Between January and February 2025, an opportunistic Business Email Compromise (BEC) threat actor carried out an Adversary-In-The-Middle (AiTM) attack against a professional services organization.   #attack   #defend   #saas

A playful guide to creating covert backdoors in AWS accounts, specifically using the AWSControlTowerExecution role.   #attack   #aws

Post investigating a small UK-based hosting provider that appear to have been misused by cybercriminals to host command-and-control (C2) servers via their Anonymous VPS service.   #attack   #saas

The AWS solution "Dynamic Image Transformation for Amazon CloudFront", previously known as "AWS Serverless Image Handler", contains a configuration weakness where the role associated with the Lambda does not constrain which buckets can be accessed. The environment variable can be set to a wildcard allowing access to any bucket.   #attack   #aws

Ever wondered what the Alt-Svc response header is used for? Turns out it can be used to become a Man-in-the-Middle and attack TLS!   #attack

Huntress has spent the last 6 months researching and cracking down on malicious OAuth applications.   #attack   #defend   #saas

Article exploring how threat actors leverage Amazon S3's Server-Side Encryption with Customer-Provided Keys (SSE-C) for ransom/extortion operations.   #attack   #aws

Microsoft's geolocation service misidentified the Singapore logins as originating from the Eastern Seaboard (New York, New Jersey, Virginia).   #attack   #azure

This repository documents TTPs associated with OIDC/OAuth 2.0 application attacks.

A security analysis tool that identifies DNS queries made by browser extensions, empowering security teams to detect and investigate suspicious activities.

Simple hunting script for suspicious M365 OAuth Apps.

Automate Cross Region DR Solution for AWS Databases (RDS, Aurora and ElastiCache).

You can enable network activity events for VPC endpoints for five AWS Services: S3, EC2, KMS, Secrets Manager, and CloudTrail.

Amazon launched the AWS Trust Center, a new online resource that shares how they approach securing customer assets in the cloud.

How to restrict S3 bucket access to a specific IAM role or user within an account by using the Conditions element.

The Policy API lets super admins programmatically access information regarding how their Google Workspace environment service level settings and rules are configured.

Google announced quantum-safe digital signatures (FIPS 204/FIPS 205) in Google Cloud Key Management Service (Cloud KMS) for software-based keys, available in preview.

Data Loss Prevention (DLP) is generally available in Gmail, alongside Drive and Chat.

Microsoft Security can also be used to help enterprises secure and govern AI apps built with the DeepSeek R1 model.