vulnerabilities
The threat actor has been moving laterally, stealing user tokens and maintaining persistence via a range of techniques.
Vulnerability chained with Apple exploit patched in August but Android users may also be affected.
"Publishing security advisories for such critical issues with such limited information only serves to hurt defenders and threat hunters"
"Malicious" images giving hackers access.
"A great way to potentially lock out other adversaries."
Issues include a faulty fix to an issue disclosed two years ago.
Attacks appear to be "linked to legacy credential use during migrations from Gen 6 to Gen 7 firewalls"
"Once on the network, the attackers don't waste time. Their actions are a mix of automated scripts for speed and hands-on-keyboard activity"
“Someone intentionally slipped a live grenade into prod and AWS gave it version release notes.”