Aviatrix Threat Research Center
Cloud breaches are accelerating — across identities, workloads, supply chains, and cloud-native services. In the Containment Era, understanding how a breach unfolds is how you architect to stop it.
The Aviatrix Threat Research Center provides security teams with:
- A structured understanding of how breaches unfold — kill chain, ATT&CK techniques, CVEs, and IOCs in a consistent format.
- What attackers exploited, and which enforcement gaps let them move.
- Where workload-level controls would have broken the attack chain — including paths that posture tools and endpoint detection don't model.
Recent Breaches, Security Incidents & Vulnerabilities
AI-Powered Threat Analysis
Agentic AI that analyzes real-world attacks — across security incidents, breaches, and exploited vulnerabilities — to produce structured, actionable intelligence.
Displaying 85 to 96 of 5908
Trezor Supply Chain Attack: When Legitimate Email Infrastructure Becomes a Weapon
In September 2026, cryptocurrency hardware wallet maker Trezor warned customers that threat actors had breached its third-party email provider and were conducting sophisticated phishing attacks. The attackers sent fake "critical security alert" emails from help@trezor.io, claiming a hardware microcontroller vulnerability in STM32 chips could expose wallet seeds to brute-force attacks. This incident followed a previous breach of Trezor's shipping provider ShipMonk in August 2026, which compromised data from 81,000 customers across multiple countries. The ShipMonk breach exploited a critical SQL injection zero-day vulnerability in the Metabase analytics platform, with the ShinyHunters extortion gang subsequently targeting the company. This incident highlights the growing trend of supply chain attacks targeting cryptocurrency platforms and the increasing sophistication of phishing campaigns that leverage compromised legitimate infrastructure to bypass security controls and user awareness training.
5 days ago
Kill Chain
Ransomware Gangs Target WatchGuard Firebox Vulnerability: 9,000 Devices Still at Risk
CISA confirmed that ransomware gangs are actively exploiting CVE-2025-14733, a critical remote code execution vulnerability in WatchGuard Firebox firewalls. The flaw, first disclosed in December 2025, stems from an out-of-bounds write vulnerability affecting firewalls with IKEv2 VPN configurations. Despite patches being available for nine months, nearly 9,000 vulnerable devices remain exposed online according to Shadowserver monitoring, down from an initial 115,000. The vulnerability allows unauthenticated attackers to execute malicious code remotely with low complexity, making it an attractive target for threat actors. This incident highlights the persistent challenge of network perimeter security in an era where traditional firewalls face sophisticated exploitation techniques. With WatchGuard serving over 250,000 organizations through 17,000 resellers globally, the widespread exposure of this vulnerability demonstrates how legacy security infrastructure becomes a liability when not properly maintained and patched.
5 days ago
Kill Chain
BlueMoon Exploit Kit Weaponizes Chrome and Windows Zero-Days in Multi-Group APT Campaign
Multiple Chinese cyber-espionage groups deployed the BlueMoon exploit kit in August-September 2026, chaining three zero-day vulnerabilities in Chrome and Windows to achieve remote code execution and privilege escalation. The kit exploited CVE-2026-85046 and CVE-2026-87491 in Chrome's V8 JavaScript engine for sandbox escape, combined with CVE-2026-85880 in Windows ALPC for local privilege escalation. Threat actors including JungleBamboo (APT31), UTA0560, UNK_LateNight, and UNK_DoubleCheck targeted NGOs, aerospace companies, and manufacturing firms through spearphishing campaigns that delivered various backdoors including ShadowPad and Grimwedge. This incident demonstrates the increasing sophistication of state-sponsored actors in rapidly weaponizing zero-day vulnerabilities and sharing exploit tools across multiple threat groups. The coordinated use of BlueMoon by different Chinese APT groups signals a concerning trend of exploit kit sharing and collaborative cyber operations targeting critical infrastructure and civil society organizations.
5 days ago
Kill Chain
IDScan Breach Exposes 153 Million Driver's Licenses: A Wake-Up Call for Identity Verification Security
In September 2026, identity verification company IDScan confirmed a significant data breach affecting over 153 million driver's license scans and personal identification documents. Threat actors gained unauthorized access to IDScan's cloud platform, compromising customer data including full names, driver's license numbers, and scanned copies of government-issued IDs. The stolen data was subsequently advertised on a dark web platform called 'Nexus' before being taken offline following FBI investigation. IDScan provides identity verification services to car rental companies, financial institutions, cannabis dispensaries, and hospitality businesses across the US and Canada. This incident highlights the growing threat to identity verification infrastructure as cybercriminals increasingly target centralized repositories of sensitive personal data. The breach demonstrates how third-party service providers handling critical identity documents have become high-value targets, creating cascading privacy risks across multiple industries that rely on these verification services.
5 days ago
Kill Chain
Russian AI Agents Exploit PaperCut Flaws in Global Campaign Hitting 395 Organizations
In August 2026, a Russian-speaking threat actor orchestrated an unprecedented AI-powered exploitation campaign targeting PaperCut NG/MF servers worldwide. Using hundreds of AI agents powered by OpenAI's Codex and DeepSeek models, the attackers automated exploit development for CVE-2026-81578 and CVE-2026-82078, compromising 440 PaperCut instances across 395 organizations in 48 countries within days. The campaign demonstrated alarming speed, with attackers achieving remote code execution in under four hours and domain administrator privileges in just seven minutes at some targets, primarily affecting educational institutions. This incident marks a critical inflection point in cybersecurity, showcasing how AI can compress traditional attack timelines from weeks to minutes. As threat actors increasingly weaponize AI for automated vulnerability discovery and exploitation, organizations face an unprecedented challenge where human-speed incident response becomes obsolete against machine-speed attacks.
5 days ago
Kill Chain
How Cisco FMC Vulnerabilities Enabled Qilin Ransomware and Russian APT Attacks
In September 2026, Cisco Talos revealed that three distinct threat actor clusters had exploited two critical vulnerabilities in Cisco's Secure Firewall Management Center (FMC). The attacks leveraged CVE-2026-20079, a maximum-severity authentication bypass flaw, and CVE-2026-20316, a static credential vulnerability. These exploits enabled attackers to deploy web shells, steal credentials, establish persistent access, and ultimately deploy Qilin ransomware and Cyclops Blink malware. The incidents demonstrate sophisticated post-compromise activities including network reconnaissance, credential harvesting, and deployment of advanced persistent threat tooling across compromised infrastructure. This incident highlights the escalating sophistication of ransomware operations and state-sponsored campaigns targeting critical network security infrastructure. As organizations increasingly rely on centralized security management platforms, these systems become high-value targets that provide attackers with extensive network visibility and control capabilities.
5 days ago
Kill Chain
Surfshark VPN Breach Exposes Critical Cloud Security Gaps in Development Environments
In August 2026, Surfshark VPN disclosed that hackers accessed internal test servers after a configuration error exposed them to the internet. The breach occurred due to human error in server configuration, allowing unauthorized access to system binaries, code history, build credentials, and a separate proxy server used for content optimization. While no customer data, VPN traffic, or encryption keys were compromised, the incident exposed internal development infrastructure and service configurations. Surfshark detected the breach on August 31, contained it by September 2, and completed remediation within three days. This incident highlights the growing trend of cloud misconfigurations becoming primary attack vectors, particularly as organizations rapidly expand their cloud infrastructure without implementing consistent security controls across development and production environments.
5 days ago
Kill Chain
ThreatsDay September 2026: The Week AI-Powered Attacks and Mass-Scale Scams Converged
A comprehensive security bulletin from September 2026 revealed multiple coordinated cyber campaigns targeting various platforms and services. Key incidents included malicious Chrome and Firefox extensions stealing cryptocurrency wallet data, AI-powered intrusions by Chinese-speaking operators targeting government systems across Asia, and a massive fake e-commerce operation called DoppelCart using over 119,000 domains to steal payment card details. Additional threats encompassed shadow AI risks exposing corporate data, sophisticated M&A wire fraud schemes, phishing campaigns abusing Google services, and various malware deployments leading to ransomware attacks. These incidents highlight the current surge in multi-vector attack campaigns leveraging AI automation, browser extension abuse, and social engineering at unprecedented scale. The convergence of AI-assisted vulnerability discovery, shadow IT adoption, and increasingly sophisticated phishing infrastructure represents a critical inflection point requiring immediate organizational attention to zero trust implementation and egress security controls.
5 days ago
Kill Chain
Mantax Otax: The Android Threat That Encrypts, Steals, and Terrorizes Victims
Mantax Otax, a sophisticated Android malware strain discovered in September 2026, combines ransomware, spyware, and harassment capabilities to target Indonesian users through malicious APKs distributed outside Google Play. The malware uses accessibility services to gain extensive device control, encrypts files on older Android versions (9 and below) using victim-specific AES keys, and steals sensitive data including SMS messages, call logs, WhatsApp conversations, and real-time screen recordings. Beyond encryption and data theft, version 2 introduced psychological harassment features including jumpscare overlays, forced audio messages, and repeated dialog boxes to pressure victims into paying ransoms through Firebase-hosted chat negotiations. This incident highlights the growing trend of multi-vector mobile threats that combine financial extortion with psychological manipulation, demonstrating how threat actors are evolving beyond traditional ransomware to create more coercive attack campaigns targeting vulnerable mobile ecosystems in developing markets.
5 days ago
Kill Chain
Chinese AI Firms Conduct Industrial-Scale Theft of US Frontier AI Models
In September 2026, US government agencies including the FBI, NSA, and CISA issued a joint advisory accusing Chinese AI companies of conducting industrial-scale model distillation campaigns against leading US AI models. The companies, including Alibaba, DeepSeek, MiniMax, Moonshot AI, StepFun, and Z.AI, allegedly extracted billions of tokens from OpenAI's GPT, Anthropic's Claude, Google's Gemini, and SpaceX's Grok models since late 2024. Using sophisticated techniques including chain-of-thought reasoning extraction, automated failover systems, and proxy networks to evade detection, these firms reportedly violated terms of service to steal proprietary capabilities and reduce their own development costs. DeepSeek's publicly quoted training costs of $5.6 million were deemed misleading as they excluded the true cost of maliciously acquired data through extensive distillation operations. This incident highlights the escalating AI intellectual property theft landscape as nation-state actors increasingly target frontier AI capabilities to accelerate domestic development while circumventing export controls and sanctions. The systematic nature of these campaigns represents a new category of cyber threat that traditional security frameworks are ill-equipped to address.
5 days ago
Kill Chain
The AI Vulnerability Firehose: When Discovery Outpaces Human Validation
In September 2026, analysis of Anthropic's Project Glasswing revealed a critical bottleneck in AI-driven vulnerability research. Since launching in April 2026, Claude Mythos AI generated 26,153 vulnerability findings across multiple software projects, but only 10% (2,736) reached the disclosure stage and less than 0.8% (202) were actually patched. The analysis exposed significant gaps between AI discovery capabilities and human validation processes, with 90% of findings never making it to the vulnerability disclosure ledger. Additionally, Claude's severity assessments proved overly aggressive, rating 91.5% of findings as critical or high severity compared to maintainers' 61.3% assessment. This incident highlights the emerging reality that AI has shifted the vulnerability research bottleneck from discovery to validation and remediation. As organizations increasingly deploy AI security scanners that generate massive volumes of potential findings, the human workforce responsible for triaging, validating, and coordinating fixes has become overwhelmed, creating new operational challenges in cybersecurity programs.
5 days ago
Kill Chain
ShieldCrash Exploit Exposes Critical Gaps in Windows Defender Security
In September 2026, the security researcher known as Nightmare-Eclipse released 'ShieldCrash,' a zero-day privilege escalation exploit targeting Microsoft's Windows Defender Malware Protection Engine. This exploit bypasses Microsoft's patch for the previous CVE-2026-69414 'ShieldBreak' vulnerability, demonstrating arbitrary file read capabilities under SYSTEM privileges across all supported Windows versions. The exploit is part of an ongoing vendetta by the researcher against Microsoft, who has been releasing monthly zero-day exploits since April 2026, often followed by patch bypasses that expose incomplete remediation efforts. This incident highlights the growing trend of adversarial security research where legitimate researchers turn hostile due to vendor disputes, creating sustained security risks for enterprise environments relying on Windows infrastructure and endpoint protection solutions.
5 days ago
Kill Chain
Security Research & Insights
Security Research & Insights with human-led deep dives into campaigns and cloud-native TTPs
The Edge Device Isn't Your Last Line of Defense. It's Their First Target.
AI Trust Abuse: A Detection Engineer's Field Guide to Agent-Abuse Attacks
Aug 18, 2026
OpenAI Lost Control of Its Models. Then Anthropic Did Too. That Is Not a Coincidence.
Market Perspectives
Market Perspectives offering expert commentary and select breach analysis from industry leaders
What Could Have Stopped the 2023 MGM Breach? A Study in the Power of Embedded Zero Trust
The Zero Trust Gap: Only 8% of US Enterprises Use Zero Trust Architectures
HITRUST CSF Compliance in the Cloud—How Aviatrix Secures Healthcare Data
How CNSF Protects Cloud Workloads
Cloud attackers don’t rely on a single exploit — they rely on paths.
Once inside, attackers move laterally between workloads, establish command-and-control through egress paths, and exfiltrate data through legitimate cloud services — often before detection tools generate an alert. These paths exist because most security architectures enforce at centralized inspection points, not at every workload. The paths that matter most are the ones that never reach a central firewall.
Aviatrix Cloud Native Security Fabric (CNSF) contains attacks by enforcing policy at every workload communication path — containing blast radius, blocking lateral movement, and cutting off egress before data leaves the environment.
With CNSF, enterprises can:
- Contain attack paths at runtime
Gain visibility into east-west and egress workload communication and apply controls that limit lateral movement, unauthorized egress, and uncontrolled trust expansion.
- Eliminate blind spots in workload-to-workload traffic
Observe traffic across VPCs/VNets, regions, and cloud providers using cloud native telemetry — including paths that posture tools and point controls don’t model.
- Secure modern and AI-driven workloads
Understand how agents, services, and workloads communicate at runtime, and enforce policy to reduce the risk of misuse, over-privileged access, or unintended data flows.
- Apply consistent Zero Trust controls without slowing teams
Enforce segmentation, egress control, and encryption centrally across clouds — without agents, application changes, or developer friction.
See Your Attack Paths. Close the Gaps with CNSF.
Blast radius starts where your enforcement stops.
Most security architectures enforce at centralized inspection points. Attackers move between workloads on paths that never reach those points — building blast radius invisibly until detection tools fire, often too late.
Your assessment delivers:
The Aviatrix Workload Attack Path Assessment (WAPA) analyzes real workload communication using cloud native telemetry to uncover attack paths already present in your environment — and shows how Cloud Native Security Fabric (CNSF) can break those paths with runtime enforcement.
The threat landscape has changed.
Has your question changed with it?
In March 2026, TeamPCP proved that detection-first architectures cannot contain attacks that move through trusted code, not around defenses. Today’s threat actors don’t break in — they log in, blend in, and expand silently. This command center tracks the evolving threat landscape and helps you measure your Blast Radius — the architectural metric that defines resilience in the Containment Era.
This command center tracks 8 active campaigns and measures your Blast Radius: what an attacker can reach once inside your environment.
Contain the Blast Radius
See the attack paths already present in your environment — and where CNSF containment controls would break them.
