Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 829 to 840 of 5935
COLDCARD Phishing Attack Leads to Remote Access Installation
In August 2026, a sophisticated phishing campaign targeted COLDCARD hardware wallet users by impersonating official communications. Attackers sent emails claiming a security audit was necessary due to recent vulnerabilities, directing recipients to a fraudulent website to download a diagnostic tool. This tool installed ScreenConnect remote access software, granting attackers control over victims' computers, potentially leading to data theft or further malware deployment. This incident underscores the evolving nature of phishing attacks, which are becoming more targeted and convincing. The exploitation of recent security concerns to deceive users highlights the critical need for continuous vigilance and education on recognizing and avoiding such threats.
1 month ago
Kill Chain
Hackers Deploy 'khunt' Toolkit via SQL Injection in Oracle Database
In July 2026, attackers exploited a SQL injection vulnerability in a public-facing Java application running Apache Tomcat to gain unauthorized access to an Oracle database. They installed the 'khunt' post-exploitation toolkit directly within the database as a Java object, enabling them to execute system commands, steal credentials, and manage files. This method allowed the attackers to operate with SYSTEM-level permissions on the Windows server hosting the database, facilitating potential data exfiltration and further network compromise. This incident underscores the critical need for organizations to sanitize all user-supplied input and restrict database account privileges, especially in public-facing applications. The use of embedded Java Virtual Machines within databases as a vector for post-exploitation activities highlights an emerging threat landscape that security teams must address proactively.
1 month ago
Kill Chain
Critical Vulnerabilities Discovered in Paperclip AI Orchestration Platform
In August 2026, multiple critical vulnerabilities were identified in Paperclip, an open-source control plane for AI agent orchestration. The most severe, CVE-2026-41679 (CVSS score: 10.0), allows unauthenticated remote code execution on network-accessible instances running in authenticated mode with default settings. Another flaw, GHSA-x8hx-rhr2-9rf7 (CVSS score: 9.6), enables attackers to execute commands on a developer's machine by exploiting the default local_trusted mode. These vulnerabilities stem from improper authentication and authorization mechanisms, potentially granting attackers full control over affected systems. The discovery of these flaws underscores the critical importance of securing AI orchestration platforms, especially as their adoption grows. Organizations utilizing Paperclip should promptly update to version 2026.416.0 or later and reassess their deployment configurations to mitigate potential exploitation risks.
1 month ago
Kill Chain
Ransom Cartel Ransomware Creator Sentenced to 16 Years
In August 2026, Maksim Silnikau, the creator and administrator of the Ransom Cartel ransomware operation, was sentenced to 16 years in prison for orchestrating attacks against at least 18 companies worldwide. Operating between 2021 and 2023, Ransom Cartel employed double extortion tactics, encrypting victims' data and threatening to leak it unless ransoms were paid. The group attempted to extort at least $5.2 million, causing over $6.7 million in losses. Notably, their operations disrupted a medical technology startup for two months and caused significant downtime for multiple law firms. This sentencing underscores the persistent threat posed by ransomware-as-a-service operations and highlights the critical need for robust cybersecurity measures. Organizations must remain vigilant against evolving ransomware tactics, as threat actors continue to adapt and exploit vulnerabilities across various sectors.
1 month ago
Kill Chain
Snowflake Data Breach 2024: A Wake-Up Call for Cloud Security
Between February and October 2024, cybercriminals exploited stolen credentials to access Snowflake customer accounts lacking multi-factor authentication (MFA). This led to unauthorized access to sensitive data from at least 165 organizations, including AT&T, Ticketmaster, and Santander. The attackers, notably Connor Riley Moucka and John Erin Binns, utilized infostealer malware to harvest login information, resulting in the theft of terabytes of data and extortion of millions of dollars from affected companies. The incident underscores the critical importance of implementing robust security measures, such as MFA, to protect cloud-based data. As cloud services become increasingly integral to business operations, organizations must prioritize stringent access controls and continuous monitoring to mitigate the risk of similar breaches.
1 month ago
Kill Chain
Over 250 ClickFix Domains Exploit Browser Fingerprinting to Deploy macOS Malware
In August 2026, a sophisticated macOS malware campaign was identified, involving over 250 domains utilizing browser fingerprinting to selectively target users. The attackers employed 'ClickFix' tactics, presenting fake software download pages that instructed users to execute obfuscated commands in the Terminal. Upon execution, these commands deployed infostealers like Atomic Stealer (AMOS) and MacSync, compromising credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files. The campaign's infrastructure evolved to evade detection by static scanners and automated analysis tools. This incident underscores the increasing sophistication of social engineering attacks targeting macOS users. The use of browser fingerprinting to selectively deliver malware highlights the need for heightened vigilance and advanced detection mechanisms to counter such evolving threats.
1 month ago
Kill Chain
OpenAI's Intervention in Poipet Scam Network Exploiting ChatGPT
In August 2026, OpenAI identified and dismantled a sophisticated scam network operating from Poipet, Cambodia, that exploited its ChatGPT technology to orchestrate various fraudulent schemes, including investment scams, romance frauds, gambling cons, and law enforcement impersonations. The perpetrators utilized ChatGPT to create fake online personas, generate and translate deceptive messages, and produce promotional content targeting victims primarily in Bangladesh and India. This operation highlights the evolving misuse of AI tools in cybercrime, enabling scammers to scale their activities and enhance the credibility of their deceptive practices. The incident underscores the urgent need for robust AI governance and proactive measures to prevent the exploitation of generative AI technologies in fraudulent activities.
1 month ago
Kill Chain
Poison Claude: Unveiling Unauthorized Access to AI Models
In August 2026, cybersecurity researchers uncovered 'Poison Claude,' a clandestine service offering unauthorized access to Anthropic's Claude AI models at discounted rates. This operation exploited vulnerabilities to provide illicit access to models such as Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6. Notably, the operator of Poison Claude had the capability to monitor and record every prompt submitted by users, leading to significant data privacy concerns and potential intellectual property theft. This incident underscores the escalating risks associated with unauthorized AI model access and the exploitation of AI systems for malicious purposes. It highlights the urgent need for robust security measures and vigilant monitoring to prevent such breaches, especially as AI technologies become increasingly integrated into critical business operations.
1 month ago
Kill Chain
Critical Flaw in Google's ADK for Python Exposes Systems to Remote Code Execution
In April 2026, a critical vulnerability (CVE-2026-4810) was identified in Google's Agent Development Kit (ADK) for Python, affecting versions 1.7.0 through 1.28.1 and 2.0.0a1 through 2.0.0a2. This flaw allowed unauthenticated remote attackers to execute arbitrary code on servers hosting vulnerable ADK instances, potentially leading to full system compromise. The vulnerability stemmed from a combination of code injection and missing authentication mechanisms within the ADK framework. Google addressed this issue by releasing patched versions 1.28.1 and 2.0.0a2, urging users to upgrade their deployments promptly. ([advisories.gitlab.com](https://advisories.gitlab.com/pypi/google-adk/CVE-2026-4810/?utm_source=openai)) This incident underscores the evolving threat landscape associated with AI development tools and the importance of securing agent-based systems. As AI agents become more integrated into critical workflows, ensuring robust authentication and input validation mechanisms is paramount to prevent exploitation and maintain system integrity.
1 month ago
Kill Chain
Unitel Cyberattack Disrupts Services Ahead of IPO
On July 28, 2026, Unitel, Angola's leading telecommunications provider, experienced a significant cyberattack targeting its technological infrastructure. Detected at approximately 2:20 AM local time, the attack disrupted voice, mobile data, and internet services nationwide, affecting over 21 million customers. The incident occurred just one day before Unitel's scheduled listing on the Angola Debt and Securities Exchange (BODIVA), following a public offering of a 15% stake in the company. In response, Unitel activated its response and containment mechanisms, mobilizing technical and cybersecurity teams to mitigate the effects and restore services. As of the latest reports, services remain affected, with ongoing efforts to fully stabilize and normalize the network. ([businessday.co.za](https://www.businessday.co.za/world/international-companies/2026-07-28-cyberattack-hits-angolas-unitel-a-day-before-its-listing/?utm_source=openai)) This incident underscores the escalating threat landscape facing critical infrastructure sectors, particularly telecommunications. The timing of the attack, coinciding with Unitel's IPO, highlights the potential for cyber adversaries to exploit significant corporate events. Organizations must prioritize robust cybersecurity measures and incident response strategies to safeguard against such disruptions, especially during pivotal business milestones.
1 month ago
Kill Chain
Leaked n8n API Tokens Expose Instances to Credential Theft
In August 2026, GitGuardian researchers identified 321 n8n instances accepting API tokens that had been exposed in public GitHub commits. This exposure allowed unauthorized access to sensitive data and downstream credentials without exploiting any software vulnerabilities. The investigation revealed that 36% of the reachable instances tested were vulnerable, highlighting significant security risks associated with leaked API tokens in workflow automation platforms. This incident underscores the critical importance of securing API tokens and credentials, especially in platforms like n8n that integrate with various internal systems. Organizations must implement robust credential management practices and regularly audit their repositories to prevent unauthorized access and potential data breaches.
1 month ago
Kill Chain
QuickFox Supply Chain Attack: FDMTP Backdoor Deployment Unveiled
In August 2026, cybersecurity researchers uncovered a prolonged supply chain attack targeting QuickFox, a VPN service popular among overseas Chinese users. The attack, active since at least August 2025, involved a trojanized version of the QuickFox application delivering the FDMTP backdoor, attributed to the Chinese state-sponsored group Mustang Panda. The malicious code was embedded in the Windows installer, executing a JavaScript loader that fingerprinted victim systems before deploying the backdoor. This campaign primarily affected Windows users, with QuickFox addressing the issue by releasing a clean version 3.59.6. This incident underscores the escalating threat of supply chain attacks, where trusted software is compromised to distribute malware. Organizations must enhance their software supply chain security, implement rigorous code audits, and maintain vigilant monitoring to detect unauthorized modifications, especially as such attacks become more sophisticated and widespread.
1 month ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
