Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 733 to 744 of 5935
Exploiting Windows 11 Plug and Play: A Path to SYSTEM-Level Access
In August 2026, security researchers Alejandro Hernando and Borja Martinez unveiled a method to exploit Windows Plug and Play (PnP) auto-installation processes, enabling unprivileged users to achieve SYSTEM-level code execution on fully updated Windows 11 systems. By emulating specific USB devices, they triggered the installation of signed vendor software containing vulnerabilities, which they chained to escalate privileges. Notably, this attack vector can be executed both physically and remotely via Remote Desktop Protocol (RDP) when USB redirection is enabled. This discovery underscores the critical need for organizations to scrutinize device installation processes and enforce strict policies on USB device usage and redirection settings. The ability to escalate privileges through such mechanisms highlights potential gaps in endpoint security, emphasizing the importance of comprehensive monitoring and control over peripheral device interactions.
1 month ago
Kill Chain
Unveiling North Korean IT Worker Infiltration Tactics in Crypto Startups
In August 2026, security researchers created a fictitious cryptocurrency startup, Ballena Azul, to investigate the infiltration tactics of suspected North Korean IT operatives. They advertised developer positions and successfully hired three individuals who provided falsified identification documents, including driver's licenses and bank account details. The operatives gained legitimate access to the company's virtual machines, which were monitored to observe their activities. Initial actions included system reconnaissance and the installation of remote desktop tools, indicating potential for unauthorized data access and exfiltration. This operation underscores the sophisticated methods employed by North Korean actors to infiltrate organizations under the guise of legitimate employment. The incident highlights the urgent need for enhanced identity verification processes, especially in remote hiring scenarios, to prevent unauthorized access and potential data breaches. Organizations are advised to implement periodic identity checks, in-person verifications, and comprehensive recruiter training to mitigate such risks.
1 month ago
Kill Chain
Malicious SIM Cards Exploit IoT Device Modems - August 2026
In August 2026, researchers from the University of Birmingham and security firm Fuzzware discovered that malicious SIM cards can execute attacker-controlled commands within the modems of cellular IoT devices, such as electric vehicle chargers, industrial routers, and car telematics units. Testing 26 devices, they found that 9 were vulnerable, including certain models from OPPO and ASUS. The vulnerability stems from the 'RUN AT' proactive command, which allows a SIM card to instruct the modem to execute AT commands, potentially leading to full device compromise. This issue predominantly affects machine-to-machine hardware, with several Quectel modules identified as susceptible. The researchers recommend disabling or hardening the 'RUN AT' interface to mitigate this risk. This discovery underscores the critical need for robust security measures in IoT devices, especially as they become more integrated into essential infrastructure. The ability for a SIM card to control device modems highlights a significant attack vector that could be exploited if not properly addressed.
1 month ago
Kill Chain
Mozilla's Proactive Key Revocation: A Lesson in Supply Chain Security
In August 2026, Mozilla revoked the cryptographic signing key used for Linux distributions of Firefox and Thunderbird after an unencrypted copy was inadvertently committed to a private code repository. Although the repository was private and audit records showed no unauthorized access, Mozilla proactively revoked the key to maintain security integrity. This revocation affects users who manually verify downloads and those using Mozilla's RPM packages, necessitating the import of a new key and the revocation of the old one. The new subkey, valid until August 5, 2028, ensures continued trust in Mozilla's software distributions. This incident underscores the critical importance of secure key management practices within software supply chains. As supply chain attacks become more prevalent, organizations must implement stringent controls to prevent unauthorized access and potential compromises, thereby safeguarding the integrity of their software products.
1 month ago
Kill Chain
OpenAI's GPT-5.6-Cyber: A Leap Forward in AI-Driven Cybersecurity
In August 2026, OpenAI introduced GPT-5.6-Cyber, a specialized AI model designed to enhance cybersecurity tasks such as vulnerability research, penetration testing, and incident response. Built upon GPT-5.6 Sol, this model reduces refusals for high-risk, dual-use cyber tasks, achieving a 95% completion rate for complex cybersecurity requests. Notably, GPT-5.6-Cyber identified CVE-2026-15903, a critical out-of-bounds read and write vulnerability in the V8 JavaScript engine, which could allow remote code execution via crafted HTML pages. This vulnerability was promptly patched by Google in mid-July 2026. The release of GPT-5.6-Cyber underscores the growing integration of AI in cybersecurity, providing defenders with advanced tools to proactively identify and mitigate vulnerabilities. This development highlights the importance of balancing AI capabilities with safety measures to prevent potential misuse, as AI models become increasingly adept at both offensive and defensive cyber operations.
1 month ago
Kill Chain
Critical Python Privilege Escalation Vulnerability (CVE-2026-12003) Discovered
In June 2026, a critical vulnerability (CVE-2026-12003) was identified in Python versions 3.11.0a3 through 3.15.0b2, affecting Windows installations. This flaw allowed low-privilege users to execute arbitrary code with elevated privileges by exploiting improper handling of the VPATH variable, leading to unauthorized access to alternative library folders. The vulnerability was introduced in December 2021 and publicly disclosed on June 16, 2026. ([securityvulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-12003?utm_source=openai)) This incident underscores the importance of securing software installation paths and the need for organizations to promptly apply security patches to prevent privilege escalation attacks. The Python Software Foundation has released updates to address this issue, and users are advised to upgrade to the latest versions to mitigate potential risks.
1 month ago
Kill Chain
Gunra Ransomware Group: A Growing Global Threat
In August 2026, U.S. and South Korean cyber agencies issued a joint advisory regarding the Gunra ransomware group, a ransomware-as-a-service (RaaS) operation that has been active since April 2025. Gunra employs double-extortion tactics, encrypting victims' data and threatening to publish it unless a ransom is paid. The group has targeted a wide range of sectors, including academia, financial services, government facilities, healthcare, manufacturing, and utilities, across multiple continents. Notably, Gunra has been recruiting ethical hackers and penetration testers as initial access brokers, offering them a share of the ransom profits in exchange for access to enterprise networks. This advisory underscores the evolving nature of ransomware threats, highlighting the increasing sophistication of RaaS operations and their global reach. Organizations are urged to bolster their cybersecurity defenses, particularly by addressing known vulnerabilities in internet-facing devices and implementing robust access controls to mitigate the risk of such attacks.
1 month ago
Kill Chain
Urgent Alert: Progress LoadMaster CVE-2026-8037 Exploitation in 2026
In June 2026, a critical OS command injection vulnerability, identified as CVE-2026-8037, was discovered in Progress Kemp LoadMaster appliances. This flaw allows unauthenticated attackers to execute arbitrary commands by exploiting unsanitized API inputs. Despite the release of security patches by Progress Software, active exploitation attempts were observed starting June 29, 2026, with nearly 300 LoadMaster instances exposed online. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its catalog of actively exploited vulnerabilities on August 7, 2026, urging immediate remediation. The exploitation of CVE-2026-8037 underscores the persistent threat posed by unpatched critical vulnerabilities in widely deployed infrastructure components. Organizations are reminded of the importance of timely patch management and continuous monitoring to mitigate such risks.
1 month ago
Kill Chain
Valve Alerts Steam Hardware Customers to Data Breach via CEVA Logistics
Between July 29 and August 1, 2026, CEVA Logistics, the shipping partner for Valve's Steam hardware in Europe, experienced a cyberattack that compromised customer data. The attackers accessed names, addresses, phone numbers, email addresses, and details of purchased products. Valve confirmed that sensitive information such as payment details and Steam account credentials remained secure, as CEVA does not have access to this data. Affected customers have been notified and advised to be vigilant against potential phishing attempts. This incident underscores the vulnerabilities in supply chain partnerships and the importance of robust security measures across all entities handling customer data. As cyberattacks targeting third-party service providers become more prevalent, organizations must ensure comprehensive security protocols are in place to protect end-user information.
1 month ago
Kill Chain
Cybercriminal 'The Com' Member Sentenced for Global Sextortion Crimes
In August 2026, Justin Swaddle, a 20-year-old from Leeds and member of the cybercriminal group 'The Com,' was sentenced to two years in prison for blackmail and sextortion offenses involving nearly 120 victims worldwide. Operating under aliases such as 'Epstein,' 'Rugen,' and 'Moscow' on platforms like Snapchat, Telegram, and Discord, Swaddle coerced victims, aged 13 to 17, into self-harm and the production of explicit content by threatening to expose their private information. The UK National Crime Agency (NCA) identified 117 female victims and discovered images of children as young as three on Swaddle's devices, some depicting acts he had incited. This case underscores the persistent threat posed by decentralized cybercriminal networks like 'The Com,' which exploit online platforms to target vulnerable individuals. The group's activities, including sextortion and the production of child sexual abuse material, highlight the urgent need for enhanced cybersecurity measures and public awareness to protect minors from such exploitation.
1 month ago
Kill Chain
LexisNexis 2026 Third-Party Vendor Breach: A Wake-Up Call for Supply Chain Security
In August 2026, LexisNexis identified unusual activity on servers managed by a third-party vendor, leading to the immediate shutdown of its Diligence, Metabase API, and Newsdesk services. The company is collaborating with a cybersecurity forensic firm to investigate the incident and is rebuilding affected systems in a new environment before restoring services. This incident underscores the critical importance of securing third-party vendor relationships, as vulnerabilities in external systems can directly impact core business operations. Organizations must implement stringent vendor risk management practices to mitigate such risks.
1 month ago
Kill Chain
SonicWall SMA1000 Vulnerabilities Exploited by Ransomware Gangs
In July 2026, SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances: CVE-2026-15409, a server-side request forgery flaw, and CVE-2026-15410, a code injection vulnerability. These flaws allowed unauthenticated attackers to execute arbitrary commands, leading to unauthorized access and potential data breaches. ([sonicwall.com](https://www.sonicwall.com/support/notices/%E8%A3%BD%E5%93%81%E3%81%AB%E9%96%A2%E3%81%99%E3%82%8B%E9%87%8D%E8%A6%81%E3%81%AA%E3%81%8A%E7%9F%A5%E3%82%89%E3%81%9B-sma-1000%E3%82%B7%E3%83%AA%E3%83%BC%E3%82%BA%E3%81%AB%E8%A4%87%E6%95%B0%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7/kA1VN000001nv6D0AQ?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware groups have actively exploited these vulnerabilities, emphasizing the urgency for organizations to apply the available patches promptly. The exploitation of these vulnerabilities underscores a growing trend of attackers targeting remote access solutions to infiltrate corporate networks. Organizations must prioritize securing their remote access infrastructure to prevent such breaches.
1 month ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
