Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 721 to 732 of 5935
AI-Assisted Exploit Chain Unveiled: Unauthenticated RCE in Microsoft SharePoint
In August 2026, security researchers identified a critical vulnerability in Microsoft SharePoint, designated as CVE-2026-55040, which allows unauthenticated attackers to impersonate any user, including administrators, without valid credentials. This flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Exploiting this vulnerability requires knowledge of the target account's Active Directory security identifier (SID) or user principal name (UPN). Rapid7 further discovered that chaining this authentication bypass with another vulnerability, CVE-2026-63520, enables remote code execution on the server without authentication. Microsoft released patches in July 2026 to address these issues. The discovery underscores the evolving threat landscape, where attackers increasingly leverage AI-assisted tools to identify and exploit vulnerabilities. Organizations must remain vigilant, ensuring timely application of security patches and adopting proactive measures to mitigate such sophisticated attack vectors.
1 month ago
Kill Chain
Sandworm's UAC-0145 Exploits Fake Job Interviews to Deploy Malicious VPN Clients
In August 2026, the Computer Emergency Response Team of Ukraine (CERT-UA) reported a sophisticated social engineering campaign by Russian state-sponsored group UAC-0145, a subgroup of Sandworm (APT44). The attackers impersonated recruiters to target Ukrainian IT professionals, conducting fake job interviews via platforms like Telegram and Zoom. They persuaded victims to install a malicious VPN client, a modified version of WireGuard, which enabled the execution of arbitrary commands on the compromised systems. This method allowed the attackers to gain unauthorized access and potentially exfiltrate sensitive information. This incident underscores the evolving tactics of nation-state actors, highlighting the increasing use of social engineering to bypass traditional security measures. Organizations must enhance their cybersecurity awareness programs and implement robust endpoint protection to mitigate such threats.
1 month ago
Kill Chain
Zoom Annotation Vulnerabilities Expose Clients to Hijacking - August 2026
In August 2026, critical vulnerabilities were discovered in Zoom's annotation feature, allowing meeting participants to hijack other attendees' clients without any user interaction. These flaws, identified as CVE-2026-53413, CVE-2026-53414, and CVE-2026-53415, stemmed from improper input validation and message handling within the annotation tool. Exploitation could lead to unauthorized control over participants' systems, posing significant security risks. Zoom addressed these issues by releasing patches in June and July 2026, with no reported exploitation as of the disclosure date. This incident underscores the growing concerns over the security of widely-used collaboration tools, especially as remote work continues to be prevalent. The rapid identification and patching of such vulnerabilities highlight the importance of proactive security measures and the need for organizations to stay vigilant against potential threats in digital communication platforms.
1 month ago
Kill Chain
Kimwolf v7 Botnet: A New Era of Sophisticated DDoS Attacks
In August 2026, cybersecurity researchers identified Kimwolf v7, an evolved version of the Kimwolf/AISURU Android and IoT botnet. This variant introduces HTTP/2-based DDoS attacks that mimic legitimate browser behavior, complicating detection efforts. Additionally, it employs a resilient command-and-control infrastructure utilizing Ethereum Name Service (ENS) and Tor hidden services, enhancing its resistance to takedown attempts. The botnet primarily targets Android TV boxes with exposed Android Debug Bridge (ADB) services, enabling the installation of malware capable of conducting DDoS attacks and relaying malicious traffic. The emergence of Kimwolf v7 underscores a significant advancement in botnet capabilities, particularly in evading detection and maintaining operational resilience. This development highlights the urgent need for organizations to implement robust security measures, including disabling unnecessary services like ADB, to mitigate the risk of such sophisticated threats.
1 month ago
Kill Chain
State-Sponsored Cyber Attacks on AI Supply Chain in 2026
In 2026, the global race to dominate artificial intelligence (AI) has intensified, with nations vying for control over critical minerals, semiconductor production, and AI model development. This competition has led to increased state-sponsored cyber operations targeting every link in the AI supply chain, from mining companies to data centers and AI research institutions. Notably, Chinese state-sponsored hackers have been implicated in sophisticated cyber espionage campaigns aimed at extracting sensitive information and disrupting competitors' advancements in AI technologies. The urgency of securing the AI development chain has never been more critical. As AI becomes deeply integrated into various sectors, the potential for cyber threats to disrupt economies and national security has escalated. Organizations must adopt comprehensive cybersecurity strategies to protect against these evolving threats, ensuring the resilience of their AI infrastructures.
1 month ago
Kill Chain
CyberAv3ngers' Cyberattacks on U.S. Water Systems: A 2026 Analysis
In July 2026, a coordinated series of cyberattacks targeted water and wastewater systems across at least 12 U.S. states, including Minnesota, Georgia, Michigan, South Dakota, Alabama, and New Jersey. The attackers exploited vulnerabilities in internet-exposed programmable logic controllers (PLCs), specifically those from Rockwell Automation, Schneider Electric, and Siemens, to modify configurations and lock out operators. While no water contamination was reported, some systems experienced operational disruptions, such as water pressure drops and the issuance of boil water advisories. These incidents underscore the critical vulnerabilities in the nation's water infrastructure, particularly in smaller utilities lacking robust cybersecurity measures. ([axios.com](https://www.axios.com/2026/08/04/water-cyberattacks-us-iran?utm_source=openai)) The attacks have been tentatively linked to the Iranian state-sponsored group CyberAv3ngers, known for targeting industrial control systems in critical infrastructure sectors. This campaign highlights the escalating cyber threat landscape and the urgent need for enhanced security protocols to protect essential services. ([ampcuscyber.com](https://www.ampcuscyber.com/shadowopsintel/cyberav3ngers-targeting-the-us-water-utilities-ics/?utm_source=openai))
1 month ago
Kill Chain
GhostJacking: Unveiling AI Agent Security Vulnerabilities
In August 2026, Tenet Security unveiled 'GhostJacking,' a sophisticated attack technique exploiting AI agents' reliance on trusted data sources. By embedding malicious instructions into security alerts, logs, and error reports, attackers can manipulate AI agents to execute unauthorized actions, including code execution, credential theft, and infrastructure takeover. Demonstrations highlighted vulnerabilities in platforms like Cloudflare, Datadog, and Sentry, where AI agents misinterpreted poisoned data as legitimate commands, leading to significant security breaches. This incident underscores the critical need for robust identity governance and operational safeguards in AI agent deployments. As AI systems become integral to organizational operations, ensuring they can discern and resist malicious manipulations is paramount to maintaining security and trust.
1 month ago
Kill Chain
Critical Metabase SQL Injection Zero-Day Vulnerability Discovered
In August 2026, Metabase disclosed a critical SQL injection vulnerability affecting versions 1.58 and above of its Cloud platform. This flaw allowed remote attackers to inject SQL statements into the application database, granting them administrator access. Exploiting this access, attackers could alter configurations, steal stored credentials, and access connected databases. Metabase promptly blocked the exploited endpoints and released patches to address the vulnerability. Self-hosted instances with exposed /api/session/reset_password endpoints remained at risk until updated. This incident underscores the persistent threat posed by SQL injection vulnerabilities, which continue to be prevalent despite longstanding awareness. Organizations are reminded of the importance of implementing prepared statements and other secure coding practices to mitigate such risks.
1 month ago
Kill Chain
BdThemes Supply Chain Attack: A New Vector in WordPress Plugin Compromises
In August 2026, a sophisticated supply chain attack targeted BdThemes, a WordPress plugin vendor, compromising multiple plugins without altering their source code. Attackers exploited a cross-site scripting (XSS) vulnerability in the Biggopti component, which fetched promotional banners via a JSON API. By poisoning the JSON data stream, they injected malicious scripts that executed within the WordPress admin dashboard, leading to the creation of rogue administrator accounts and deployment of web shells. This breach affected plugins with over 100,000 active installations, prompting WordPress to temporarily disable their downloads. This incident underscores the evolving nature of supply chain attacks, where adversaries manipulate external data sources to compromise systems without direct code modifications. It highlights the critical need for organizations to scrutinize all components of their software supply chain, including third-party APIs and data streams, to mitigate such vulnerabilities.
1 month ago
Kill Chain
Cyberattack on Polish Power Plant via Private Cellular Network - 2025
In December 2025, a coordinated cyberattack targeted Poland's energy infrastructure, including over 30 renewable energy farms and a major combined heat and power (CHP) plant supplying heat to nearly 500,000 residents. Attackers exploited vulnerabilities in private cellular networks, gaining unauthorized access to industrial control systems (ICS) and deploying wiper malware aimed at sabotaging operations. Despite the sophisticated nature of the attack, prompt response measures prevented significant service disruptions. This incident underscores the escalating threat landscape facing critical infrastructure, highlighting the need for robust cybersecurity measures in industrial environments. The attack's timing, during severe winter conditions, emphasizes the potential human and economic impact of such cyber threats.
1 month ago
Kill Chain
Gunra Ransomware Exploits Fortinet and Schneider Electric Vulnerabilities
In August 2026, cybersecurity agencies from South Korea and the U.S. issued warnings about Gunra ransomware attacks targeting critical infrastructure sectors worldwide. The attackers exploited vulnerabilities in Schneider Electric PowerLogic P5 (CVE-2024-5559) and Fortinet FortiOS and FortiProxy (CVE-2025-24472) appliances to gain initial access. Employing a double extortion model, they encrypted data and exfiltrated sensitive information, threatening to publish it unless a ransom was paid within five to seven days. Since its emergence in April 2025, Gunra has listed 51 victims, primarily in South Korea, Brazil, Spain, Thailand, and Hong Kong. The group utilizes phishing campaigns and advanced encryption methods like Salsa20 and ChaCha20 to execute their attacks. This incident underscores the evolving tactics of ransomware groups, highlighting the critical need for organizations to promptly patch known vulnerabilities and implement robust security measures to protect against such sophisticated threats.
1 month ago
Kill Chain
GhostSplice: Unveiling the Exploitation of AI Coding Assistants via Malicious MCP Servers
In August 2026, the ASSET Research Group disclosed 'GhostSplice,' a technique exploiting AI coding assistants connected via the Model Context Protocol (MCP). Malicious MCP servers can fragment exfiltration instructions into innocuous parts, embedding them within tool descriptions and results. This method enables AI agents to inadvertently collect and transmit sensitive data, such as SSH keys and proprietary source code, without detecting the malicious intent. The attack assumes prior connection to the attacker's MCP server and access to the targeted files. This incident underscores the evolving sophistication of attacks targeting AI-integrated development environments. As AI coding assistants become more prevalent, ensuring robust validation of external tool integrations and enhancing security protocols within AI agents is imperative to prevent unauthorized data exfiltration.
1 month ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
