS mitigation providers and ISPs, and causing service dropouts and customer impact across multiple networks. This incident exemplifies the rising scale and sophistication of IoT-based botnets and exposes urgent deficiencies in outbound DDoS filtering at the ISP level. The Aisuru event also highlights a growing threat trend: attackers using compromised consumer IoT to reinforce both DDoS infrastructure and residential proxy networks, broadening attacker capabilities and the attack surface for businesses and critical providers.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
