Mandiant
Google Mandiant researchers tracked activity linked to the PeopleSoft vuln over 13 days.
Hackers "enumerated and accessed objects within S3 buckets, terminated production EC2 and RDS instances, and decrypted application keys."
File-sharing platforms continue to be a threat actor favourite.
The threat actor has been moving laterally, stealing user tokens and maintaining persistence via a range of techniques.
"The core vulnerability is a help desk process that lacks robust, non-transferable identity verification for password resets..."
Threat actor decrypts malicious payloads and executes them in memory, leaving 'minimal forensic traces.'
Russia's Cozy Bear hacking operation is changing up its tactics to go after political parties in Germany
Malware avoids EDR, attains persistence, is highly stealthy