7 casos · pág. 1/1
Unit 42 published research showing that an attacker with root access on a compromised Kubernetes node can misuse SPIFFE/SPIRE workload attestation to impersonate co-located workloads and harvest their SVIDs. The attacker spoofs the Linux cgroup information the SPIRE agent uses to identify callers, so the agent issues a victim workload's i…
ConnectWise took several cloud services offline, including Cloud Backup (formerly SkyKick), SaaS Security and Cloud Management, after finding unauthorized access to application identities in the ConnectWise Cloud Backup environment. The company began investigating suspicious activity on October 15 and confirmed the unauthorized access by …
Attackers used compromised application credentials from ConnectWise Cloud Backup (formerly SkyKick) to access Microsoft 365 customer environments. Huntress researcher Jonathan Semon confirmed unauthorized sign-ins across 162 tenants as of 19:00 UTC on October 16. ConnectWise disabled application access, which interrupted backup services, …
ConnectWise disabled seven application identities on October 17, 2026 after unknown threat actors gained unauthorized access to them and used them to compromise Microsoft 365 tenants. The company detected the issue on October 14 and has suspended Cloud Backup, SaaS Security and Cloud Management while it investigates. Huntress observed alm…
ConnectWise suspended its Cloud Backup (formerly SkyKick) service and took SaaS Security and Cloud Management offline after unknown attackers obtained unauthorized access to seven of its application identities. The company detected the incident on October 14, disabled the compromised identities on October 17, and is still investigating ho…
Unit 42 researchers found that in default AWS AgentCore Harness deployments, prompt injection can steer the agent's built-in shell tool to exfiltrate plaintext credentials resolved from AgentCore Identity. The shell tool is enabled by default and runs as root, in the same UID as the harness runtime (PID 1, python3.10 -m loopy.server). Tha…
CISA ran concurrent red team assessments at two organizations: Organization A (Government Services and Facilities) and Organization B (Water and Wastewater Systems). Both reached full domain compromise and accessed sensitive business systems (SBSs) and cloud resources. Organization A did not detect or contain the activity. Organization B …
