SecuriTricks

PhaaS actor uses DoH and DNS MX to dynamically distribute phishing

Infoblox discovered a phishing kit that creatively employs DNS mail exchange (MX) records to dynamically serve fake, tailored, login pages, spoofing over 100 brands.

phishing

cloud

malspam

2025-03-31

morphing meerkat

Published: March 31, 2025

Downloadable IOCs: 21

Ransomware in the Cloud: Scattered Spider Targeting Insurance and Financial Industries

The Scattered Spider cybercriminal group is targeting cloud infrastructures in the insurance and financial sectors using advanced techniques. They exploit leaked authentication tokens, conduct phishing and smishing campaigns, and leverage SIM swapping to bypass multi-factor authentication. The grou…

Published: September 11, 2024

Downloadable IOCs: 12

Leaked Environment Variables Allow Large-Scale Extortion Operation of Cloud Environments

Unit 42 researchers uncovered an extortion campaign that compromised and extorted multiple victim organizations by leveraging exposed environment variable files containing sensitive credentials. The campaign involved setting up attack infrastructure within victims' Amazon Web Services (AWS) environ…

Published: August 16, 2024

Linked vulnerabilities : CVE-2024-6387 (CVSS 8.1), CVE-2024-3094

Downloadable IOCs: 37

Analysis and Detection of CLOUD#REVERSER: An Attack Involving Threat Actors Compromising Systems Using A Sophisticated Cloud-Based Malware

Securonix Threat Research has uncovered a sophisticated malware campaign, dubbed CLOUD#REVERSER, that leverages popular cloud storage services like Google Drive and Dropbox for malware delivery, command execution, and data exfiltration. The infection chain starts with a phishing email containing a …

Published: May 22, 2024

Downloadable IOCs: 16

Attackers exploiting new critical vulnerabilities on Kubernetes clusters

Microsoft security researchers have uncovered an attack campaign exploiting recently disclosed critical vulnerabilities in the OpenMetadata platform to gain unauthorized access to Kubernetes clusters, followed by reconnaissance and the deployment of crypto-mining malware. The vulnerabilities, affec…

Published: May 21, 2024

Downloadable IOCs: 6

Analysis of APT Group's Use of Malicious LNK Files to Deliver RokRat Attack

The report details a recent cyber attack campaign by the APT-C-28 (ScarCruft) group, known for targeting organizations in Korea and Asia. The campaign utilized a malicious LNK file disguised as a document related to a 'North Korean Human Rights Expert Debate' to deliver the RokRat remote access tro…

Published: April 29, 2024

Downloadable IOCs: 3

Tag: cloud

Attack reports

PhaaS actor uses DoH and DNS MX to dynamically distribute phishing

Ransomware in the Cloud: Scattered Spider Targeting Insurance and Financial Industries

Leaked Environment Variables Allow Large-Scale Extortion Operation of Cloud Environments

Hackers Leveraging OneDrive Or Google Drive To Hide Malicious Traffic

Cloud Cover: How Malicious Actors Are Leveraging Cloud Services

DERO cryptojacking adopts new techniques to evade detection

APT Attacks Using Cloud Storage

Commando Cat: A Novel Cryptojacking Attack Abusing Docker Remote API Servers

Analysis and Detection of CLOUD#REVERSER: An Attack Involving Threat Actors Compromising Systems Using A Sophisticated Cloud-Based Malware

Attackers exploiting new critical vulnerabilities on Kubernetes clusters

Analysis of APT Group's Use of Malicious LNK Files to Deliver RokRat Attack