Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 913 to 924 of 5935
Adform's 2026 Supply-Chain Breach: A Wake-Up Call for Ad Tech Security
In July 2026, Adform, a leading European online advertising firm, experienced a supply-chain attack where its JavaScript tracking script, 'trackpoint-async.js', was compromised. This malicious code, embedded in numerous client websites, monitored users' clipboards for cryptocurrency wallet addresses and replaced them with attacker-controlled addresses, leading to unauthorized redirection of cryptocurrency transactions. The breach was identified by security researcher Kevin Beaumont, who noted that the malicious script also transmitted user data to an attacker-controlled server. This incident underscores the escalating threat of supply-chain attacks, particularly in the ad tech industry, where third-party scripts are widely utilized. The ability of attackers to infiltrate trusted platforms and distribute malicious code highlights the need for enhanced security measures and vigilance in monitoring third-party integrations to prevent similar breaches.
1 month ago
Kill Chain
Arch Linux AUR Compromise: Over 400 Packages Infected in Supply Chain Attack
In June 2026, the Arch User Repository (AUR) of Arch Linux experienced a significant supply chain attack where over 400 packages were compromised. Attackers adopted orphaned packages, injecting malicious code into their build scripts. This code deployed a Rust-based infostealer and an eBPF rootkit, enabling credential theft and system concealment. The Arch Linux team responded by disabling new account registrations and package adoptions to mitigate further damage. ([archlinux.org](https://archlinux.org/news/active-aur-malicious-packages-incident/?utm_source=openai)) This incident underscores the vulnerabilities inherent in community-maintained repositories and highlights the necessity for rigorous package vetting processes. It also serves as a cautionary tale for organizations relying on open-source software, emphasizing the importance of continuous monitoring and verification of third-party code.
1 month ago
Kill Chain
Amgen's 2026 Cloud Data Breach: A Wake-Up Call for Healthcare Cybersecurity
In July 2026, Amgen, a leading biotechnology company, detected unauthorized access to its cloud environments managed by third-party service providers. The breach resulted in the exfiltration of proprietary data and patient protected health information. Amgen promptly activated its cybersecurity response plan, implemented containment measures, and engaged independent forensic experts to investigate the incident. The company is assessing the full scope of the breach, including potential exposure of confidential business information, intellectual property, and additional patient data. This incident underscores the escalating risks associated with third-party cloud services in the healthcare sector. Organizations must enhance their security postures by implementing robust access controls, continuous monitoring, and comprehensive incident response strategies to mitigate potential threats.
1 month ago
Kill Chain
HollowFrame and Matryoshka: Unveiling a Sophisticated Spear-Phishing Attack on a Law Firm
In July 2026, a sophisticated cyberattack targeted an undisclosed law firm using a previously undocumented Go-based loader named HollowFrame and a Rust-based backdoor called Matryoshka. The attack commenced with a spear-phishing email containing a link to an encrypted archive, which, when executed, initiated a multi-stage infection chain. This sequence involved privilege escalation, disabling Microsoft Defender protections, and downloading additional payloads. HollowFrame utilized DLL side-loading techniques to deploy Matryoshka, enabling persistent remote command execution, Active Directory reconnaissance, file transfers, and deployment of further malicious tools. These capabilities facilitated credential theft, lateral movement within the network, and potential broader domain compromise. This incident underscores the evolving threat landscape where attackers employ multi-stage, modular malware frameworks to infiltrate organizations. The use of spear-phishing as an initial vector highlights the critical need for robust email security measures and user awareness training to mitigate such sophisticated attacks.
1 month ago
Kill Chain
Chinese-Speaking Hackers Deploy OctLurk and SilkLurk Backdoors in Central Asian Cyber Attacks
Since January 2025, a Chinese-speaking threat actor has been conducting cyber attacks against government organizations in Central Asia, including Afghanistan, Kyrgyzstan, Tajikistan, Uzbekistan, Kazakhstan, and the Syrian Arab Republic. These attacks have targeted sectors such as healthcare, research, government offices, ministries of foreign affairs, logistics, law enforcement agencies, urban planning, and public education. The attackers employ two new obfuscated backdoors, OctLurk and SilkLurk, along with a specialized utility called LurkProxy to proxy network traffic. These tools enable a range of malicious activities, including command execution, file operations, credential dumping, keylogging, and remote access. The use of sophisticated backdoors and proxy tools in these attacks highlights an evolving threat landscape where state-sponsored actors develop and deploy advanced malware to achieve persistent access and data exfiltration. Organizations in the targeted regions should enhance their cybersecurity measures to detect and mitigate such threats.
1 month ago
Kill Chain
Unveiling Critical Vulnerabilities in AI Harnesses: A Call for Enhanced Security Measures
In July 2026, researchers at Novee Security identified critical vulnerabilities within AI harnesses used by major vendors such as Anthropic, Google, and OpenAI. These harnesses, which integrate various software components to manage AI models, exhibited trust issues between components, enabling attackers to execute supply chain attacks. Notably, Google's AI agent was exploited to write to its own GitHub repository, and similar issues were found in Anthropic's and OpenAI's AI agents. The vulnerabilities stemmed from misaligned trust between harness components, allowing unauthorized code execution and potential data breaches. This incident underscores the urgent need for organizations to scrutinize the security of AI harnesses, as the integration of multiple software components can introduce significant vulnerabilities. As AI systems become more prevalent, ensuring the integrity and security of their supporting frameworks is paramount to prevent exploitation by malicious actors.
1 month ago
Kill Chain
Minnesota Water Utility Cyberattack 2026: A Wake-Up Call for Critical Infrastructure Security
In late July 2026, over 30 community water systems in Minnesota experienced cyberattacks attributed to Iranian-affiliated actors. These attacks disrupted automated control systems, necessitating a temporary switch to manual operations. While water supply and quality remained largely unaffected, cities like Braham and Plymouth advised residents to limit water usage during the incidents. ([apnews.com](https://apnews.com/article/5bb1dcbaab8e3231889700c38a21e8ea?utm_source=openai)) This incident underscores the escalating cyber threats targeting U.S. critical infrastructure, particularly in the water sector. It highlights the vulnerabilities of operational technology systems and the pressing need for enhanced cybersecurity measures to protect essential services. ([csis.org](https://www.csis.org/analysis/iranian-cyber-threat-us-critical-infrastructure?utm_source=openai))
1 month ago
Kill Chain
Critical Vulnerabilities Discovered in Open62541
In July 2026, multiple vulnerabilities were identified in o6 Automation GmbH's Open62541, an open-source OPC UA stack widely used in industrial automation. These vulnerabilities, including CVE-2026-63362, CVE-2026-65423, CVE-2026-63035, and CVE-2026-63559, affect versions from 1.3.0 to 1.5.4 and the master branch. Exploitation could allow attackers to disclose sensitive information, cause denial-of-service conditions, or execute arbitrary code. ([aviatrix.ai](https://aviatrix.ai/threat-research-center/o6-automation-gmbh-open62541-vulnerability-2026/?utm_source=openai)) The discovery of these vulnerabilities underscores the critical importance of rigorous security practices in industrial automation software. Organizations utilizing Open62541 should promptly upgrade to the latest version to mitigate these risks. Additionally, implementing network segmentation and minimizing exposure of control systems to external networks are essential steps to enhance security posture.
1 month ago
Kill Chain
Critical Vulnerability in Rockwell Automation's ControlLogix and CompactLogix Controllers
In July 2026, Rockwell Automation disclosed a security vulnerability (CVE-2026-9636) affecting its CompactLogix 5380, ControlLogix 5580, and 1756-EN4TR communication modules. The flaw involves improper handling of Certificate Revocation Lists (CRLs), allowing attackers to use revoked certificates to establish unauthorized connections, potentially bypassing CIP Security protections. This vulnerability impacts firmware versions V36 to V37 for the affected products. ([rockwellautomation.com](https://www.rockwellautomation.com/es-es/trust-center/security-advisories/advisory.SD1788.html?utm_source=openai)) The incident underscores the critical importance of robust certificate validation processes in industrial control systems. As cyber threats targeting critical infrastructure continue to evolve, organizations must prioritize timely firmware updates and adhere to security best practices to mitigate potential risks.
1 month ago
Kill Chain
Critical Vulnerabilities in MZ Automation's lib60870: CVE-2026-61893 and CVE-2026-63033
In July 2026, MZ Automation's lib60870 library, widely used in industrial control systems, was found to have critical vulnerabilities identified as CVE-2026-61893 and CVE-2026-63033. These flaws, present in version 2.4.0, could be exploited by attackers to crash the parsing process, leading to a denial of service. The vulnerabilities stem from out-of-bounds read errors triggered by specially crafted IEC 60870-5-104 I-frames, allowing unauthorized access to memory beyond allocated buffers. ([windowsforum.com](https://windowsforum.com/security-alerts.84/cve-2026-16002-lib60870-2-4-1-fixes-scada-denial-of-service-risk.440185/?utm_source=openai)) Given the widespread deployment of lib60870 in critical infrastructure sectors such as energy, water, and manufacturing, these vulnerabilities pose significant operational risks. Organizations are urged to update to version 2.4.1 or later to mitigate potential threats. ([windowsforum.com](https://windowsforum.com/security-alerts.84/cve-2026-16002-lib60870-2-4-1-fixes-scada-denial-of-service-risk.440185/?utm_source=openai))
1 month ago
Kill Chain
Critical Vulnerabilities Disclosed in Johnson Controls OpenBlue Employee Software
In July 2026, Johnson Controls disclosed multiple vulnerabilities in its OpenBlue Employee (FMS Employee) software, versions up to V2025.3.1. These vulnerabilities include unrestricted file uploads (CVE-2026-21662), stored cross-site scripting (CVE-2026-34495), and HTML injection (CVE-2026-34497). Exploitation could allow attackers to upload malicious files, execute scripts, or inject arbitrary HTML content, potentially compromising system integrity and user data. The disclosure underscores the critical need for organizations to promptly apply security patches and implement robust web application security measures. As cyber threats targeting web applications continue to rise, maintaining vigilance and proactive defense strategies are essential to safeguard sensitive information and maintain operational continuity.
1 month ago
Kill Chain
CISA Issues Alert on Iranian Cyber Actors Targeting U.S. Critical Infrastructure PLCs
In July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert regarding Iranian-affiliated cyber actors targeting internet-connected programmable logic controllers (PLCs) within U.S. critical infrastructure sectors, including water and wastewater systems. These actors exploited vulnerabilities in PLCs from manufacturers such as Rockwell Automation, Schneider Electric, and Siemens, leading to operational disruptions and financial losses. The attackers manipulated data on human-machine interfaces (HMIs) and supervisory control and data acquisition (SCADA) displays, causing outages and misleading operators about system statuses. This incident underscores the escalating threat landscape where state-sponsored actors are increasingly focusing on industrial control systems. The expansion of targeted PLC brands highlights the need for organizations to reassess and fortify their operational technology (OT) security measures to prevent potential disruptions to essential services.
1 month ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
