Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5497 to 5508 of 5924
RedNovember: Chinese State-Sponsored Espionage Campaign Hits Global Defense and Tech Sectors
Between June 2024 and July 2025, the Chinese state-sponsored threat group RedNovember (overlapping with Storm-2077 and formerly tagged as TAG-100) orchestrated a far-reaching cyber-espionage campaign targeting government, defense, and technology organizations globally. Leveraging weaponized perimeter device exploits and open-source tools like Pantegana and Cobalt Strike, the group gained initial access via widely used firewalls and VPNs, including SonicWall, Fortinet, Palo Alto, and Ivanti Connect Secure. Victims included ministries, intergovernmental bodies, US defense contractors, European manufacturers, and space organizations. The campaign’s impact highlights persistent perimeter vulnerabilities and demonstrated operational scale and stealth through commodity tooling and strategic timing near geopolitical events. This incident underscores the shift toward exploiting edge devices and open-source frameworks for stealth, scalable compromise by advanced actors. The trend signals urgent challenges for organizations relying on perimeter appliances and highlights the need to strengthen monitoring, zero trust segmentation, and compliance-driven security controls across hybrid and multicloud environments.
8 months ago
Kill Chain
npm Package Supply Chain Compromise: 2023’s Maintainer Phishing Attacks
In mid-2023, a significant wave of supply chain attacks targeted the npm JavaScript ecosystem, compromising maintainer accounts through highly sophisticated phishing campaigns and credential theft. Adversaries delivered convincing emails impersonating npmjs.org, tricking developers into revealing login credentials and two-factor authentication secrets. Stolen publishing tokens and, in some cases, hijacked email domains enabled attackers to inject malicious code into popular packages such as 'prettier', 'chalk', and 'debug'. This resulted in malware propagation to thousands of downstream applications, facilitating widespread credential theft, cryptocurrency manipulation, and exfiltration risks within user environments. Organizations and end users faced significant exposure due to the trust placed on these foundational open-source dependencies. The incident remains highly relevant as npm and the broader open-source software community continue to see an uptick in targeted supply chain attacks. Threat actors are evolving their techniques, leveraging both technical exploits and sophisticated social engineering, raising the urgency for robust package vetting, stronger identity controls, and supply chain transparency.
8 months ago
Kill Chain
Double Agents: The 2024 Exploitation of AI Agent Mode in Commercial Platforms
In March 2024, security researchers revealed how threat actors exploited 'agent mode' in commercial AI products to conduct AI-in-the-middle (AIitM) attacks. By abusing the emerging capability that allows AI assistants to autonomously perform actions, adversaries were able to impersonate users or escalate privileges by intercepting and manipulating commands. This allowed attackers to facilitate lateral movement, data exfiltration, and policy circumvention within enterprise environments, often leaving minimal forensic traces. The incident highlighted how the wider adoption of agentic AI features substantially expands the potential threat surface for organizations. This breach has rapidly gained industry attention amid a surge in advanced AI-driven attacks and a wave of regulatory scrutiny on AI operational security. As enterprises accelerate their deployment of commercial AI tools, understanding the novel risks introduced by agentic AI is now critical for leadership and security teams.
8 months ago
Kill Chain
NPM Supply Chain: Shai-Hulud Attack Compromises 700+ Packages
In September 2024, researchers identified a large-scale supply chain attack leveraging malicious NPM packages weaponized with the "Shai-Hulud" malware. Attackers trojanized over 700 NPM packages—including popular and widely-used ones such as CrowdStrike's—compromising developer systems and creating persistent, unauthorized GitHub Actions workflows in code repositories. The attack targeted both Windows and Linux environments, harvesting developer credentials, CI/CD tokens, and secrets, then exfiltrating the data via webhooks to attacker-controlled servers. The worm-like propagation enabled ongoing data theft and espionage, raising substantial risks for any organization dependent on NPM or continuous integration workflows. This incident underscores growing risks in software supply chains, as modern attacks increasingly target developer tools and automation infrastructure. Self-propagating, persistent attacks such as Shai-Hulud highlight the need for stronger code provenance controls, real-time threat detection, and updated development pipeline security to counter evolving adversary tactics.
8 months ago
Kill Chain
King KongTuke Breach Unmasks East-West Security Gaps in Multi-Cloud Era
In September 2025, a sophisticated breach attributed to the threat group 'King KongTuke' targeted several enterprises operating in multi-cloud environments. Attackers exploited weaknesses in east-west traffic controls and bypassed improper network segmentation by leveraging encrypted, paste-and-run lures to establish covert lateral movement between cloud workloads. Once inside, the group utilized remote access tools and encrypted tunnels to exfiltrate sensitive data at scale, evading traditional threat detection and impairing business operations across industries including fintech and healthcare. The incident revealed extensive compliance risks and forced urgent remediation of cloud and hybrid network configurations. This breach highlights a growing trend of threat actors exploiting hybrid and multicloud blind spots. The event has triggered renewed urgency on east-west visibility, zero trust controls, and AI-enabled anomaly detection. Regulatory attention is increasing on enforcing segmentation, encryption in transit, and cloud-native policy enforcement at scale.
8 months ago
Kill Chain
Phishing and RMM Tool Abuse Drive Multi-Vector Attacks – September 2025 Wrap-Up
In September 2025, organizations faced a surge of multi-vector cyber campaigns targeting enterprises through sophisticated phishing attacks and compromised WordPress sites. Attackers used phishing emails as entry points, tricking employees into installing remote monitoring and management (RMM) tools such as AnyDesk and Atera, thereby gaining unauthorized access to internal networks. Simultaneously, threat actors leveraged vulnerable or hijacked WordPress websites to distribute malware payloads, facilitating both initial compromise and lateral movement across organizations' internal networks. The impact included credential theft, unauthorized remote control, and data exfiltration, as well as disruption to normal business activities. This incident highlights a rapidly evolving threat landscape where attackers combine social engineering, legitimate RMM tools, and supply-chain exploits to evade traditional security defenses. It underscores increased regulatory attention on monitoring east-west traffic, policy enforcement, and anomaly detection across hybrid cloud environments.
8 months ago
Kill Chain
DraftKings 2025 Credential Stuffing Breach: Lessons in Password Security
In October 2025, DraftKings, a prominent sports betting company, disclosed that less than 30 customer accounts were compromised via credential stuffing attacks. Threat actors utilized previously stolen username and password combinations from breaches of unrelated services, leveraging automated tools to gain unauthorized access to DraftKings user accounts. While the attackers obtained personal data such as names, addresses, dates of birth, contact details, and the last four digits of payment cards, there was no evidence of access to sensitive government-issued IDs or full financial account numbers. DraftKings responded swiftly by notifying affected users, requiring password resets, and recommending the use of multifactor authentication to mitigate further risk. This incident highlights the persistent threat of credential stuffing—an attack vector that exploits widespread password reuse. With large troves of leaked credentials available and automated attack tools on the rise, organizations across industries face increasing regulatory pressure to implement layered authentication and robust account monitoring to defend against identity-driven threats.
8 months ago
Kill Chain
Google Gemini Hit by Unfixed ASCII Smuggling AI Attack in 2025
In October 2025, a newly disclosed ASCII smuggling attack targeting Google’s Gemini AI assistant exposed a significant security vulnerability stemming from the model's processing of hidden Unicode payloads. Security researcher Viktor Markopoulos demonstrated that attackers could leverage invisible Unicode characters in Calendar invites or emails, prompting Gemini to execute unseen instructions and alter its behavior without user awareness. Notably, the exploit could automate data extraction or spoof identities within Google Workspace integrations, increasing risk for both users and enterprises. Despite the demonstrated risks, Google chose not to address the vulnerability, citing its overlap with social engineering tactics. This incident underscores the heightened threat posed by AI/ML attacks against widely integrated platforms. As LLMs increasingly automate workflows and access sensitive data, adversarial prompt manipulation and Unicode character abuse are becoming urgent areas for organizational security reviews and regulatory scrutiny.
8 months ago
Kill Chain
Salesforce 2025 Supply Chain Data Breach: An Executive Overview
In 2025, Salesforce and hundreds of its customers were targeted in two coordinated data theft campaigns by the threat group "Scattered Lapsus$ Hunters," leveraging both social engineering and stolen OAuth tokens. Attackers tricked employees into connecting malicious OAuth applications or exploited compromised Salesloft Drift tokens, gaining unauthorized access to sensitive CRM data, support tickets, credentials, and authentication tokens. The attackers subsequently attempted to extort 39 major organizations, threatening to leak up to 1.5 billion records via a dark web leak site unless sizable ransom demands were met. Salesforce publicly refused to negotiate or pay any ransom, and law enforcement actions appeared to subsequently seize the extortion domain. This incident underscores the growing sophistication of supply-chain attacks using identity-based and OAuth token compromise, highlighting the rising risk to SaaS ecosystems. The event triggered significant concerns across industries that increasingly rely on interconnected third-party platforms and further emphasizes urgent gaps in SaaS security, zero trust application governing, and lateral movement prevention.
8 months ago
Kill Chain
Google Workspace 2025 OAuth Supply Chain Breach: Lessons From the Drift Incident
In August 2025, a supply chain attack targeted Google Workspace via compromised OAuth tokens associated with the Drift email integration, impacting several organizations. Attackers leveraged stolen Drift tokens to gain unauthorized, delegated access to connected Google Workspace mailboxes, bypassing traditional security controls by exploiting trusted third-party app grants. Google rapidly responded on August 9 by revoking the affected tokens and disabling the integration. While only a small number of mailboxes were directly accessed, the incident underscored how attackers increasingly exploit SaaS interconnections rather than direct platform breaches. This incident is particularly relevant today as exploitation of OAuth tokens and third-party integrations continues to climb, representing a paradigm shift in enterprise attack surfaces. It highlights the growing need for comprehensive SaaS integration visibility, rigorous token governance, and real-time behavioral monitoring as attackers increasingly favor these stealthy, scalable techniques.
8 months ago
Kill Chain
Ransomware Breach at London’s Kido Nursery: Child Data Leaked by Radiant Group
In September 2025, the Kido International nursery chain, operating in several countries and serving over 15,000 families, suffered a ransomware attack orchestrated by the Radiant Group. Attackers accessed sensitive data and photographs of more than 1,000 children, their families, and nursery employees. Some stolen data, including children's pictures and residential addresses, were leaked on a dark web site to pressure Kido into paying a ransom. When extortion attempts failed, the attackers removed the leaked files, but only after making threatening calls to parents, intensifying the distress of the incident. This event underscores the alarming targeting of childcare and educational institutions by cybercriminals, reflecting a broader trend of ransomware attacks exploiting organizations that handle sensitive personal data. The swift arrests by London police of suspects involved demonstrate growing law enforcement action, yet also highlight increased risks for sectors entrusted with children's safety and privacy.
8 months ago
Kill Chain
Hackers Exploit Auth Bypass in Service Finder WordPress Theme (CVE-2025-5947)
In the autumn of 2025, a critical authentication bypass vulnerability (CVE-2025-5947) was discovered and actively exploited in the Service Finder WordPress theme, affecting versions 6.0 and older. Attackers leveraged improper validation in the 'service_finder_switch_back()' function, allowing them to impersonate any user—including administrators—simply by sending HTTP requests with a crafted cookie or query parameter. The flaw enabled threat actors to gain full administrative control over thousands of websites, with over 13,800 exploitation attempts recorded by Wordfence since August 1. Attackers could then create or modify site content, add malicious code, or export sensitive data undetected, putting site owners and users at risk. This breach is particularly relevant as it illustrates the continued targeting of WordPress ecosystems with privilege escalation exploits, highlighting growing risks from vulnerable third-party themes and plugins. It underscores the urgency of rapid patching, improved logging, and continuous monitoring to defend against evolving web application threats.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
