Loading story…
ownCloud has issued an urgent advisory to users of its Community Edition, emphasizing the immediate need to enable multi-factor authentication (MFA) following a series of credential theft incidents. According to a threat intelligence report by Hudson Rock, attackers leveraged infostealer malware such as RedLine, Lumma, and Vidar to compromise employee endpoints and harvest login credentials. These stolen credentials were then used to access ownCloud instances that did not have MFA enabled, resulting in unauthorized access to sensitive data. ownCloud clarified that its platform was not breached and that no zero-day vulnerabilities were exploited; instead, the attacks succeeded due to misconfigurations and the absence of enforced MFA on self-hosted deployments.
The company recommends several mitigation steps: enabling MFA across all user accounts, resetting passwords, auditing access logs for suspicious activity, and invalidating active sessions to force re-authentication. Security experts highlight that MFA can block over 99% of account takeover attempts, yet adoption remains low among self-hosted platforms. The incident has drawn attention to the broader risks facing open-source file-sharing solutions like ownCloud, Nextcloud, and Seafile, especially as infostealer malware becomes more prevalent and corporate data is increasingly targeted for sale on dark web markets. Organizations are urged to prioritize MFA and robust credential management to defend against similar attacks.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
ownCloud published a security advisory urging Community Edition users to enable multi-factor authentication, reset passwords, invalidate sessions, and review access logs after reports of credential-theft-driven compromises. The company stated that ownCloud itself was not breached and said the incidents stemmed from stolen credentials and weak security configurations, especially missing MFA.
Threat intelligence reporting found that infostealer malware including RedLine, Lumma, and Vidar had infected employee devices, stolen credentials, and enabled unauthorized access to some self-hosted ownCloud instances without MFA. The reporting indicated the activity relied on compromised credentials rather than any ownCloud zero-day or platform breach.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor known as **Zestix** has systematically breached dozens of major global enterprises by exploiting credentials harvested from infostealer malware such as RedLine, Lumma, and Vidar. These infostealers, often distributed through malvertising or phishing, collect login data from infected employee devices, which is then aggregated and sold or used on underground forums. Zestix specifically targeted cloud file-sharing platforms including ShareFile, Nextcloud, and OwnCloud, gaining unauthorized access to sensitive corporate data across sectors like aviation, defense, healthcare, utilities, and government. The breaches were enabled by the widespread absence of Multi-Factor Authentication (MFA), allowing attackers to use valid credentials—some of which had been exposed for years—to access and exfiltrate terabytes of confidential information. Security researchers from multiple firms, including Hudson Rock and InfoStealers, highlighted that Zestix operates as an initial access broker, auctioning access to compromised cloud environments and datasets. The attacks underscore a critical security gap: organizations' failure to implement or enforce MFA and to regularly rotate credentials, leaving them vulnerable to credential-based attacks. The scale and persistence of these breaches demonstrate the urgent need for improved credential hygiene and robust access controls to protect cloud-based assets from similar threats.
Jun 29, 2026
CISA reported multiple intrusions into organizations’ cloud environments in which attackers exploited weak security configurations, particularly in remote-work settings that mixed corporate and personal devices. The activity included phishing for cloud credentials, brute-force login attempts, abuse of valid accounts, and manipulation of email services after compromise. In several cases, attackers created or modified email forwarding rules to redirect sensitive messages to attacker-controlled accounts, sent phishing emails from internal compromised mailboxes, and concealed security warnings by moving them into RSS-related folders. The incidents also showed that **multi-factor authentication was not always sufficient on its own**: some brute-force attempts were blocked by MFA, but at least one account was still accessed, likely through stolen web session cookies in a **pass-the-cookie** scenario that bypassed MFA checks. U.S. government guidance urged organizations to harden authentication and cloud access controls by enforcing universal MFA, using conditional access policies, reviewing logs for anomalous sign-ins, restricting external email forwarding, blocking legacy authentication, securing exposed remote access services, and improving user awareness to reduce credential theft and session hijacking risks.
Aug 15, 2026
Recent high-profile breaches at major UK retailers, including M&S and Co-op Group, have highlighted the growing threat of identity-based attacks. Attackers used vishing techniques to obtain corporate passwords, which enabled ransomware deployment and resulted in significant financial and reputational damage. The distributed nature of modern IT environments, with resources spread across cloud and on-premises systems, has made identity the new security perimeter, increasing the value of credentials for cybercriminals. Infostealer malware and various forms of phishing, including smishing and vishing, are now primary methods for harvesting credentials, contributing to a surge in identity-related breaches across industries. To counter these threats, security experts emphasize the importance of robust multifactor authentication (MFA), particularly methods that are resistant to phishing. While traditional MFA methods such as one-time passwords (OTPs) sent via SMS or email are still widely used, they are increasingly vulnerable to social engineering and interception. The adoption of passkeys and other phishing-resistant MFA solutions is being promoted as the gold standard, with Microsoft reporting that MFA blocks over 99% of unauthorized access attempts. Organizations are urged to move beyond basic MFA and implement stronger, phishing-resistant authentication to protect against evolving identity-based attacks.
Jun 29, 2026