Browse public community intelligence reports, source analysis, and threat research.
5 intel reports
A confused deputy vulnerability in Google Cloud's Config Connector (KCC) allows Kubernetes users to escalate privileges to Organization Owner by submitting malicious IAMPolicyMember YAML files.
Midnight Blizzard leverages compromised Entra ID Agent Blueprints to pivot between tenants and escalate to Global Administrator using Temporary Access Passes.
Threat actors including BlackCat and STORM-0501 are leveraging native Azure features like Encryption Scopes and Customer-Provided Keys to encrypt and hold blob storage for ransom.
Threat actors are increasingly leveraging compromised Microsoft Intune administrative accounts to deploy malicious scripts and perform fleet-wide device wipes.
Threat actors manipulate AWS CloudTrail and Google Cloud Logging configurations to blind security teams and maintain persistent visibility within compromised environments.
