Cloud Threat Landscape

Incidents
Actors
Techniques
Defenses
ABC Poster
Periodic Table
Tools
Targeted Technologies
About
RSS
STIX
Back to wiz.io

Cloud Threat Landscape

❓

Unknown

Tags

Attribution

Unknown

Incidents

Jupyter Notebook cred harvesting campaign Redirection Roulette LastPass & GoTo incident Fast Company incident Optus incident GitHub & npm incident Imperva incident ESXiArgs ransomware campaign RBAC Buster Behind the scenes in the Expel SOC: Alert-to-fix in AWS Large-scale cryptomining attack against K8s clusters detected by Azure From CLI to console, chasing an attacker in AWS Spotting an attacker in GCP Poisoned image to K8s to cloud SIM-Swap to Data Leak on Dark Web Misconfigured firewall to cryptojacking botnet SugarCRM as initial access to AWS envs Use of linPEAS for cloud enumeration From PHP exploitation to AWS lateral movement Rollbar hack Retool hack Cloud tools imitation campaign Qubitstrike Crypto Mining and Rootkit Campaign Apache server Cryptojacking with Cobalt Strike Denonia campaign OracleIV campaign Sumologic incident Tsunami targeting Jenkins and Weblogic EleKtra-Leak IceFire Aspera Faspex campaign SQL Server to cloud lateral movement First Republic Bank incident Cloud lateral movement via Citrix cookie Codecov incident Apache app cryptojacking campaign FBot toolkit targets cloud environments From PHP vuln to Sliver execution via cron From web app exploitation to Chisel tunneling From WSO2 RCE to SSH lateral movement Evil_MinIO campaign Leaked long-lived AWS creds 9hits Docker campaign AndroxGh0st usage (2024)From ActiveMQ to Godzilla webshell RE#TURGENCE MSSQL Server RansomOp DangerDev SES abuse incident S3 data exfiltration ECS Fargate cryptojacking Okta support system supply chain attack Cloudflare incident following Okta breach New Relic incident (November 2023)Webmin supply chain attack (2018)SSH-Snake Confluence targeting campaign S3 ransomware scam CGI Federal incident LINE and NAVER Cloud incident Cetus campaign Graboid campaign C3Pool mining via Confluence vulnerability Sliver deployment via Confluence vulnerability From social engineering to cryptocurrency theft Redis, Hadoop, and Docker exploitation Meson Network cryptojacking campaign ngrok cryptojacking campaign Gin Docker cryptojacking campaign Widespread TeamCity exploitation (March ‘24)Okta source code theft Auth0 source code theft XZ Utils backdoor incident Sisense breach K8s targeted via OpenMetadata exploitation Delinea breach Cryptojacking via Azure Batch Mirai campaign targeting Ivanti products LLMjacking via Laravel exploitation Dero cryptojacking targeting K8s From SSH bruteforce to cryptojacking AlienFox campaign JavaScript injection via vulnerable CMS JavaScript injection via WordPress exploitation GitHub certificate theft incident Dropbox breach Viamedis incident Almerys incident S3 RansomOp following long-term key exposure Abusing management tooling for cloud access Personal local drive to AWS ransomware Third party to cloud compromise Smishing into Entra onto VMWare ransomware From password reset to data exfiltration Compromise of Top.gg repo Scylla LLMJacking campaign DERO cryptojacking campaign (2024)Dama webshell deployment via ThinkPHP exploitation Club Penguin data theft via Confluence NYT source code theft SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining Misconfigured Jenkins Servers Used for Cryptomining Panamorfi campaign Msupedge Backdoor Targeting Taiwanese University Godzilla Backdoor Exploiting Confluence Vulnerability Extortion Campaign Exploiting Exposed Environment Variable Hadooken Malware Targeting Weblogic Servers Campaign targeting Selenium Grid for cryptomining Fortinet Sharepoint data leak Confluence exploited for cryptojacking GitHub PAT leakage leading to RDS Database exfiltration Docker Swarm and K8s cryptojacking campaign perfctl Malware Targeting Linux Rackspace incident (2024)Veeam Vulnerability Exploited by Akira and Fog Ransomware perfctl campaign targeting Docker API kernel.org supply chain attack Cdorked campaign Supply Chain Attack on lottie-player BrowserStack Data Breach Drizly data breach The Los Angeles Times Cryptomining Attack SharePoint Vulnerability Exploited in-the-Wild RCE Vulnerability in PAN-OS Exploited in-the-Wild Sports Piracy Exploiting Misconfigured Jupyter Servers Ultralytics compromise State-Sponsored APT Abuse Visual Studio Code in Attacks Attack abusing Amazon SES Byte Federal Data Breach via Gitlab Vulnerability RCE Vulnerability in Apache Struts Targeted by Attackers Mauri Ransomware Exploiting Apache ActiveMQ US Treasury breach via BeyondTrust supply chain attack Phishing campaign leading to Azure account takeover Volkswagen data leak through Spring Boot Actuator misconfiguration ZAGG customer data compromised via hijacked FreshClicks BigCommerce app Exploitation in the wild of Aviatrix Controller RCE Gravy Analytics data breach Campaign targeting exposed FortiGate firewall management interfaces Kong image compromise Otelier data breach MasterCard Fixes Five-Year-Old DNS Typo Misconfiguration USAID cryptojacking incident DogWifTool supply chain attack From social engineering to Lambda modification Malicious AI Models Bypass Picklescan Detection Code Injection Attacks Exploiting Publicly Disclosed ASP.NET Keys Ivanti supply chain attack via compromised library Krpano XSS exploitation campaign Zapier data breach PREMINT hack PHP-CGI Vulnerability Exploited in Attacks Targeting Japan Exposed Jupyter Notebooks Targeted for Cryptomining tj-actions/changed-files supply chain attack Operation LongFang Critical Ivanti Connect Secure Vulnerability Exploited by China-linked Actor Europecar Gitlab Breach Long-Term Email Breach at OCC Exposes Sensitive Bank Oversight Data AWS Breach at a SaaS Company Multi-Layered Cryptojacking via Docker Grafana GitHub Action attempted supply chain attack SAP NetWeaver Visual Composer exploitation campaign Compromised cloud keys exfiltrated to bucket ComfyUI exploitation campaign Oracle Cloud Potential Supply Chain Breach Larva-25003: IIS Native Module Malware Used in Targeted Web Server Attacks Game Freak data leak From stolen cloud key to persistence-as-a-service Supply Chain Compromise of rand-user-agent: Obfuscated RAT with C2 Communication and File Exfiltration Solana web3.js Supply Chain Attack Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild RedisRaider Linux Cryptojacking Campaign Targets Redis Servers Coordinated One-Day Cloud Scanning Operation Targets 75 Exposure Points Open WebUI Misconfiguration Exploited for Cryptojacking NPM Supply Chain Attack Compromises 16 Popular React Native and GlueStack Packages TeamFiltration Account Takeover Campaign Langflow Vulnerability Exploited to Deliver Flodrix Botnet JSFireTruck: Malicious JavaScript Campaign Using Obfuscation

Last edited

Jan 18, 2024 1:25 PM

Status

Stub

Cloud-fluent

Unique Tools

Mimic ransomware

Made with 💙 by Wiz

Last Updated: April 3, 2025

	
		OSZAR »