Do Son Hackers are weaponizing AWS termination protection to lock defenders out while they mine crypto on hijacked ECS/EC2 resources using a malicious Docker image.
Cloud Security
Salesforce revoked all Gainsight app tokens and removed the app from the AppExchange after finding unusual activity that may have exposed customer data via the connection.
Trend Research warns that ransomware is shifting to AWS S3, exploiting misconfigured IAM and SSE-C keys in five attack variants to cause irreversible data loss and cloud-native extortion.
Google launched Private AI Compute, a new platform that combines Gemini's cloud power with hardware-protected security (TIE) to offer advanced on-device AI for Pixel 10 while guaranteeing data privacy.
A Critical flaw (CVE-2025-11919) in Wolfram Cloud allows RCE and privilege escalation. Attackers exploit a race condition in the shared /tmp/ directory to inject code into other tenants' JVMs.
HashiCorp patched two flaws in Vault: CVE-2025-11621 allows AWS Auth Bypass via IAM role collision, and CVE-2025-12044 allows unauthenticated JSON DoS attack.
Unit 42 exposed Jingle Thief, a Morocco-linked group exploiting Microsoft 365 credentials via phishing. They maintain 10-month access to issue fraudulent gift cards worth hundreds of thousands of dollars.
MinIO patched a privilege escalation flaw (CVE-2025-62506) where restricted service accounts could bypass session policies during account creation to gain full parent privileges.
Rapid7 identified the Crimson Collective using TruffleHog to find leaked AWS IAM keys. The group achieves Admin access to steal data from RDS/S3 and extort victims.
A new DDoS-as-a-service botnet, ShadowV2, uses GitHub CodeSpaces and Docker to mimic legitimate cloud apps, bypassing traditional defenses and enabling powerful attacks.
A major breach at Salesloft's Drift platform exposed customer authentication tokens, leading to unauthorized access of Salesforce data at over 750 companies.
Microsoft will begin enforcing mandatory MFA for all Azure resource management operations starting October 1, 2025, to enhance cloud security.
A new report reveals how a compromised AWS key was used to bypass security controls in Amazon SES, enabling a 50,000-email-per-day phishing campaign.
A new report reveals a dangerous misconfiguration: exposed appsettings.json files can contain Azure AD credentials, giving attackers full access to a company's cloud kingdom.
A new Microsoft report reveals that the Storm-0501 threat actor is pivoting to cloud-native ransomware, using cloud tools to exfiltrate and destroy data without malware.
A severe misconfiguration in Tencent Cloud exposed sensitive internal credentials and source code to the public internet for months, risking a major breach.
A Red Canary report reveals attackers are exploiting an Apache ActiveMQ flaw to breach Linux systems, then patching the vulnerability to hide their presence.
Proofpoint reveals an AiTM phishing campaign using fake OAuth apps and the Tycoon platform to bypass MFA, hijack Microsoft 365 accounts, and steal credentials.
Wiz Research uncovers Soco404, an evolving cryptojacking operation exploiting cloud misconfigurations and PostgreSQL to stealthily mine cryptocurrency across Linux and Windows.
A critical unauthenticated SSRF vulnerability (CVE-2025-54122, CVSS 10.0) in Manager.io's accounting software allows bypassing network isolation and exfiltrating sensitive data from cloud environments.
Unit 42 uncovers HazyBeacon, a novel backdoor using AWS Lambda URLs for stealthy C2. It's deployed via DLL sideloading, targeting Southeast Asian govts for trade documents.
SCATTERED SPIDER targets U.S. airlines with ransomware, vishing, and VMware exploits—CrowdStrike warns of a rising threat across cloud identities.