Tag
Unauthorized Access to Microsoft 365 Tenants via Compromised ConnectWise Credentials
6 TTPs 1 IOCThreat actors are exploiting a compromised service principal credential belonging to ConnectWise Cloud Backup to gain unauthorized access to 173 Microsoft 365 tenants and potentially escalate privileges.
Storm-3168 Cloud Attack Campaign
1 rule 3 TTPsStorm-3168 (linked to JADEPUFFER) leverages compromised Azure service principals to execute automated resource destruction and credential exfiltration through AI-orchestrated cloud API manipulation.
Cross-Environment Secret Harvesting via Cloud APIs
1 TTPAdversaries are utilizing compromised credentials and stolen session tokens to perform rapid, automated secret harvesting across AWS, GCP, Azure, and Kubernetes environments from singular source IP addresses.
SQL Injection Vulnerability in Budibase MySQL Integration
1 rule 7 TTPsA critical SQL injection vulnerability was discovered in Budibase's MySQL integration (versions <= 3.38.1) that allows remote attackers to execute arbitrary SQL commands through user input fields due to the `multipleStatements: true` configuration, leading to complete database compromise.
Real-World SIM Swap and Near Account Takeover Exploits Identity Verification Failures
5 TTPsAn unspecified attacker conducted a sophisticated SIM swap and identity attack against a personal wireless account by employing social engineering (vishing) to steal an SMS-based One-Time Passcode and account PIN, facilitating session hijacking and unauthorized account modifications like mobile number cancellation, demonstrating critical weaknesses in point-in-time identity verification and the need for continuous risk assessment.