CyberSecurity news

FlagThis - #cloudsecurity

David Jones@cybersecuritydive.com //
The Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning on April 17, 2025, regarding increased breach risks following a potential compromise of legacy Oracle Cloud servers. This alert comes in response to public reporting of alleged threat activity targeting Oracle customers, though the scope and impact of the activity are currently unconfirmed. CISA's guidance urges organizations and individuals to take immediate steps to secure their IT environments amid claims of a large trove of customer credentials being compromised. The agency is also asking organizations to come forward if they detect suspicious activity or other evidence of a compromise.

CISA is particularly concerned about situations where credential material may be exposed, reused across separate and unaffiliated systems, or embedded into applications and tools. Embedded credential material, which can be hardcoded into scripts, applications, infrastructure templates, or automation tools, is especially difficult to detect and can enable long-term unauthorized access if exposed. The compromise of credentials like usernames, emails, passwords, authentication tokens, and encryption keys can pose a significant risk to enterprise environments.

To mitigate these risks, CISA recommends organizations reset passwords for known affected users, especially those not federated through enterprise identity solutions. Additionally, they should review source code, infrastructure as code templates, automation scripts, and configuration files for hardcoded credentials, replacing them with secure authentication methods supported by centralized secret management. Monitoring authentication logs for anomalous activity, particularly using privileged, service, or federated identity accounts, is also crucial. Finally, CISA advises enforcing phishing-resistant multi-factor authentication for all user and administrator accounts whenever possible.

Recommended read:
References :
  • DataBreaches.Net: Sergiu Gatlan reports: On Wednesday, CISA warned of heightened breach risks after the compromise of legacy Oracle Cloud servers earlier this year and highlighted the significant threat to enterprise networks. CISA said, “the nature of the reported activity presents potential risk to organizations and individuals, particularly where credential material may be exposed, reused across separate,...
  • BleepingComputer: On Wednesday, CISA warned of heightened breach risks after the compromise of legacy Oracle Cloud servers earlier this year and highlighted the significant threat to enterprise networks.
  • www.cybersecuritydive.com: The agency is asking organizations to come forward if they detect suspicious activity or other evidence of a compromise.
  • MSSP feed for Latest: Legacy Oracle cloud breach poses credential exposure risk
  • hackread.com: Following reports of unauthorized access to a legacy Oracle cloud environment, CISA warns of potential credential compromise leading…
  • www.scworld.com: Secure legacy Oracle cloud credentials amid leak reports, CISA warns
  • www.itpro.com: CISA issues warning in wake of Oracle cloud credentials leak
  • securityonline.info: CISA Warns of Credential Risks Tied to Oracle Cloud Breach
  • The Register - Security: Oracle hopes talk of cloud data theft dies off. CISA just resurrected it for Easter
  • securityonline.info: CISA Warns of Credential Risks Tied to Oracle Cloud Breach
  • The DefendOps Diaries: Understanding the Oracle Cloud Breach: CISA's Guidance and Recommendations
  • ciso2ciso.com: CISA Urges Action on Potential Oracle Cloud Credential Compromise
  • ciso2ciso.com: Following reports of unauthorized access to a legacy Oracle cloud environment, CISA warns of potential credential compromise leading to phishing, network breaches, and data theft.

Dissent@DataBreaches.Net //
Oracle has confirmed a cloud data breach, issuing notifications to customers about a cybersecurity incident. The confirmation follows claims by a threat actor alleging possession of millions of data lines related to over 140,000 Oracle Cloud tenants, including sensitive Personally Identifiable Information (PII), along with corporate and financial data. The company states the breach involved what it described as "two obsolete servers," and maintains that its Oracle Cloud Infrastructure (OCI) was not compromised, and no OCI customer data was viewed or stolen. However, this incident has brought into question Oracle's communication strategy and the accuracy of its disclosures.

The company's initial response has sparked debate and criticism, with cybersecurity experts and customers expressing concern over potential inconsistencies in Oracle's narrative. While Oracle claims the issue stemmed from "obsolete servers," independent analyses and customer confirmations suggest that customer data may have been compromised, contradicting the company's initial denial of an OCI breach. The discrepancy between Oracle's statements and the emerging evidence has raised questions about transparency and the potential use of carefully chosen terminology to minimize the perceived impact of the incident.

The communication strategy has drawn specific criticism regarding Oracle's distinction between "Oracle Cloud" and "Oracle Cloud Classic." Experts, like Kevin Beaumont, have pointed out that this distinction allows Oracle to deny a breach of "Oracle Cloud" while acknowledging issues with "Oracle Classic," which is still part of Oracle's cloud services. This approach raises concerns about potential wordplay and its effects on customer trust and Oracle's reputation. The incident highlights the challenges companies face in maintaining transparency and trust during cybersecurity incidents, especially when sensitive customer data is at risk.

Recommended read:
References :
  • DataBreaches.Net: Oracle’s statement to customers is still raising questions about its disclosure and transparency
  • The DefendOps Diaries: Explore Oracle's security incident, its communication strategy, and the implications for customer trust and industry standards.
  • securityaffairs.com: Oracle confirms a cloud data breach, quietly informing customers while downplaying the impact of the security breach.
  • BleepingComputer: Oracle finally confirmed in email notifications sent to customers that a hacker stole and leaked credentials that were stolen from what it described as "two obsolete servers."
  • The Register - Security: Oracle says its cloud was in fact compromised
  • securityonline.info: Oracle Data Breach: Authenticity Confirmed Despite Denial
  • Cyber Security News: CyberPress on Oracle Confirms Breach
  • cyberinsider.com: Oracle Sends “Not a Breach†Notices to Customers Following Data Exposure
  • phishingtackle.com: Oracle Confirms Cloud Data Breach, Privately Alerts Affected Customers
  • Techzine Global: Oracle confirms data breach via outdated servers, denies cloud breach
  • The Register - Security: The Reg translates the letter in which Oracle kinda-sorta tells customers it was pwned
  • Phishing Tackle: Oracle Confirms Cloud Data Breach, Privately Alerts Affected Customers
  • securityonline.info: At the end of March, a hacker claimed to have breached Oracle’s cloud infrastructure, allegedly exfiltrating approximately six million records. These reportedly included sensitive materials such as Oracle Cloud customer security keys, encrypted credentials, and LDAP authentication data. The threat actor even published a sample of the data as proof. Oracle promptly denied the breach, […] The post appeared first on .
  • CyberInsider: Cybersecurity Insiders article about Oracle's sends the data exposure notices to customers
  • www.csoonline.com: Oracle admits breach of ‘obsolete servers,’ denies main cloud platform affected

Aman Mishra@gbhackers.com //
A cyber threat group known as JavaGhost has been exploiting misconfigured Amazon Web Services (AWS) Identity and Access Management (IAM) permissions to conduct sophisticated phishing campaigns. Palo Alto Networks Unit 42 is tracking this group, known as TGR-UNK-0011, which overlaps with JavaGhost. Since 2022, JavaGhost pivoted from website defacement to cloud-based phishing attacks, targeting unsuspecting targets for financial gain.

The group exploits leaked long-term AWS access keys to gain initial access, then misuses AWS services like Simple Email Service (SES) and WorkMail to send phishing emails, bypassing typical email protections. They create new SMTP credentials and IAM users, some for active attacks and others for long-term persistence, even leaving the same calling card in the middle of their activities.

JavaGhost's tactics include generating temporary credentials and utilizing advanced evasion techniques to obfuscate their identities in CloudTrail logs, a tactic historically used by Scattered Spider. The attackers create IAM roles with trust policies, allowing access from attacker-controlled AWS accounts, and attempt to enable all AWS regions to potentially evade security controls. These activities leave detectable events in CloudTrail logs, providing opportunities for threat detection and response for vigilant organizations.

Recommended read:
References :
  • The Hacker News: Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail
  • gbhackers.com: JavaGhost: Exploiting Amazon IAM Permissions for Phishing Attacks
  • Talkback Resources: JavaGhost: Exploiting Amazon IAM Permissions for Phishing Attacks
  • Talkback Resources: Hackers Exploit AWS Misconfigurations to Launch Phishing Attacks via SES and WorkMail [cloud]
  • Cyber Security News: JavaGhost Exploits Amazon IAM Permissions for Phishing Attacks

@www.networkworld.com //
Versa Networks has launched its Sovereign SASE platform, presenting a new option for enterprises and service providers seeking greater control over their network security. This solution allows organizations to deploy a SASE platform within their own on-premises or private cloud environments, moving away from the traditional cloud-only security model. Versa's Sovereign SASE is designed to run entirely on customer-controlled infrastructure, offering a "do-it-yourself" model for customized networking and security services.

Increased privacy and control, reduced risk of service disruption, and eased regulatory compliance are key benefits. The platform enables organizations to build and manage their SASE environment on their own infrastructure, ensuring greater autonomy and data protection. By eliminating reliance on third-party SaaS platforms, Versa Sovereign SASE reduces operational risks and costs tied to unplanned outages, strengthening business continuity. The "air-gapped" infrastructure also simplifies meeting strict requirements for regulatory compliance, data residency, and security.

Recommended read:
References :
  • @VMblog: Versa Redefines SASE with Industry-First Sovereign SASE for Enterprises and Service Providers
  • Help Net Security: Versa Sovereign SASE enables organizations to create self-protecting networks
  • : Versa Networks launches sovereign SASE, challenging cloud-only security model
  • www.helpnetsecurity.com: Versa releases Versa Sovereign SASE, allowing enterprises, governments, and service providers to deploy customized networking and security services directly from their own infrastructure in a “do-it-yourself†model.

@csoonline.com //
Cybersecurity researchers have uncovered a new "whoAMI" attack that exploits name confusion in Amazon Machine Images (AMIs) to achieve remote code execution within Amazon Web Services (AWS) accounts. The attack allows anyone publishing an AMI with a specific, crafted name to potentially gain access and execute malicious code. The vulnerability stems from misconfigured software that can be tricked into using a malicious AMI instead of a legitimate one when creating Elastic Compute Cloud (EC2) instances.

Researchers found that the attack vector requires specific conditions to be met when retrieving AMI IDs through the API, including the use of the name filter and a failure to specify the owner. An attacker can create a malicious AMI with a matching name, leading to the creation of an EC2 instance using the attacker's doppelgänger AMI. Amazon addressed the issue following a responsible disclosure in September 2024, introducing new security controls and HashiCorp Terraform implemented warnings to prevent misuse of the API.

Recommended read:
References :
  • Talkback Resources: Cybersecurity researchers disclosed the whoAMI attack, enabling attackers to execute code within AWS accounts by tricking misconfigured software into using a malicious AMI with a specific name, prompting AWS to introduce new security controls and HashiCorp Terraform to implement warnings.
  • The Hacker News: New “whoAMIâ€� Attack Exploits AWS AMI Name Confusion for Remote Code Execution
  • www.bleepingcomputer.com: Security researchers discovered a name confusion attack that allows access to an Amazon Web Services account to anyone that publishes an Amazon Machine Image (AMI) with a specific name.
  • www.csoonline.com: whoAMI name confusion attacks can expose AWS accounts to malicious code execution
  • BleepingComputer: Security researchers discovered a name confusion attack that allows access to an Amazon Web Services account to anyone that publishes an Amazon Machine Image (AMI) with a specific name.
  • aws.amazon.com: AWS blog post on the fix.
  • securitylabs.datadoghq.com: Datadog Security Labs report detailing the whoAMI attack.
  • securityaffairs.com: whoAMI attack could allow remote code execution within AWS account
  • Security Affairs: whoAMI attack could allow remote code execution within AWS account

@www.helpnetsecurity.com //
Palo Alto Networks has unveiled Cortex Cloud, a unified platform integrating its cloud detection and response (CDR) and cloud-native application protection platform (CNAPP) capabilities. Cortex Cloud merges Prisma Cloud with Cortex CDR to deliver real-time cloud security, addressing the growing risks in cloud environments. The platform uses AI-driven insights to reduce risks and prevent threats, providing continuous protection from code to cloud to SOC.

Cortex Cloud aims to solve the disconnect between cloud and enterprise security teams, which often operate in silos. With Cortex Cloud, security teams gain a context-driven defense that delivers real-time cloud security. Palo Alto Networks will include CNAPP at no additional cost for every Cortex Cloud Runtime Security customer.

Recommended read:
References :
  • www.helpnetsecurity.com: Palo Alto Networks Cortex Cloud applies AI-driven insights to reduce risk and prevent threats
  • www.paloaltonetworks.com: Introducing Cortex Cloud — The Future of Real-Time Cloud Security
  • www.prnewswire.com: "we're including CNAPP at no additional cost for every Cortex Cloud Runtime Security customer."
  • securityboulevard.com: Palo Alto Networks today launched its Cortex Cloud platform to integrate the company’s cloud-native application protection platform (CNAPP) known as Prisma Cloud into a platform that provides a wider range of cloud security capabilities.

Jessica Lyons@theregister.com //
Researchers at watchTowr Labs have uncovered a significant security flaw involving abandoned Amazon Web Services (AWS) S3 buckets, potentially allowing attackers to compromise the software supply chain. The analysis revealed that nearly 150 S3 buckets previously used by various organizations, including cybersecurity firms, governments, Fortune 500 companies, and open source projects, could be re-registered. This re-registration could enable attackers to inject malicious code or executables into deployment processes and software update mechanisms.

Over a two-month period, these abandoned buckets received over eight million HTTPS requests for various files, including software updates and other binary artifacts. The requests originated from a wide range of sources, including government networks in multiple countries, military networks, Fortune 100 and 500 companies, and even cybersecurity companies. This vulnerability could allow threat actors to deliver malware or backdoors to these organizations, leading to widespread security breaches. AWS has since blocked the specific buckets identified by watchTowr to prevent their re-creation and potential misuse.

Recommended read:
References :
  • The Register - Security: Abandoned AWS S3 buckets can be reused in supply-chain attacks that would make SolarWinds look 'insignificant'
  • : watchTowr : Abandoned AWS S3 buckets could be reused to conduct supply chain attacks.
  • go.theregister.com: Abandoned AWS S3 buckets can be reused in supply-chain attacks that would make SolarWinds look 'insignificant' When cloud customers don't clean up after themselves, part 97 Abandoned AWS S3 buckets could be reused to hijack the global software supply chain in an attack that would make Russia's "SolarWinds adventures look amateurish and insignificant," watchTowr Labs security researchers have claim…
  • www.theregister.com: watchTowr : Abandoned AWS S3 buckets could be reused to conduct supply chain attacks.
  • labs.watchtowr.com: WatchTowr Labs research details 8 million requests against AWS S3 buckets.
  • www.csoonline.com: Code references to nonexistent cloud assets continue to pose significant security risks, and the problem is only growing. Recent research identified approximately 150 AWS S3 storage buckets once used by various software projects to host sensitive scripts, configuration files, software updates, and other binary artifacts that were automatically downloaded and executed on user machines.
  • www.scworld.com: Nearly 150 S3 buckets previously leveraged by cybersecurity firms, governments, Fortune 500 companies, and open source projects could be re-registered with the same AWS account name to facilitate executable and/or code injections in the deployment code/software update mechanism, according to an analysis from watchTowr Labs researchers.
  • www.securityweek.com: Abandoned Amazon S3 Buckets Enabled Attacks Against Governments, Big Firms
  • BleepingComputer: How attackers abuse S3 Bucket Namesquatting — And How to Stop Them
  • SecurityWeek: Abandoned Amazon S3 Buckets Enabled Attacks Against Governments, Big Firms
  • therecord.media: Researchers warn of risks tied to abandoned cloud storage buckets
  • Jon Greig: Researchers at Watchtowr warned of malicious actors taking over abandoned AWS S3 buckets used by governments, militaries, Fortune 500 companies and even some cybersecurity firms
  • darkreading: Researchers from watchTowr discovered around 150 Amazon Web Services S3 buckets that were formerly used by organizations for software deployment and updates but were then abandoned.

@ciso2ciso.com //
Two ransomware groups, identified as STAC5143 and STAC5777, are actively targeting Microsoft Office 365 users by exploiting default settings and using their own Microsoft 365 tenants. These groups are leveraging the platform's features, like Teams, to initiate contact with internal users under the guise of tech support. This tactic is being used to gain access to victim systems. This concerning activity highlights a significant vulnerability in the default configuration of Microsoft 365 and the need for enhanced security measures.

Sophos researchers have detailed the tactics used by both groups. STAC5143 uses Teams’ remote control capabilities and deploys Java-based tools to exploit systems, extracting Python backdoors via SharePoint links. Meanwhile, STAC5777 uses Microsoft Quick Assist and manual configuration changes to install malware, steal credentials, and discover network resources. Both groups share techniques with other known threat actors, like Storm-1811 and FIN7. These attacks often start with spam email bombing, sometimes sending 3,000 emails in an hour, followed by Teams calls requesting screen control for malicious purposes, highlighting a multi-pronged social engineering approach.

Recommended read:
References :
  • ciso2ciso.com: Sophos MDR tracks two ransomware campaigns using "email bombing," Microsoft Teams "vishing."
  • ciso2ciso.com: Two ransomware groups abusing Microsoft's Office 365 platform
  • ciso2ciso.com: Details about the attacks and the tactics being used.
  • securityonline.info: STAC5143 and STAC5777: New Ransomware Campaigns Target Microsoft Office 365 Users
  • ciso2ciso.com: Two ransomware groups abuse Microsoft’s Office 365 platform to gain access to target organizations
  • securityaffairs.com: Two ransomware groups abuse Microsoft’s Office 365 platform to gain access to target organizations
  • securityonline.info: STAC5143 and STAC5777: New Ransomware Campaigns Target Microsoft Office 365 Users