Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 5761 to 5772 of 5918
SystemBC Malware: How Infected VPS Systems Became a Global Proxy Highway (2025)
In September 2025, security researchers from Lumen Technology’s Black Lotus Labs uncovered a significant increase in the activity of the SystemBC proxy botnet, which compromised an average of 1,500 commercial virtual private servers (VPS) daily by exploiting unpatched and critically vulnerable systems. SystemBC enabled threat actors, including ransomware gangs and criminal proxy networks, to route malicious traffic through infected VPS infrastructures, obscuring command-and-control activity and facilitating large-scale cyberattacks, such as WordPress brute-forcing and malware distribution. Impacted servers often had dozens of security flaws, with infection lifespans exceeding a month and some systems exhibiting over 100 vulnerabilities. The prevalence of SystemBC underscores a growing shift away from traditional residential botnets toward high-bandwidth, stable VPS resources easily abused due to lax patching. The incident amplifies urgent concerns around lateral movement, proxy abuse, and the need for robust network segmentation and real-time anomaly detection as attackers leverage compromised enterprise-grade infrastructure for persistent threats.
8 months ago
Kill Chain
Scattered Spider Strikes: 2024 Ransomware Attack on Transport for London Exposes Critical Gaps
In August 2024, Transport for London (TfL), a critical national infrastructure operator in the UK, suffered a significant ransomware attack attributed to the 'Scattered Spider' cybercrime collective. Law enforcement arrested two UK-based teenagers, believed to be key members of the group, after evidence tied them to not just the TfL breach but also a string of attacks targeting US healthcare and federal systems. The ransomware event caused extensive disruption to TfL’s internal and online systems, delayed refund processing, and ultimately led to a breach of customer data, including names, contact details, and addresses. Financial losses for TfL ran into the millions. This incident highlights both the growing capability and brazenness of young, English-speaking cybercriminals, as well as the expanding impact of ransomware on critical infrastructure and global enterprises. The subsequent law enforcement operation illustrates the increased regulatory scrutiny and international cooperation aimed at dismantling hacker collectives operating ransomware and extortion campaigns.
8 months ago
Kill Chain
RaccoonO365: Microsoft & Cloudflare Take Down Major Phishing-as-a-Service Network in 2024
In July 2024, Microsoft, in collaboration with Cloudflare and law enforcement, disrupted the RaccoonO365 Phishing-as-a-Service (PhaaS) operation, which enabled cybercriminals to launch large-scale phishing campaigns mimicking Microsoft 365 and other trusted brands. The service, run by Storm-2246 and attributed to Joshua Ogundipe, offered subscription-based kits that automated credential-theft campaigns targeting over 2,300 US organizations and at least 20 healthcare entities. The takedown involved seizing 338 domains, mapping the attack infrastructure, and revealing financial flows in cryptocurrency, shutting down an operation responsible for stealing at least 5,000 sets of credentials from 94 countries. This incident underscores the industrialization of phishing through subscription-based platforms and highlights how low-skill attackers are being enabled at scale. As phishing-as-a-service proliferates and leverages brand impersonation, organizations face escalating risks of credential theft and downstream ransomware or malware attacks.
8 months ago
Kill Chain
Scattered Lapsus$ Hunters: Hacking Groups Go Dark, But Risks Remain
In early 2024, the notorious Scattered Spider and Lapsus$ cybercriminal groups announced they were disbanding and ending their hacking campaigns, raising hopes of a reprieve from their disruptive cyberattacks. However, security researchers observed ongoing activity linked to these groups, including continued phishing, extortion, and data theft campaigns, suggesting the announcements may have been a smokescreen aimed at evading law enforcement scrutiny. The groups are known for high-profile intrusions into enterprise and technology organizations, frequently exploiting identity-based attacks and lateral movement to access sensitive data and systems, resulting in operational disruptions and significant data breaches. This incident highlights the persistent threat posed by organized cybercriminal groups that leverage identity-centric attack vectors and sophisticated social engineering, underscoring the necessity for robust segmentation, effective threat detection, and advanced access controls on corporate networks. Amid evolving attacker tactics and regulatory demands, organizations must prioritize zero trust strategies to defend against similar threats.
8 months ago
Kill Chain
Microsoft's September 2025 Patch: Critical Azure & SMB Vulnerabilities Fixed
In September 2025, Microsoft released a critical security update addressing 80 vulnerabilities across its product suite, with particular focus on an SMB privilege escalation flaw and an Azure vulnerability rated CVSS 10.0. While eight of these vulnerabilities were classified as Critical and the rest as Important, none are reported to have been exploited in the wild at release. The patch release comes after public disclosures made some flaws widely known, elevating risk of exploitation. Microsoft urged organizations to immediately apply updates, highlighting the dangers posed by both privilege escalation and remote code execution vectors that could severely impact enterprise security. This incident underscores the continued rise in attacks targeting software supply chains and cloud platforms. With a surge in public disclosures and exploit tool availability, patch management has become both more challenging and more essential—particularly as attackers increasingly exploit unpatched vulnerabilities for lateral movement and privilege escalation.
8 months ago
Kill Chain
Google Chrome Zero-Day CVE-2025-10585: Exploit Puts Millions at Risk
In September 2025, Google addressed a critical security incident involving a zero-day vulnerability (CVE-2025-10585) within Chrome's V8 JavaScript and WebAssembly engine. This type confusion vulnerability was actively exploited in the wild, allowing attackers to execute arbitrary code in users’ browsers. The exploit’s ease of deployment and ability to bypass conventional browser defenses put millions of Chrome users at risk globally until Google released an urgent patch. The attack vector enabled threat actors to compromise targeted endpoints primarily through malicious web content. This incident highlights the ongoing proliferation and rapid exploitation of browser-based zero-days. Continuous advancements in attacker tactics—and their ability to weaponize browser vulnerabilities at scale—underscore the necessity for organizations to implement proactive patch management and behavioral threat detection aligned with zero trust strategies.
8 months ago
Kill Chain
SilentSync RAT Supply Chain Attack on PyPI Exposes Python Developer Ecosystem
In September 2025, cybersecurity researchers uncovered a sophisticated supply chain attack targeting Python developers through two malicious packages uploaded to the Python Package Index (PyPI) repository. These packages secretly deployed the SilentSync remote access trojan (RAT) onto Windows systems, enabling cybercriminals to execute remote commands, exfiltrate files, and capture screenshots from infected machines. The attackers leveraged trusted developer platforms to propagate their malware, increasing the risk of widespread compromise and posing a significant operational threat to organizations relying on open-source software dependencies. This incident highlights the ongoing risks associated with open-source ecosystems and third-party package repositories, which have become prime targets for threat actors. The escalation in supply chain attacks underscores the need for robust software supply chain security, vigilant dependency monitoring, and stronger policies governing the use of third-party code.
8 months ago
Kill Chain
SonicWall Cloud Backup Breach: Firewall Configurations Compromised, Credential Resets Urged
In September 2025, SonicWall disclosed a cloud security incident that exposed firewall configuration backup files tied to less than 5% of MySonicWall accounts, prompting a company-wide advisory to reset credentials for impacted users. The breach involved unauthorized access to backup firewall preference files hosted in SonicWall’s cloud backup service, which could potentially allow attackers insight into sensitive network policies and infrastructure details. Upon detection, SonicWall revoked affected credentials, reset authentication tokens, and notified regulatory authorities and end-users. The incident underscores operational risks associated with cloud-based configuration repositories and the downstream consequences for enterprise security posture. This breach highlights ongoing attacker focus on cloud storage services and device configuration files, which are increasingly targeted for initial access or lateral movement. As regulatory scrutiny grows and advanced threats seek out persistent footholds, organizations face mounting urgency to harden cloud storage, segment sensitive data, and enforce continuous credential hygiene.
8 months ago
Kill Chain
CountLoader: The Russian Ransomware Loader Redefining Post-Exploitation in 2025
In September 2025, cybersecurity researchers uncovered a major campaign involving CountLoader, a newly identified malware loader leveraged by Russian ransomware gangs. CountLoader has been deployed to infiltrate organizations by delivering post-exploitation tools such as Cobalt Strike, AdaptixC2, and the PureHVNC RAT via sophisticated phishing and initial access broker (IAB) operations. Notably, the loader is associated with affiliates of the LockBit ransomware group and is suspected to support both initial access sales and direct ransomware attacks. The campaign enabled attackers to establish stealthy persistence and remote control over compromised environments, amplifying threats of data theft, lateral movement, and disruptive encryption attacks. This incident highlights the growing adoption of multi-stage loader malware by established ransomware actors, blending traditional and cutting-edge post-exploitation tools for maximum impact. The tactics seen here illustrate the evolving, service-based ransomware ecosystem—one where payload delivery, access brokering, and command-and-control capabilities are modular and rapidly evolving in response to network defenses.
8 months ago
Kill Chain
NPM Phishing 2024: Developer Credentials Compromised by Sophisticated Email Lures
In September 2024, a targeted phishing campaign compromised multiple npm developer accounts by using convincing emails and deceptive landing pages such as "npmjs.help" and "npmjs.cam." Attackers exploited commonly overlooked weaknesses in email link validation and human trust, causing even experienced developers to disclose credentials. The attackers leveraged lookalike domains and effective social engineering, leading to account takeovers and enabling potential downstream attacks on open-source supply chains. The incident highlighted how traditional security awareness measures and multi-factor authentication (MFA) can be circumvented by advanced phishing tactics. This incident underscores the increasing effectiveness of credential compromise attacks in the software supply chain and the limitations of user training and legacy MFA solutions. As threat actors continue to innovate with sophisticated phishing techniques and pass-through attacks, businesses must urgently reconsider authentication strategies, emphasizing phishing-resistant technologies such as passkeys and cryptographic authenticators.
8 months ago
Kill Chain
Dshield Honeypot Exposes IoT Botnet Worm Using Default Credentials in 2024
In September 2024, analysis of a Dshield honeypot deployed on AWS revealed a campaign targeting internet-exposed systems with IoT-focused botnet malware. Attackers attempted to upload shell scripts and architecture-specific binaries using known default credentials and exploited weak or unchanged passwords, particularly on Raspberry Pi and IoT devices. The payloads, often delivered over unencrypted FTP and SSH methods, led to the installation of UNIX_PIMINE.A malware, which achieves persistence, removes competing malware, and connects to IRC-based command-and-control channels, highlighting an active botnet spreading via automated credential stuffing and remote file uploads. This incident underscores a persistent threat: legacy systems and embedded devices with default or weak credentials remain a prime target for botnets. With continued rises in IoT deployments and exposed services, automated malware propagation using basic scripts and known default logins is resurging, driving renewed regulatory scrutiny and best-practice emphasis for credential management and east-west traffic security.
8 months ago
Kill Chain
GhostRedirector Backdoors Windows Servers with Malicious IIS Modules
In early 2024, ESET researchers uncovered a sophisticated cyber campaign known as GhostRedirector targeting Windows servers worldwide. The attacker employed a passive C++ backdoor and a malicious Microsoft IIS module, granting remote control and enabling the manipulation of Google search results. By compromising internet-facing IIS web servers, the threat actor covertly redirected visitors to malicious domains while maintaining persistent access through undetected, stealthy backdoors. The attack had the potential to facilitate broad influence operations, data exfiltration, and further deployment of malware on compromised networks. This incident highlights the growing risk of advanced web server threats utilizing legitimate application modules for stealthy persistence. Such tactics reflect a wider trend of attackers exploiting trusted infrastructure and automated SEO poisoning, challenging organizations to strengthen threat detection, zero trust controls, and incident response.
8 months ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
