Latest cybersecurity reporting from selected sources.

Storm-2949 turned stolen credentials into a cloud-wide breach, moving from identity compromise to large-scale data theft without using malware. This incident shows how threat actors can exploit trusted systems to operate undetected. The post How Storm-2949 turned a compromised identity into a cloud-wide breach appeared first on Microsoft Security Blog.

Cloud app developer Vercel appears to have suffered a security breach

A threat actor known as UNC6426 leveraged keys stolen following the supply chain compromise of the nx npm package last year to completely breach a victim's cloud environment within a span of 72 hours

Threat actors are exploiting misconfigured web applications used for security training and internal penetration testing, such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP, to gain access to cloud environments of Fortune 500 companies and security vendors. [...]

Today, every unpatched system, leaked password, and overlooked plugin is a doorway for attackers. Supply chains stretch deep into the code we trust, and malware hides not just in shady apps — but in job offers, hardware, and cloud services we rely on every day

A large-scale extortion campaign has compromised various organizations by taking advantage of publicly accessible environment variable files (.env) that contain credentials associated with cloud and social media applications

The threat actors linked to Kinsing have been observed attempting to exploit the recently disclosed Linux privilege escalation flaw called Looney Tunables as part of a "new experimental campaign" designed to breach cloud environments

Cloud services provider Rackspace on Thursday confirmed that the ransomware gang known as Play was responsible for last month's breach

Chinese hackers used a zero-day exploit for a critical-severity vulnerability in Sophos Firewall to compromise a company and breach cloud-hosted web servers operated by the victim. [...]

Our Vectra Masked CISO series tackles some of the biggest issues in security and how to overcome them Advertorial Security must be tried, tested, and tested again. It’s become easier than ever for cybercriminals to find stealthy new ways to gain access to and navigate laterally across systems, exploit gaps in hybrid workflows, or hijack cloud accounts to gain access to a target. It is vital that every CISO can offer a clear picture of how their security is really holding up against the latest tactics, techniques, and procedures. However, all too often I’ve seen my fellow CISOs fall into a cycle of preparing annual penetration tests of point systems to be “compliant,” which in fact only makes them sitting ducks just waiting for a breach to occur.…