Cloud Threat Landscape

Incidents
Actors
Techniques
Defenses
Tools
Targeted Technologies
Posters & Newspapers
About
RSS
STIX
Back to wiz.io

Cloud Threat Landscape

/

/

❓

Unknown

Tags

Attribution

Unknown

Incidents

Jupyter Notebook cred harvesting campaign Redirection Roulette LastPass & GoTo incident Fast Company incident Optus incident GitHub & npm incident Imperva incident ESXiArgs ransomware campaign RBAC Buster Behind the scenes in the Expel SOC: Alert-to-fix in AWS Large-scale cryptomining attack against K8s clusters detected by Azure From CLI to console, chasing an attacker in AWS Spotting an attacker in GCP Poisoned image to K8s to cloud SIM-Swap to Data Leak on Dark Web Misconfigured firewall to cryptojacking botnet SugarCRM as initial access to AWS envs Use of linPEAS for cloud enumeration From PHP exploitation to AWS lateral movement Rollbar hack Retool hack Cloud tools imitation campaign Qubitstrike Crypto Mining and Rootkit Campaign Apache server Cryptojacking with Cobalt Strike Denonia campaign OracleIV campaign Sumologic incident Tsunami targeting Jenkins and Weblogic EleKtra-Leak IceFire Aspera Faspex campaign SQL Server to cloud lateral movement First Republic Bank incident Cloud lateral movement via Citrix cookie Codecov incident Apache app cryptojacking campaign FBot toolkit targets cloud environments From PHP vuln to Sliver execution via cron From web app exploitation to Chisel tunneling From WSO2 RCE to SSH lateral movement Evil_MinIO campaign Leaked long-lived AWS creds 9hits Docker campaign AndroxGh0st usage (2024)From ActiveMQ to Godzilla webshell RE#TURGENCE MSSQL Server RansomOp DangerDev SES abuse incident S3 data exfiltration ECS Fargate cryptojacking Okta support system supply chain attack Cloudflare incident following Okta breach New Relic incident (November 2023)Webmin supply chain attack (2018)SSH-Snake Confluence targeting campaign S3 ransomware scam CGI Federal incident LINE and NAVER Cloud incident Cetus campaign Graboid campaign C3Pool mining via Confluence vulnerability Sliver deployment via Confluence vulnerability From social engineering to cryptocurrency theft Redis, Hadoop, and Docker exploitation Meson Network cryptojacking campaign ngrok cryptojacking campaign Gin Docker cryptojacking campaign Widespread TeamCity exploitation (March ‘24)Okta source code theft Auth0 source code theft XZ Utils backdoor incident Sisense breach K8s targeted via OpenMetadata exploitation Delinea breach Cryptojacking via Azure Batch Mirai campaign targeting Ivanti products LLMjacking via Laravel exploitation Dero cryptojacking targeting K8s From SSH bruteforce to cryptojacking AlienFox campaign JavaScript injection via vulnerable CMS JavaScript injection via WordPress exploitation GitHub certificate theft incident Dropbox breach Viamedis incident Almerys incident S3 RansomOp following long-term key exposure Abusing management tooling for cloud access Personal local drive to AWS ransomware Third party to cloud compromise Smishing into Entra onto VMWare ransomware From password reset to data exfiltration Compromise of Top.gg repo Scylla LLMJacking campaign DERO cryptojacking campaign (2024)Dama webshell deployment via ThinkPHP exploitation Club Penguin data theft via Confluence NYT source code theft SeleniumGreed: Threat actors exploit exposed Selenium Grid services for Cryptomining Misconfigured Jenkins Servers Used for Cryptomining Panamorfi campaign Msupedge Backdoor Targeting Taiwanese University Godzilla Backdoor Exploiting Confluence Vulnerability Extortion Campaign Exploiting Exposed Environment Variable Hadooken Malware Targeting Weblogic Servers Campaign targeting Selenium Grid for cryptomining Fortinet Sharepoint data leak Confluence exploited for cryptojacking GitHub PAT leakage leading to RDS Database exfiltration Docker Swarm and K8s cryptojacking campaign perfctl Malware Targeting Linux Rackspace incident (2024)Veeam Vulnerability Exploited by Akira and Fog Ransomware perfctl campaign targeting Docker API kernel.org supply chain attack Cdorked campaign Supply Chain Attack on lottie-player BrowserStack Data Breach Drizly data breach The Los Angeles Times Cryptomining Attack SharePoint Vulnerability Exploited in-the-Wild RCE Vulnerability in PAN-OS Exploited in-the-Wild Sports Piracy Exploiting Misconfigured Jupyter Servers Ultralytics compromise State-Sponsored APT Abuse Visual Studio Code in Attacks Attack abusing Amazon SES Byte Federal Data Breach via Gitlab Vulnerability RCE Vulnerability in Apache Struts Targeted by Attackers Mauri Ransomware Exploiting Apache ActiveMQ US Treasury breach via BeyondTrust supply chain attack Phishing campaign leading to Azure account takeover Volkswagen data leak through Spring Boot Actuator misconfiguration ZAGG customer data compromised via hijacked FreshClicks BigCommerce app Exploitation in the wild of Aviatrix Controller RCE Gravy Analytics data breach Campaign targeting exposed FortiGate firewall management interfaces Kong image compromise Otelier data breach MasterCard Fixes Five-Year-Old DNS Typo Misconfiguration USAID cryptojacking incident DogWifTool supply chain attack From social engineering to Lambda modification Malicious AI Models Bypass Picklescan Detection Code Injection Attacks Exploiting Publicly Disclosed ASP.NET Keys Ivanti supply chain attack via compromised library Krpano XSS exploitation campaign Zapier data breach PREMINT hack PHP-CGI Vulnerability Exploited in Attacks Targeting Japan Exposed Jupyter Notebooks Targeted for Cryptomining tj-actions/changed-files supply chain attack Operation LongFang Critical Ivanti Connect Secure Vulnerability Exploited by China-linked Actor Europecar Gitlab Breach Long-Term Email Breach at OCC Exposes Sensitive Bank Oversight Data AWS Breach at a SaaS Company Multi-Layered Cryptojacking via Docker Grafana GitHub Action attempted supply chain attack SAP NetWeaver Visual Composer exploitation campaign Compromised cloud keys exfiltrated to bucket ComfyUI exploitation campaign Oracle Cloud Potential Supply Chain Breach Larva-25003: IIS Native Module Malware Used in Targeted Web Server Attacks Game Freak data leak From stolen cloud key to persistence-as-a-service Supply Chain Compromise of rand-user-agent: Obfuscated RAT with C2 Communication and File Exfiltration Solana web3.js Supply Chain Attack Ivanti EPMM RCE Vulnerability Chain Exploited in the Wild RedisRaider Linux Cryptojacking Campaign Targets Redis Servers Coordinated One-Day Cloud Scanning Operation Targets 75 Exposure Points Open WebUI Misconfiguration Exploited for Cryptojacking NPM Supply Chain Attack Compromises 16 Popular React Native and GlueStack Packages TeamFiltration Account Takeover Campaign Langflow Vulnerability Exploited to Deliver Flodrix Botnet JSFireTruck: Malicious JavaScript Campaign Using Obfuscation Attacks on Korean IIS & Linux Servers Linux SSH Servers Compromised to Deploy Proxies JDWP Exploited in the Wild Azure Account Hijack via Stolen Tokens AWS Data Exfiltration and Attempted Ransomware AWS Network Exploitation and Ransomware Detonation Linuxsys Cryptominer Campaign 0day Vulnerability in Microsoft Sharepoint Exploited in-the-Wild Soco404 Cryptomining Campaign Exploits PostgreSQL and Cloud Misconfigurations Supply Chain Attack on npm Packages via Maintainer Phishing AWS CodeBuild Vulnerability Allows Build Process Secrets Extraction Plague PAM-Based Backdoor for Linux Akira Ransomware Targeting Critical Vulnerability in SonicWall SSLVPN Auto-Color Malware Exploits SAP Vulnerability for Linux Backdoor Nx Package Supply Chain Compromise Delivers Data-Stealing Malware DripDropper Malware Exploits Patched Apache ActiveMQ for Persistence on Cloud Linux Systems GhostAction campaign Qix npm package supply chain compromise Shai-Hulud: Ongoing Package Supply Chain Compromise Delivering Data-Stealing Malware SonicWall MySonicWall Cloud Backup File Security Incident PyTorch-nightly torchtriton dependency compromise eBPF Rootkit Targeting AWS and Linux Environments F5 incident PassiveNeuron Campaign: Espionage Campaign Targeting Windows Server Environments TruffleNet Campaign Exploits AWS SES for Large-Scale Cloud Abuse and BEC Fraud Cisco ISE Vulnerability Exploited as 0day by APT Gambling Network Exploits Abandoned Subdomains Shai-Hulud 2.0 Supply Chain Attack Amadey Loader Abuses Compromised Self-Hosted GitLab to Deliver StealC Infostealer GeoServer RCE Exploited in CoinMiner Campaigns LLMJacking for Roleplaying Campaign Canonical Snap Store Hijacking Campaign Cloud-Native Phishing Infrastructure via Abused AWS WorkMail Supply-Chain Attack via Force Pushes on Plone GitHub Repositories Supply-Chain Hijacking of Notepad++ Updates via Hosting Provider Compromise SANDWORM_MODE: Typosquatted npm Packages Used to Hijack CI Workflows Apifox supply chain attack BuddyBoss supply chain attack xygeni-action repository hijack PolinRider supply chain attack Exploitation Campaign of Vulnerable GitHub Workflows O365 Device Code Phishing Campaign using EvilTokens and Abusing Railway Platform Context.ai OAuth Token Compromise Elementary Data Compromised in Supply Chain Attack Critical SQL Injection Vulnerability in LiteLLM Exploited in-the-Wild DDoS Botnet Leveraging Jenkins Misconfigurations for Initial Access node-ipc npm Distribution Compromised Supply Chain Campaign Targeting Composer and GitHub Repositories Megalodon Campaign Backdoors GitHub Repositories via CI Workflow Compromise ServiceNow Unauthenticated Access Incident Atomic Arch: AUR Package Supply Chain Compromise Using Malicious npm Package Klue Supply Chain Breach Leads to Salesforce Data Exfiltration FortiBleed: Credential Compromise Campaign Targeting Fortinet Devices Cryptojacking Campaign Targeting K8s Clusters Cryptomining campaign targeting Linux SSH servers Coordinated GitHub API Enumeration and Access Token Abuse Compromised Injective SDK npm Package Exfiltrates Cryptocurrency Wallet Keys Jscrambler npm Package Compromised in Supply Chain Attack AsyncAPI Supply Chain Compromise via GitHub Actions CVE-2025-54068 Exploited in Large-Scale Laravel Livewire Credential Theft Campaign NadMesh: Autonomous AI-Focused Botnet Targeting Cloud and AI Infrastructure SleeperGem: RubyGems Supply Chain Attack Targets Dormant Maintainer Accounts keyv and cacheable npm Package Hijacked in Supply Chain Attack @7nohe/openapi-react-query-codegen Compromised in Supply Chain Attack JetBrains Cadence Compromised via Exploitation of TeamCity Vulnerability Coder Module Registry Compromise Leads to Credential-Stealing Malware Distribution

Last edited

Jan 18, 2024 1:25 PM

Status

Stub

Cloud-fluent

Unique Tools

Mimic ransomware

Made with 💙 by Wiz

Last Updated: April 3, 2025