ConnectWise Backup Credential Opens Graph Access in 162 Tenants
An abused vendor-held Cloud Backup credential obtained app-only Graph tokens. Find the service principal, disable sign-in, then inspect roles and added secrets.
Read article →cloud
Cloud platforms, SaaS, containers, and infrastructure.
Latest in cloud
Komodo Log Access Lets Restricted Users Run Commands on Managed Hosts
Komodo Periphery passes some restricted-user requests to a shell on managed servers. Upgrade agents to 2.3.0 and review Logs and Execute grants.
Read article →
Lowcoder Flaw Lets One Tenant Run Another Tenant's Saved Queries
An admin or developer in one organization can reach another's Query Library on a shared instance. Restrict the affected API while a security update is pending.
Read article →
YAM Store sells Microsoft and Google cloud access to phishing crews
Microsoft traces a broker reselling cloud tenant access and storage to phishing kits. Examine app credentials, privileged grants and hosted files in affected tenants.
Read article →
Palo Alto Networks traces blockchain C2 through poisoned dependencies
Unit 42 maps contract reads, transaction data and zero-value transfers used by poisoned packages. Correlate runner processes with blockchain traffic and restrict unneeded egress.
Read article →
Microsoft Power BI phishing plants two rogue ScreenConnect clients
A Power BI report link sent targets to a fingerprinting page and a delayed installer. Hunt for both remote clients and the recurring repair task.
Read article →
Microsoft Brings Sensitive AI Upload Blocking to Entra Networks
Purview classifies files and text while Entra enforces network policy for employee and on-behalf-of agent traffic. Confirm forwarding and an active blocking rule before relying on it.
Read article →
IBM Turbonomic Operator Grants Cluster-Wide Access to Secrets
Prometurbo's service account could read secrets outside its own namespace. Reinstall the fixed agent and test the operator's effective permissions.
Read article →
Storm-3068 Steals Kubernetes Credentials via Microsoft Azure DevOps
After a password reset, Storm-3068 used an authorized Azure DevOps pipeline to collect Kubernetes credentials. Trace pipeline changes and restrict resource access.
Read article →
Antino Backdoor Uses Microsoft 365 for Espionage Tasking
Talos traces a phishing-to-Windows backdoor chain affecting Asian institutions. Hunt the script host and sideloaded DLL, then restrict script execution.
Read article →
AWS Quarantines an Exposed IAM Key While CloudTrail Names the User
A public-key exposure test reached AWS quarantine in 10 seconds. Alert on the IAM policy attachment, then investigate the key and follow the Support case.
Read article →
Mandiant Details How Shared CI Caches Expose Release Builds
A pull request can plant dependencies in a shared build cache for a privileged release job. Separate cache writes by branch privilege and constrain publishing identities.
Read article →
Storm-3168 Deletes Azure Storage Accounts With Stolen Service Principals
Two compromised service principals drove a rapid Azure deletion campaign. Trace their ARM operations, rotate exposed secrets and verify recovery-resource locks.
Read article →Showing 1–13 of 38