Tag: cloud
-
Attacks leveraging Ivanti EPMM flaws in clouds underway
First seen on scworld.com Jump to article: www.scworld.com/brief/attacks-leveraging-ivanti-epmm-flaws-in-clouds-underway
-
Google Cloud Marketplace Introduces New Revenue Models and Incentives to Boost Partner Growth
First seen on scworld.com Jump to article: www.scworld.com/news/google-cloud-marketplace-introduces-new-revenue-models-and-incentives-to-boost-partner-growth
-
Hybrid-Cloud: KI zwingt deutsche Unternehmen Abstriche bei der Sicherheit zu machen
First seen on datensicherheit.de Jump to article: www.datensicherheit.de/hybrid-cloud-ki-sicherheit-studie-2025
-
Flaw in Google Cloud Functions Sparks Broader Security Concerns
Patched privilege escalation flaw in Google Cloud Platform linked to wider cloud security concerns First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/flaw-google-cloud-security-concerns/
-
Cybercriminals Could Leverage Google Cloud Platform for Malicious Activities
A Research by Tenable and Cisco Talos has shed light on a critical vulnerability in Google Cloud Platform’s (GCP) Cloud Functions and Cloud Build services, revealing a potential attack vector for cybercriminals. According to Tenable, the default Cloud Build Service Account (SA) previously granted excessive permissions during the deployment of Cloud Functions, a serverless compute…
-
Hazy Hawk Targets DNS Vulnerabilities to Hijack Cloud Resources and Spread Malware
The threat actor gained attention in February 2025 after successfully hijacking a subdomain of the U.S. Centers for Disease Control and Prevention (CDC). Sophisticated threat actor dubbed >>Hazy Hawk
-
Threat intelligence platform buyer’s guide: Top vendors, selection advice
Tags: ai, attack, automation, breach, cloud, computing, credentials, crowdstrike, cyber, cybersecurity, dark-web, data, data-breach, deep-fake, detection, dns, edr, email, endpoint, exploit, finance, firewall, fraud, gartner, google, group, guide, identity, incident response, infrastructure, intelligence, kubernetes, law, malicious, malware, microsoft, mitigation, monitoring, network, open-source, phishing, privacy, risk, service, siem, soar, soc, sophos, sql, supply-chain, technology, threat, tool, vpn, vulnerability, zero-dayThe Cybersecurity and Infrastructure Security Agency (CISA) found that since 2023 the majority of exploits were zero days, meaning exploiting heretofore unknown methods. And according to the latest Verizon Data Breach Investigations report (DBIR), the percentage of AI-assisted malicious emails doubled to 10% of the totals they observed over the past two years, making staying…
-
Poor DNS hygiene is leading to domain hijacking
Tags: attack, authentication, ciso, cloud, control, credentials, detection, dns, email, exploit, incident response, intelligence, threat, toolDNS hijacking comes in many forms: DNS hijacking comes in many forms. In 2019, CSO inteviewed Paul Vixie, a DNS system contributor, about the need to strengthen security. We later wrote about the problem of abandoned domain names. And things haven’t changed a lot since then. Most CISOs may be familiar with typosquatting, where “firm.com”…
-
Critical VMware ESXi vCenter Flaw Allows Remote Execution of Arbitrary Commands
VMware by Broadcom has released critical security updates to address multiple severe vulnerabilities affecting its virtualization products, with evidence suggesting active exploitation in the wild. The vulnerabilities, tracked as CVE-2025-22224, CVE-2025-22225, and CVE-2025-22226, affect VMware ESXi, Workstation, Fusion, Cloud Foundation, and Telco Cloud Platform products. With CVSS scores ranging from 7.1 to 9.3, these flaws…
-
Falsche Verarbeitung übergroßer Anfragen – Gefährliche Sicherheitslücke in der Google Cloud Platform
First seen on security-insider.de Jump to article: www.security-insider.de/sicherheitsluecke-google-cloud-schadcode-einschleusung-a-29bcaa4f0619aa77620fb7700e11c652/
-
Attack Surface Reduction for Enterprises: A Guide
Today’s enterprises have embraced digital evolution. Business deals are conducted in online spaces, contracts are signed with a keyboard, data is held in physical servers and the cloud, and client… First seen on securityboulevard.com Jump to article: securityboulevard.com/2025/05/attack-surface-reduction-for-enterprises-a-guide/
-
Poor DNS hygiene is leading to domain hijacking: Report
Tags: attack, authentication, ciso, cloud, control, credentials, detection, dns, email, exploit, incident response, intelligence, threat, toolDNS hijacking comes in many forms: DNS hijacking comes in many forms. In 2019, CSO inteviewed Paul Vixie, a DNS system contributor, about the need to strengthen security. We later wrote about the problem of abandoned domain names. And things haven’t changed a lot since then. Most CISOs may be familiar with typosquatting, where “firm.com”…
-
‘Ongoing’ Ivanti hijack bug exploitation reaches clouds
Nothing like insecure code in security suites First seen on theregister.com Jump to article: www.theregister.com/2025/05/21/ivanti_rce_attacks_ongoing/
-
European customers report Oracle Cloud identity outage, Big Red is silent
DownDetector reported problems for about 6 hours First seen on theregister.com Jump to article: www.theregister.com/2025/05/19/oci_outage_europe/
-
Free to Choose the Right Security for Your Cloud
Is Choosing Cloud Security a Complex Task? From financial services and healthcare to DevOps and SOC teams, businesses across sectors are grappling with the complexity of managing Non-Human Identities (NHIs). NHIs, essentially machine identities, are a critical component of an organization’s cybersecurity. They play a pivotal role in reducing threats by securing both the machine……
-
Orca snaps up Opus to advance automated cloud security
Tags: cloudFirst seen on scworld.com Jump to article: www.scworld.com/brief/orca-snaps-up-opus-to-advance-automated-cloud-security
-
Google Cloud offers real-time cyber risk insights
First seen on scworld.com Jump to article: www.scworld.com/brief/google-cloud-offers-real-time-cyber-risk-insights
-
Let’s Talk About SaaS Risk Again”¦ This Time, Louder.
By Kevin Hanes, CEO of Reveal Security A few weeks ago, I shared a thought that sparked a lot of discussion: SaaS is not a black box we can ignore. It’s a rich, dynamic attack surface and one that attackers are increasingly targeting. That urgency was echoed powerfully in JPMorgan CISO Patrick Opet’s open letter…
-
Cisco Hires Former Google Cloud Exec As New Security GM
Cisco has hired former Google Cloud executive Peter Bailey as the new senior vice president and general manager of its security business, executives disclosed Tuesday. First seen on crn.com Jump to article: www.crn.com/news/security/2025/cisco-hires-former-google-cloud-exec-as-new-security-gm
-
Hazy Hawk Exploits DNS Records to Hijack CDC, Corporate Domains for Malware Delivery
A threat actor known as Hazy Hawk has been observed hijacking abandoned cloud resources of high-profile organizations, including Amazon S3 buckets and Microsoft Azure endpoints, by leveraging misconfigurations in the Domain Name System (DNS) records.The hijacked domains are then used to host URLs that direct users to scams and malware via traffic distribution systems (TDSes),…
-
Hazy Hawk gang exploits DNS misconfigs to hijack trusted domains
A threat actor named ‘Hazy Hawk’ has been using DNS CNAME hijacking to hijack abandoned cloud endpoints of domains belonging to trusted organizations and incorporate them in large-scale scam delivery and traffic distribution systems (TDS). First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hazy-hawk-gang-exploits-dns-misconfigs-to-hijack-trusted-domains/
-
‘Hazy Hawk’ Cybercrime Gang Swoops In for Cloud Resources
Since December 2023, the threat group has preyed on domains belonging to the US Centers for Disease Control and Prevention (CDC) and numerous other reputable organizations worldwide to redirect users to malicious sites. First seen on darkreading.com Jump to article: www.darkreading.com/cloud-security/hazy-hawk-cybercrime-gang-cloud-resources
-
Hazy Hawk Attack Spotted Targeting Abandoned Cloud Assets Since 2023
Infoblox reveals Hazy Hawk, a new threat exploiting abandoned cloud resources (S3, Azure) and DNS gaps since Dec… First seen on hackread.com Jump to article: hackread.com/hazy-hawk-attack-abandoned-cloud-assets-since-2023/
-
Your Data, Your Responsibility: Securing Your Organization’s Future in the Cloud
Tags: access, ai, application-security, attack, best-practice, breach, business, cloud, compliance, control, cyberattack, data, data-breach, dora, encryption, finance, framework, gartner, GDPR, google, ibm, infrastructure, international, mfa, network, PCI, phishing, privacy, regulation, risk, saas, service, strategy, threatYour Data, Your Responsibility: Securing Your Organization’s Future in the Cloud madhav Tue, 05/20/2025 – 04:37 Cloud adoption has fundamentally changed the way businesses operate, offering scalability, agility, and cost efficiencies that were unimaginable just a decade ago. But with this shift comes a necessary conversation: the cloud can also introduce complex security risks without…
-
Google Cloud weitet sein Risk Protection Program (RPP) auf EMEA Märkte aus
Viele Unternehmen empfinden den Versicherungsprozess heute als unzureichend oft spiegeln die gestellten Fragen nicht den tatsächlichen Sicherheitsstatus wider First seen on infopoint-security.de Jump to article: www.infopoint-security.de/google-cloud-weitet-sein-risk-protection-program-rpp-auf-emea-maerkte-aus/a40848/
-
Duping Cloud Functions: An emerging serverless attack vector
Cisco Talos built on Tenable’s discovery of a Google Cloud Platform vulnerability to uncover how attackers could exploit similar techniques across AWS and Azure. First seen on blog.talosintelligence.com Jump to article: blog.talosintelligence.com/duping-cloud-functions-an-emerging-serverless-attack-vector/