STRUCTURED THREAT INTELLIGENCE FOR THE CLOUD COMMUNITY

Aviatrix Threat Research Center

Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.

The Aviatrix Threat Research Center provides security teams with:

A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
What attackers exploited, and which enforcement gaps let them move.
Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.

Kill Chain Coverage

ATT&CK Mapped

Real-World IOCs

Threat ReportsLive Intelligence

Recent Breaches, Security Incidents & Vulnerabilities

A unified view of real-world cloud threats — combining AI-powered analysis, security research, and expert perspectives through a consistent, cloud-specific framework.

AI-Powered Threat Analysis

Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.

Browse by Industry

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Displaying 6649 to 6660 of 6710 threat reports

Financial Services9 months ago

Microsoft September 2025 Patch Tuesday: Spotlight on Network Privilege Escalation Flaws

On September 2025, Microsoft released security patches addressing over 80 vulnerabilities across Windows products, including 13 rated as 'critical.' Notably, CVE-2025-54918, a vulnerability in Windows NTLM authentication, allows attackers with network access and credential knowledge to elevate privileges to SYSTEM level remotely. Another disclosed vulnerability, CVE-2025-55234 in the SMB client, is also remotely exploitable and could result in code execution through replay attacks. Alongside these, the update addressed an NTFS remote code execution flaw (CVE-2025-54916) that, although not network-exploitable, poses significant risk via social engineering vectors. This Patch Tuesday illustrates a continued shift in attacker focus towards privilege escalation and lateral network movement within enterprise environments. Escalating regulatory scrutiny and rising advanced persistent threats reinforce the urgency of timely patching and integrated security controls for both external and east-west traffic.

Low impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(low)

Read report

Health Care / Life Sciences9 months ago

U.S. Indicts Ukrainian Ransomware Operator Behind Hundreds of Global Attacks

In June 2024, the U.S. Department of Justice indicted Volodymyr Tymoshchuk, a Ukrainian national linked to the development and deployment of the Nefilim, LockerGoga, and MegaCortex ransomware variants. Operating under aliases such as 'deadforz' and 'farnetwork,' Tymoshchuk and his co-conspirators targeted organizations—including healthcare, industrial, and blue-chip companies—across the U.S., Europe, and Australia from at least 2018 onward. Over 250 U.S. and hundreds of global victims experienced encrypted systems, data theft, and significant operational disruption, resulting in tens of millions of dollars in damages attributed to ransom payments, mitigation, and recovery costs. This indictment underscores increasing law enforcement cooperation and heightened government focus on disrupting ransomware-as-a-service ecosystems. The ongoing campaign and associated public rewards for information highlight how ransomware actors continue evolving tactics, targeting high-revenue organizations and leveraging affiliate networks to scale global extortion operations.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Computer Software/Engineering9 months ago

Meta's WhatsApp Security Lapses: Insider Risks and Lessons for Compliance in 2025

In April 2025, Meta (parent company of WhatsApp) faced legal action from a former security manager, Attaullah Baig, who alleged that systemic cybersecurity and privacy failures were ignored within WhatsApp. Baig claimed that a Red Team exercise revealed approximately 1,500 engineers had unrestricted access to sensitive user data, with no audit trails, logging, or adequate operational controls, violating regulatory requirements and a 2020 FTC consent order. Baig raised alarms about deficiencies—such as lack of data inventory, improper data access controls, and insufficient security staffing—which he asserts led to retaliatory actions and his eventual dismissal under the pretense of poor performance. This high-profile lawsuit underscores urgent concerns about insider risk, weak internal security policy enforcement, and regulatory noncompliance in large tech platforms. As regulators increase scrutiny and whistleblowers continue to come forward, enterprises must address internal blind spots and strengthen controls to prevent privilege misuse and data exposure.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(medium)

IImpact(high)

Read report

Financial Services9 months ago

Microsoft 2025 Zero-Day Patch Tuesday: SMB & SQL Server Vulnerabilities Fixed

In September 2025, Microsoft addressed 81 security flaws in its monthly Patch Tuesday, including two significant zero-day vulnerabilities—one impacting the Windows SMB Server (CVE-2025-55234) and another affecting Microsoft SQL Server through the Newtonsoft.Json library (CVE-2024-21907). The SMB Server flaw enabled attackers to perform relay attacks that could escalate user privileges, while the SQL Server vulnerability allowed unauthenticated remote attackers to trigger denial of service conditions. These flaws were publicly disclosed prior to the release and posed a heightened risk, as threat actors could exploit them before organizations applied the necessary patches. The broad spectrum of vulnerabilities underscores potential exposure across a wide range of Microsoft products and services. This incident exemplifies the urgent need for organizations to keep patch management processes rigorous and up-to-date. The increasing sophistication of attacker TTPs and the frequency of zero-day exploitation have positioned timely security updates as a frontline defense against data compromise and operational disruption.

Low impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(low)

EExfiltration(low)

IImpact(low)

Read report

Information Technology/IT9 months ago

Hackers Deploy Advanced Botnet Over Exposed Docker APIs via Tor (2025)

In September 2025, a sophisticated threat campaign was uncovered targeting exposed Docker APIs, where attackers leveraged the Tor network to obfuscate their activities and deploy a new, evolving botnet. The attackers used automated scanning to discover open Docker API endpoints (commonly on port 2375), then executed a multi-stage infection chain utilizing malicious containers. These payloads established persistent SSH access, blocked further exploitation by others, and launched additional tools for internal scanning, lateral movement, and covert communication. While earlier versions dropped cryptominers, the updated tooling focused on botnet expansion, user monitoring, and groundwork for additional attacks such as credential theft or DDoS. This incident exemplifies the rapid shift toward automation and stealth in cloud-native threats. Its relevance is underscored by the proliferation of misconfigured APIs and cloud workloads, combined with attackers’ increasing use of anonymizing networks (like Tor) and multi-vector attacks. Organizations with exposed or poorly secured container environments are urgently at risk.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services9 months ago

Ransomware's New Playbook: 2024 Sophisticated Extortion Hits Major Enterprises

In early 2024, a prominent enterprise fell victim to a highly sophisticated ransomware attack orchestrated by the notorious LockBit gang. Attackers gained entry through compromised credentials, swiftly encrypting critical systems and demanding a $30 million ransom within 72 hours, threatening public data exposure. The perpetrators leveraged professional, SaaS-style operations, exploiting sensitive internal documentation—such as financials and cyber insurance details—to tailor their extortion tactics. Business operations were severely disrupted as the company rushed to contain the breach, initiate crisis response procedures, and engage third-party negotiators. This incident underscores the growing maturity of ransomware groups, who now use advanced negotiation and psychological tactics alongside technical exploits. The increased reliance on credential theft and swift lateral movement, combined with extortion strategies targeting both IT infrastructure and organizational psychology, reflects a broader trend impacting all sectors.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Computer Software/Engineering9 months ago

Salesloft's GitHub Compromise Sparks 2024 Supply Chain Breach

In early 2024, Salesloft experienced a significant cybersecurity breach after attackers compromised a developer's GitHub account. By exploiting weak authentication protocols, threat actors were able to steal OAuth tokens, which enabled them to access and manipulate connected Salesforce instances of downstream customers, resulting in a widespread supply chain attack. The attackers leveraged their foothold to propagate malicious code and gain privileged access to hundreds of enterprise environments, exposing sensitive data and business operations across multiple organizations. This incident highlights the escalating risk presented by software supply chain attacks, particularly those exploiting code repositories and third-party integrations. It underscores the urgent need for organizations to implement strong access controls, enforce zero trust principles, and continuously monitor code and account activity in their development workflows.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Automotive9 months ago

Jaguar Land Rover Ransomware Breach Disrupts Global Operations in 2024

In June 2024, Jaguar Land Rover (JLR), the renowned luxury automotive manufacturer, experienced a major ransomware-related cyber incident that forced the company to shut down vital portions of its IT infrastructure. The disruption, which began on a Sunday and quickly affected production and retail activities globally, resulted in assembly line stoppages at key UK plants including Halewood and Solihull. JLR responded by disabling systems to prevent further attacker movement and data loss, launching an internal investigation with forensics partners to determine entry vectors, potential data exposure, and persistent threats. While the company stated there was no evidence of customer data being compromised, the operational and financial impacts were significant. This incident underscores the ongoing trend of ransomware actors targeting critical manufacturing and supply chain operations, where downtime can rapidly translate into massive losses. The event serves as a stark reminder that even mature organizations face evolving threats that can bypass traditional security controls, highlighting the urgent need for zero trust segmentation, enhanced network monitoring, and rapid anomaly detection.

High impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(high)

Read report

Telecommunications9 months ago

45 New Domains Fuel Salt Typhoon's Stealthy APT Campaign (2024)

In mid-2024, security researchers uncovered that the China-based Advanced Persistent Threat group Salt Typhoon (UNC4841) had deployed 45 new domains and previously undiscovered infrastructure to facilitate persistent, stealthy compromises of targeted organizations. Exploiting their advanced tradecraft, Salt Typhoon gained and maintained long-term access undetected, leveraging encrypted traffic and lateral movement techniques. The attacks primarily targeted sectors with sensitive data and critical infrastructure, amplifying operational and reputational risk for the victims. The campaign demonstrates ongoing actor adaptation and the challenges of detecting covert infrastructure expansion. This incident is especially relevant as organizations face a surge in nation-state actor activity leveraging novel infrastructure and sophisticated evasion methods. The discovery highlights the evolving threat landscape, where increased regulatory pressure and cloud adoption make comprehensive visibility and proactive response capabilities more critical than ever.

Low impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(low)

Read report

Computer Software/Engineering9 months ago

2025 NPM Supply Chain Breach: Phishing Attack on JavaScript Developer Risks Crypto Theft

In September 2025, a targeted supply chain attack compromised at least 18 widely used JavaScript packages on the NPM repository after a key developer, Josh Junon, was phished. The attackers created a convincing fake NPM login website, stealing both credentials and a one-time 2FA token to access the developer's account. They injected malicious code into popular packages, enabling browser-based interception of cryptocurrency transactions and redirection of funds to attacker-controlled wallets. The breach was discovered rapidly by Aikido, which alerted the maintainer, enabling a swift cleanup and limiting broader damage. This incident underscores the persistent risks lurking in open-source software supply chains, particularly as threat actors evolve their tactics to bypass conventional security controls using phishing and social engineering. The rapid containment averted a potentially devastating impact, but the episode highlights ongoing vulnerabilities in software ecosystems reliant on centralized package maintainers.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Government Administration9 months ago

Iran MOIS Targets Diplomatic Missions Worldwide in Sophisticated Phishing Campaign (2024)

Between August and September 2024, the Iranian state-affiliated APT group 'Homeland Justice,' linked to Iran’s Ministry of Intelligence (MOIS), orchestrated a sophisticated phishing campaign targeting over 50 embassies, government ministries, and international organizations across six continents. Attackers leveraged more than 100 hijacked, legitimate email accounts, using them to distribute infostealing malware concealed in macro-laden Word documents, often themed around timely geopolitical topics. These emails were sent via VPNs to obfuscate their true origin and bypassed basic email filtering due to the use of authentic sender addresses. This incident highlights the sustained threat posed by nation-state actors employing classic social engineering methods with modern evasion techniques. The resurgence of macro-enabled attacks and increasing abuse of compromised trusted accounts point to evolving risk vectors for governmental and international bodies, underscoring the need for continuous vigilance and upgraded detection capabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(low)

C&CCommand & Control(high)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services9 months ago

MostereRAT Malware: New Era of EDR Bypass and Persistent Threats

In 2024, security researchers uncovered a sophisticated campaign deploying the 'MostereRAT' malware against Windows environments. The threat actor used advanced techniques to deliver an EDR (Endpoint Detection and Response)-killing tool, enabling long-term, covert persistence on infected systems. MostereRAT blends into legitimate network traffic, leverages encrypted channels, and systematically disables or bypasses security controls, making detection and remediation difficult. Impacted organizations faced risks of data exfiltration, lateral movement, and significant business disruption, with attackers maintaining access for extended periods before discovery. This incident highlights the increasing prevalence of anti-EDR malware designed to counter modern defensive capabilities. As organizations adopt stronger endpoint security, attackers are deploying stealthier, more evasive malware, presenting ongoing challenges for incident detection, compliance, and cyber resilience.

Low impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(low)

IImpact(low)

Read report

1...553 554 555 556 557...560

Security Research & Insights

Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs

All Research Articles

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had

Matt Snyder

Oct 21, 202615 min read

Eight Certificates That Can Impersonate Anyone: The eMudhra Key Failure and Your Real Attack Surface

Matt Snyder

Oct 21, 202613 min read

Kubernetes RBAC is Not Enough

Harshvardhan Verma

Oct 12, 20268 min read

Market Perspectives

Market Perspectives offering expert commentary and select breach analysis from industry leaders

Read All Blogs

What Could Have Stopped the 2023 MGM Breach v4

Cloud Native Security Fabric

What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust

Cloud Network Security

John Qian

Jul 31, 20257 min read

Zero Trust

The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures

Scott Leatherman

Jul 23, 202512 min read

Cloud Network Security

HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data

Tom Davis

Jun 25, 20257 min read

How CNSF Protects Cloud Workloads

Cloud attackers don’t rely on a single exploit — they rely on paths.

Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.

Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.

With CNSF, enterprises can:

Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.

See Your Attack Paths. Close the Gaps with CNSF.

Blast radius starts where your enforcement stops.

Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.

The Executive Assistant That Broke the Company Why Shadow AI is the New Cloud Crisis card image

Your assessment delivers:

The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.

Explore the Workload Attack Path Assessment

Containment Era Intelligence

The threat landscape has changed.
Has your question changed with it?

In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.

Interactive ToolOpen Threat Command Center Quick AssessmentAssess My Blast Radius

Tracked Campaigns

82%

Intrusions are malware-free

— CrowdStrike GTR 2026

29 min

Avg. eCrime breakout time

— CrowdStrike GTR 2026

27 sec

Fastest observed breakout

— CrowdStrike GTR 2026

This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.

Contain the Blast Radius

See the attack paths already present in your environment — and where CNSF containment controls would break them.

Free Containment Assessment Under Active Attack?

Aviatrix Threat Research Center

Recent Breaches, Security Incidents & Vulnerabilities

AI-Powered Threat Analysis

Microsoft September 2025 Patch Tuesday: Spotlight on Network Privilege Escalation Flaws

U.S. Indicts Ukrainian Ransomware Operator Behind Hundreds of Global Attacks

Meta's WhatsApp Security Lapses: Insider Risks and Lessons for Compliance in 2025

Microsoft 2025 Zero-Day Patch Tuesday: SMB & SQL Server Vulnerabilities Fixed

Hackers Deploy Advanced Botnet Over Exposed Docker APIs via Tor (2025)

Ransomware's New Playbook: 2024 Sophisticated Extortion Hits Major Enterprises

Salesloft's GitHub Compromise Sparks 2024 Supply Chain Breach

Jaguar Land Rover Ransomware Breach Disrupts Global Operations in 2024

45 New Domains Fuel Salt Typhoon's Stealthy APT Campaign (2024)

2025 NPM Supply Chain Breach: Phishing Attack on JavaScript Developer Risks Crypto Theft

Iran MOIS Targets Diplomatic Missions Worldwide in Sophisticated Phishing Campaign (2024)

MostereRAT Malware: New Era of EDR Bypass and Persistent Threats

Security Research & Insights

php2shell: Two Critical PHP RCEs, a Pre-Patch Leak, and the PHP You Didn't Know You Had