Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5641 to 5652 of 5924
SSL.com Certificate Abuse: Iranian APTs Sign Malware with Trusted Keys in 2024
In early 2024, multiple Iranian state-linked threat groups, including the Charming Kitten offshoot Subtle Snail, leveraged code-signing certificates issued by Houston-based SSL.com to digitally sign malware campaigns targeting organizations worldwide. Researchers discovered that the threat actors abused trusted certificates to bypass security controls and distribute malicious payloads, with their primary focus on espionage and data exfiltration. This compromised trust in legitimate software distribution channels and posed significant detection challenges for defenders, underscoring the evolving sophistication of APT campaigns tied to Iran. The incident highlights an uptick in supply chain and abuse-of-trust techniques among state-sponsored groups. Attackers are increasingly capitalizing on trusted processes—such as code signing—to slip past endpoint protection platforms, raising the regulatory and operational urgency for organizations dependent on digital certificate trust.
8 months ago
Kill Chain
COLDRIVER’s 2025 ClickFix Malware Campaign: Modular APT Tactics Evolve
In September 2025, the Russian APT group COLDRIVER launched a multi-stage cyber campaign using newly identified malicious tools, BAITSWITCH and SIMPLEFIX, delivered through ClickFix-style phishing attacks. Zscaler ThreatLabz observed that COLDRIVER targeted Russian-speaking entities with sophisticated social engineering and credential phishing tactics, ultimately compromising victims by deploying lightweight downloaders that enable remote access and further malware deployment. Impacted organizations faced stealthed data exfiltration risks and the threat actor's evolving persistence mechanisms, signifying a leap in their operational security evasion. This incident reflects an accelerating trend of APT actors developing nimble, modular malware to bypass traditional defenses and exploit collaboration platforms. Continued adaptation in attacker tradecraft underscores the growing urgency for zero trust controls, east-west visibility, and anomaly detection across hybrid environments.
8 months ago
Kill Chain
Targeted SVG Phishing Hits Ukrainian Agencies with CountLoader, PureRAT
In September 2025, cybersecurity researchers uncovered a targeted phishing campaign impersonating Ukrainian government agencies. Attackers distributed emails containing malicious SVG file attachments, crafted to deliver the CountLoader malware. Upon execution, CountLoader dropped secondary payloads—Amatera Stealer and PureMiner—allowing cybercriminals to steal sensitive information and deploy cryptomining operations on victim systems. The attacks leveraged sophisticated social engineering and file formats to evade detection, threatening both public sector and affiliated organizations. This incident highlights a surge in phishing operations leveraging advanced loaders and novel file types, such as SVG. As more attackers exploit government-themed lures and multi-tool chains, organizations face an elevated risk of data exfiltration, credential theft, and operational disruption, demanding robust, adaptive security controls.
8 months ago
Kill Chain
Salesforce Agentforce 2024: ForcedLeak AI Prompt Injection Breach Exposes CRM Data
In June 2024, researchers at Noma Security identified a severe vulnerability in Salesforce's Agentforce AI agents, termed 'ForcedLeak'. By exploiting prompt injection via web-to-lead forms, attackers were able to manipulate Agentforce into exfiltrating sensitive CRM data, including PII, corporate secrets, and transactional details, to unauthorized locations. The vulnerability hinged on whitelist misconfigurations of trusted domains and the agent’s overly broad prompt interpretation, leading to an attacker-controlled data leak chain. Salesforce addressed data exfiltration by patching URL restrictions and acquiring an expired trusted domain but ongoing risks persist with agentic AI’s prompt processing logic. The incident underscores the growing challenges as mainstream SaaS platforms rapidly integrate autonomous GenAI features, often lacking robust input validation and security boundaries. High CVSS-scored issues like ForcedLeak exemplify the urgent need for zero trust guardrails and more resilient AI security frameworks given the increasing velocity and sophistication of prompt injection attacks.
8 months ago
Kill Chain
Nation-State Attackers Exploit Cisco Zero-Day Bugs in 2024: What You Need to Know
In early 2024, Cisco disclosed four actively exploited zero-day vulnerabilities impacting its firewalls and IOS software, affecting millions of devices globally. At least three of these flaws were exploited by a sophisticated nation-state threat actor behind the ArcaneDoor campaign. Attackers leveraged the zero-days to gain unauthorized access to networks, facilitating lateral movement, data interception, and potentially persistent backdoors in affected systems. The campaign specifically targeted high-value government and critical infrastructure entities, prompting urgent patching initiatives. This incident underscores a growing trend of state-backed actors aggressively targeting network infrastructure with zero-day exploits. As attackers focus on networking gear as an entry point, organizations must reevaluate perimeter defenses and accelerate patch management to remain resilient against such advanced threats.
8 months ago
Kill Chain
Brickstorm Backdoor: UNC5221’s Stealthy Edge Device Supply Chain Attack (2024)
In a sophisticated cyber-espionage campaign uncovered in 2024, the China-linked group UNC5221 systematically compromised edge network appliances—such as firewalls, VPNs, and virtualization hosts—unable to run traditional EDR agents. By deploying a newly evolved backdoor known as 'Brickstorm,' the attackers gained highly persistent, stealthy access to organizations in technology, legal, SaaS, and outsourcing sectors. The malware, enhanced with delayed activation and strong obfuscation, leveraged unique command-and-control domains per victim and often exploited both zero-day and publicly known vulnerabilities. High-value credential harvesting and lateral movement to strategic systems, such as VMware vCenter, enabled the threat actor to maintain undetected access for an average of 393 days, facilitating both data theft and potential downstream customer compromise. This incident highlights the evolving risk posed by state-sponsored actors targeting blind spots in infrastructure—especially unmanaged or agentless edge devices critical to supply chains and cloud access. With ongoing innovation in stealth tactics and platform abuse, the Brickstorm campaign marks a serious escalation in the complexity and duration of modern supply chain threats.
8 months ago
Kill Chain
2024 DOGE Insider Threat: Massive Data Privacy Risk at U.S. Agencies
In June 2024, the Department of Government Efficiency (DOGE), created by Elon Musk, was found to be operating outside federal law, compromising cybersecurity and privacy protocols at three major U.S. agencies: the General Services Administration (GSA), Office of Personnel Management (OPM), and Social Security Administration (SSA). According to a Senate Homeland Security and Governmental Affairs Committee report, DOGE staffers allegedly uploaded sensitive personal data—such as the SSA's Numident database—into inadequately protected environments. This exposed millions of Americans to potential identity theft and data misuse, circumventing standard cybersecurity and regulatory controls by leveraging unauthorized cloud resources and private satellite networks, notably Starlink, to evade agency oversight. The incident underscores an urgent shift in the threat landscape, whereby insider threats and shadow IT initiatives create unprecedented systemic risk within critical public sector organizations. Amid regulatory scrutiny, this breach highlights the critical need for robust monitoring, segmentation, and compliance enforcement against complex, evolving insider vulnerabilities.
8 months ago
Kill Chain
Nation-State Zero-Day Attacks Breach Cisco Firewalls in 2024
In mid-2024, an advanced nation-state threat group—tracked as UAT4356 (Talos) and Storm-1849 (Microsoft)—launched a widespread espionage campaign exploiting newly discovered zero-day vulnerabilities (CVE-2025-20333 and CVE-2025-20362) in Cisco Adaptive Security Appliance (ASA) firewalls. These attackers gained persistent, full-device control by chaining zero-days, disabling logging, evading defenses, and implanting custom malware on federal networks, achieving potential data exfiltration and establishing long-term persistence beyond standard remediation steps. The Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive mandating immediate federal agency response, including mandatory patching or device disconnection. This attack underscores the evolving sophistication and urgency of supply chain and perimeter device threats. As zero-day exploitation targeting network infrastructure escalates and aligns with global power competition, organizations must prioritize detection, segmented defense, and rapid vulnerability management to safeguard high-value assets and comply with emerging federal cyber mandates.
8 months ago
Kill Chain
Cisco Zero-Day Exploitation: Federal Agencies Targeted in Prolonged Nation-State Attack
In 2024, a series of sophisticated attacks leveraging zero-day vulnerabilities in Cisco firewalls targeted U.S. federal agencies and critical infrastructure. Initial reconnaissance began in November 2023, with attackers exploiting unknown flaws at the network edge to gain persistent, low-profile access—including read-only memory modifications. The breach remained undetected for months as Cisco and federal authorities investigated, coordinated patches, and ultimately prompted an emergency CISA directive. Despite working closely with vendors on remediation, the scope required urgent government intervention, with potential exposure impacting hundreds of Cisco firewalls across key sectors. These attacks underscore growing nation-state interest in exploiting core network devices for stealthy espionage. With similar tactics on the rise, the breach brings renewed urgency for rapid threat detection, zero-trust policy enforcement, and timely vulnerability disclosures across government and industry.
8 months ago
Kill Chain
Forta GoAnywhere 2025: Zero-Day Supply Chain Breach Raises Compliance Alarms
In September 2025, Forta's GoAnywhere MFT file-transfer service was found to contain a critical deserialization vulnerability (CVE-2025-10035) which could enable attackers to execute arbitrary code remotely. Although Forta initially stopped short of confirming exploitation, credible evidence from threat researchers surfaced showing active in-the-wild attacks dating back to at least September 10. The exploit relies on the attacker’s ability to sign Java objects with a stolen or leaked private key, raising concerns over supply chain security and key management. Enterprises using GoAnywhere MFT face risks of data exfiltration and operational disruption. The incident highlights ongoing challenges in vendor transparency and the risks associated with critical third-party software. It underscores the urgent need for enhanced monitoring, timely vendor disclosures, strict key management, and robust segmentation strategies, as similar exploitation patterns have escalated across the supply chain attack landscape.
8 months ago
Kill Chain
Teen Hacker, Scattered Spider, and the 2023 Vegas Casino Ransomware Crisis
In late summer and early fall 2023, Las Vegas casinos MGM Resorts and Caesars Entertainment suffered major cyberattacks conducted by the Scattered Spider threat group, including at least one 17-year-old suspect. Attackers gained network access via social engineering and lateral movement, ultimately deploying BlackCat/ALPHV ransomware. The incidents led to severe operational disruption, significant financial losses exceeding $100 million for MGM, a $15 million ransom paid by Caesars, and exposure of sensitive customer and employee data. Law enforcement identified and apprehended one teenage perpetrator, who was later released to parental custody pending trial. This high-profile case highlights the growing trend of sophisticated, identity-driven ransomware attacks launched by younger, tech-savvy threat actors and hacking collectives. It underscores the urgent need for organizations to close internal security gaps, improve zero trust posture, and address the challenges of compliance amid increasingly aggressive and disruptive ransomware campaigns.
8 months ago
Kill Chain
Malicious Rust Crates on Crates.io Compromise Developer Crypto Wallets in 2025
In September 2025, security researchers uncovered two malicious Rust packages, 'faster_log' and 'async_println', uploaded to the official Crates.io repository. These packages, downloaded nearly 8,500 times, masqueraded as legitimate logging libraries but secretly scanned developers' machines for cryptocurrency wallet private keys and other sensitive secrets. The attackers used cloned documentation and authentic functionality to evade suspicion, while an embedded payload exfiltrated discovered secrets to a hardcoded Cloudflare Worker endpoint controlled by the threat actors. Upon discovery, Crates.io removed the packages and banned the associated users, mitigating the immediate threat. This incident demonstrates the persistent risk posed by supply chain attacks targeting open-source repositories and the increasing focus of cybercriminals on cryptocurrency theft. It underscores the need for rigorous vetting, enhanced code scanning, and heightened awareness among developers regarding open-source dependencies.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
