The Breach News

Exploring Wing Security’s Multi-Layered SaaS Identity Defense

April 16, 2025
SaaS Security / Identity Management

Introduction: Why Hack When You Can Log In?
SaaS applications are essential for modern organizations, enhancing productivity and operational efficiency. However, each new application introduces significant security risks through integrations and multiple users, creating potential access points for cyber threats. Recent data reveals a troubling rise in SaaS breaches; according to a May 2024 XM Cyber report, identity and credential misconfigurations were responsible for 80% of security exposures. Subtle indicators of compromise often go unnoticed amid the noise, allowing multi-stage attacks to develop undetected due to disconnected security measures. A scenario could unfold where an account takeover in Entra ID leads to privilege escalation in GitHub and data exfiltration from Slack. When examined individually, these incidents appear unrelated, but together they form a perilous breach.

Wing Security’s SaaS platform offers a comprehensive, multi-layered solution that integrates posture management with real-time identity threat detection and response. This empowers organizations to…

Product Walkthrough: Inside the Layered Identity Defense of Wing Security April 16, 2025 SaaS Security / Identity Management As organizations increasingly rely on SaaS applications to enhance productivity and streamline operations, the associated security risks are growing more significant. Each new application can potentially introduce vulnerabilities through integrations and multi-user…

Read More

Exploring Wing Security’s Multi-Layered SaaS Identity Defense

April 16, 2025
SaaS Security / Identity Management

Introduction: Why Hack When You Can Log In?
SaaS applications are essential for modern organizations, enhancing productivity and operational efficiency. However, each new application introduces significant security risks through integrations and multiple users, creating potential access points for cyber threats. Recent data reveals a troubling rise in SaaS breaches; according to a May 2024 XM Cyber report, identity and credential misconfigurations were responsible for 80% of security exposures. Subtle indicators of compromise often go unnoticed amid the noise, allowing multi-stage attacks to develop undetected due to disconnected security measures. A scenario could unfold where an account takeover in Entra ID leads to privilege escalation in GitHub and data exfiltration from Slack. When examined individually, these incidents appear unrelated, but together they form a perilous breach.

Wing Security’s SaaS platform offers a comprehensive, multi-layered solution that integrates posture management with real-time identity threat detection and response. This empowers organizations to…

Navigating the Personal Data Protection Act: Steps to Take in the Event of a Data Breach

KUALA LUMPUR, August 28 — In an era rife with phishing attempts, relentless spam, and the looming threat of scams, safeguarding personal data has become more vital than ever. This necessity underscores the purpose of the Personal Data Protection Act 2010 (PDPA), designed to shield individuals from the misuse of…

Read MoreNavigating the Personal Data Protection Act: Steps to Take in the Event of a Data Breach

Security Flaw in AWS Default IAM Roles Threatens Lateral Movement and Cross-Service Exploitation

Researchers in cybersecurity have identified concerning default identity and access management (IAM) roles within Amazon Web Services (AWS) that could potentially allow attackers to escalate privileges, manipulate other AWS services, and even compromise accounts entirely. According to Aqua researchers Yakir Kadkoda and Ofek Itach, “These roles, typically created automatically or suggested during setup, grant excessively broad permissions, including full access to S3.” They warn that these default roles create silent attack vectors for privilege escalation and cross-service access, leading to possible account breaches. The cloud security firm pinpointed vulnerabilities in default IAM roles established by AWS services such as SageMaker, Glue, EMR, and Lightsail. A similar issue has also been detected in the widely-used open-source framework Ray, which generates a default IAM role (ray-autoscaler-v1) that includes the AmazonS3FullAccess policy.

AWS Default IAM Roles Discovered to Facilitate Lateral Movement and Cross-Service Exploitation May 20, 2025 Cybersecurity researchers have uncovered significant vulnerabilities tied to the default identity and access management (IAM) roles within Amazon Web Services (AWS). These vulnerabilities potentially allow adversaries to escalate privileges, access other AWS services, and in…

Read More

Security Flaw in AWS Default IAM Roles Threatens Lateral Movement and Cross-Service Exploitation

Researchers in cybersecurity have identified concerning default identity and access management (IAM) roles within Amazon Web Services (AWS) that could potentially allow attackers to escalate privileges, manipulate other AWS services, and even compromise accounts entirely. According to Aqua researchers Yakir Kadkoda and Ofek Itach, “These roles, typically created automatically or suggested during setup, grant excessively broad permissions, including full access to S3.” They warn that these default roles create silent attack vectors for privilege escalation and cross-service access, leading to possible account breaches. The cloud security firm pinpointed vulnerabilities in default IAM roles established by AWS services such as SageMaker, Glue, EMR, and Lightsail. A similar issue has also been detected in the widely-used open-source framework Ray, which generates a default IAM role (ray-autoscaler-v1) that includes the AmazonS3FullAccess policy.

CISA Alerts on Five Actively Exploited Security Vulnerabilities: Immediate Action Needed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, highlighting ongoing exploitation in real-world scenarios. Among these, three high-severity flaws in Veritas Backup Exec Agent software (CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878) may allow attackers to execute privileged commands on the system. These vulnerabilities were addressed in a patch released by Veritas in March 2021.

  • CVE-2021-27876 (CVSS score: 8.1) – File Access Vulnerability
  • CVE-2021-27877 (CVSS score: 8.2) – Improper Authentication Vulnerability
  • CVE-2021-27878 (CVSS score: 8.8) – Command Execution Vulnerability

A recent report from Google-owned Mandiant highlighted that an affiliate tied to the BlackCat (also known as ALPHV and Noberus) ransomware operation is utilizing these vulnerabilities for attacks.

CISA Alerts Businesses to Five Critical Security Vulnerabilities: Immediate Response Needed On April 10, 2023, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent advisory concerning five newly identified security vulnerabilities now included in its Known Exploited Vulnerabilities (KEV) catalog. This addition is backed by evidence indicating active…

Read More

CISA Alerts on Five Actively Exploited Security Vulnerabilities: Immediate Action Needed

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added five security vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, highlighting ongoing exploitation in real-world scenarios. Among these, three high-severity flaws in Veritas Backup Exec Agent software (CVE-2021-27876, CVE-2021-27877, and CVE-2021-27878) may allow attackers to execute privileged commands on the system. These vulnerabilities were addressed in a patch released by Veritas in March 2021.

  • CVE-2021-27876 (CVSS score: 8.1) – File Access Vulnerability
  • CVE-2021-27877 (CVSS score: 8.2) – Improper Authentication Vulnerability
  • CVE-2021-27878 (CVSS score: 8.8) – Command Execution Vulnerability

A recent report from Google-owned Mandiant highlighted that an affiliate tied to the BlackCat (also known as ALPHV and Noberus) ransomware operation is utilizing these vulnerabilities for attacks.

Virtru Resolves Patent Dispute with Microsoft over Encryption Technology

Data Security, Encryption & Key Management, Litigation Settlement Reached in Virtru’s Patent Infringement Case Against Microsoft’s Message Encryption Tool Michael Novinson (MichaelNovinson) • August 27, 2025 In a significant development, Virtru has settled a lawsuit against Microsoft that contested the alleged infringement of its patents related to data protection in…

Read MoreVirtru Resolves Patent Dispute with Microsoft over Encryption Technology

New BPFDoor Controller Facilitates Covert Lateral Movement in Linux Server Attacks

Apr 16, 2025
Cyber Espionage / Network Security

Cybersecurity researchers have discovered a new component linked to the BPFDoor backdoor, employed in cyber attacks targeting the telecommunications, finance, and retail sectors across South Korea, Hong Kong, Myanmar, Malaysia, and Egypt in 2024. “The controller can establish a reverse shell,” explained Trend Micro researcher Fernando Mercês in a technical report released earlier this week. “This capability permits lateral movement, enabling attackers to penetrate deeper into compromised networks and gain control over more systems or access sensitive data.” The campaign has been tentatively attributed to a threat group known as Earth Bluecrow, also referred to as DecisiveArchitect, Red Dev 18, and Red Menshen. The medium confidence level stems from the BPFDoor malware source code being leaked in 2022, suggesting it could have been adopted by other hacking entities. BPFDoor is a Linux backdoor that first emerged in…

New BPFDoor Controller Enhances Stealthy Lateral Movement in Linux Server Intrusions April 16, 2025 Recent findings by cybersecurity experts reveal the emergence of a new component linked to the BPFDoor backdoor, spotlighting a sophisticated wave of cyber attacks that targeted the telecommunications, finance, and retail sectors across multiple regions, including…

Read More

New BPFDoor Controller Facilitates Covert Lateral Movement in Linux Server Attacks

Apr 16, 2025
Cyber Espionage / Network Security

Cybersecurity researchers have discovered a new component linked to the BPFDoor backdoor, employed in cyber attacks targeting the telecommunications, finance, and retail sectors across South Korea, Hong Kong, Myanmar, Malaysia, and Egypt in 2024. “The controller can establish a reverse shell,” explained Trend Micro researcher Fernando Mercês in a technical report released earlier this week. “This capability permits lateral movement, enabling attackers to penetrate deeper into compromised networks and gain control over more systems or access sensitive data.” The campaign has been tentatively attributed to a threat group known as Earth Bluecrow, also referred to as DecisiveArchitect, Red Dev 18, and Red Menshen. The medium confidence level stems from the BPFDoor malware source code being leaked in 2022, suggesting it could have been adopted by other hacking entities. BPFDoor is a Linux backdoor that first emerged in…

Major Breach Exposes Sensitive Medical Marijuana Patient Information – MJBizDaily

Sensitive Medical Marijuana Patient Data Compromised in Significant Breach In a concerning incident highlighting the vulnerabilities in healthcare data security, sensitive personal information of medical marijuana patients has been exposed due to a significant data breach. This breach raises alarms about the confidentiality of patient records, emphasizing the urgent need…

Read MoreMajor Breach Exposes Sensitive Medical Marijuana Patient Information – MJBizDaily

Russian Hackers Target Ukraine Aid Logistics Through Email and VPN Vulnerabilities

May 21, 2025
Cyber Espionage / Vulnerability

State-sponsored Russian cyber actors have been linked to a campaign focused on Western logistics and tech firms since 2022. This activity is attributed to APT28 (also known as BlueDelta, Fancy Bear, or Forest Blizzard), connected to the Russian GRU’s 85th Main Special Service Center, Military Unit 26165. Key targets include companies involved in the coordination and delivery of international aid to Ukraine, as highlighted in a joint advisory from agencies across Australia, Canada, Czechia, Denmark, Estonia, France, Germany, the Netherlands, Poland, the United Kingdom, and the United States. The bulletin notes that this cyber-espionage campaign employs a range of previously identified tactics and is likely linked to broader efforts aimed at IP cameras in Ukraine and neighboring NATO countries.

Russian Hackers Target Email and VPN Vulnerabilities to Monitor Ukraine Aid Operations May 21, 2025 Cyber Espionage / Vulnerability In a troubling development, Russian cyber threat actors have initiated a state-sponsored campaign aimed at infiltrating Western logistics and technology sectors, with particular focus since 2022. Authorities attribute this wave of…

Read More

Russian Hackers Target Ukraine Aid Logistics Through Email and VPN Vulnerabilities

May 21, 2025
Cyber Espionage / Vulnerability

State-sponsored Russian cyber actors have been linked to a campaign focused on Western logistics and tech firms since 2022. This activity is attributed to APT28 (also known as BlueDelta, Fancy Bear, or Forest Blizzard), connected to the Russian GRU’s 85th Main Special Service Center, Military Unit 26165. Key targets include companies involved in the coordination and delivery of international aid to Ukraine, as highlighted in a joint advisory from agencies across Australia, Canada, Czechia, Denmark, Estonia, France, Germany, the Netherlands, Poland, the United Kingdom, and the United States. The bulletin notes that this cyber-espionage campaign employs a range of previously identified tactics and is likely linked to broader efforts aimed at IP cameras in Ukraine and neighboring NATO countries.