AVIVORE – Hunting Global Aerospace through the Supply Chain

Context Information Security documents the AVIVORE campaign: a likely nation-state actor (operators correlated to UTC+8) conducting long-term supply-chain espionage against aerospace, defence and related sectors by compromising suppliers and leveraging VPN/Tor infrastructure, credential theft, living-off-the-land techniques and PlugX implants; the report details intrusion patterns, infrastructure, persistence since 2015, and provides mitigations such as restricting supplier VPN access, enforcing MFA and enhanced logging.