Loading story…
Palo Alto Networks Unit 42 reported a cloud incident involving exploitation of a SugarCRM zero-day vulnerability that was used alongside compromised access keys to deepen attacker access. The case highlights how a flaw in an internet-facing CRM platform can become the initial foothold for broader cloud compromise, allowing an intruder to move from application exploitation into abuse of cloud credentials and services.
The incident underscores the compounded risk created when zero-day exploitation and exposed or stolen cloud access keys occur together. In this case, responders tied the intrusion to abuse of the SugarCRM flaw and subsequent cloud-oriented activity, illustrating how attackers can pivot from a vulnerable business application into a wider cloud environment and forcing defenders to investigate both application compromise and credential exposure at the same time.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published an incident-response case study describing how a SugarCRM zero-day vulnerability and exposed access keys were used in a cloud intrusion. The reference does not provide enough detail in the supplied content to extract earlier discrete events with confidence, so the publication itself is the only reliably dated event.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are actively exploiting **intentionally vulnerable web applications** used for security training and internal testing (including **DVWA**, **OWASP Juice Shop**, **Hackazon**, and **bWAPP**) when they are mistakenly exposed to the public Internet, using them as an entry point into enterprise cloud environments. Reporting based on a Pentera investigation described evidence of real-world abuse leading to follow-on activity such as **cryptominer deployment**, **webshell placement**, and **pivoting** deeper into sensitive systems—especially when these apps are deployed from **privileged cloud accounts** and paired with weak configurations. Pentera reported finding **1,926** live exposed instances across **AWS, GCP, and Azure**, frequently associated with **over-permissioned IAM roles** and poor hygiene such as **default credentials** and failure to follow least-privilege practices. The exposed environments could enable access to cloud storage (e.g., **S3**, **GCS**, **Azure Blob Storage**), secrets stores (e.g., **AWS Secrets Manager**), container registries, and in some cases **administrative control** of cloud accounts; impacted organizations cited in coverage included major vendors such as **Cloudflare**, **F5**, and **Palo Alto Networks**, which were notified and reportedly remediated affected exposures.
Jun 29, 2026
A threat actor known as **Zestix** has systematically breached dozens of major global enterprises by exploiting credentials harvested from infostealer malware such as RedLine, Lumma, and Vidar. These infostealers, often distributed through malvertising or phishing, collect login data from infected employee devices, which is then aggregated and sold or used on underground forums. Zestix specifically targeted cloud file-sharing platforms including ShareFile, Nextcloud, and OwnCloud, gaining unauthorized access to sensitive corporate data across sectors like aviation, defense, healthcare, utilities, and government. The breaches were enabled by the widespread absence of Multi-Factor Authentication (MFA), allowing attackers to use valid credentials—some of which had been exposed for years—to access and exfiltrate terabytes of confidential information. Security researchers from multiple firms, including Hudson Rock and InfoStealers, highlighted that Zestix operates as an initial access broker, auctioning access to compromised cloud environments and datasets. The attacks underscore a critical security gap: organizations' failure to implement or enforce MFA and to regularly rotate credentials, leaving them vulnerable to credential-based attacks. The scale and persistence of these breaches demonstrate the urgent need for improved credential hygiene and robust access controls to protect cloud-based assets from similar threats.
Jun 29, 2026
Palo Alto Networks Unit 42 reported that exposed AWS IAM access keys were used in malicious operations that rapidly turned compromised cloud accounts into platforms for **cryptojacking** and broader resource abuse. Attackers leveraged valid IAM credentials to gain access without exploiting software flaws, then provisioned compute resources and manipulated cloud services to mine cryptocurrency while consuming victims’ infrastructure and budget. The activity highlights how leaked cloud credentials can enable fast, low-friction compromise across internet-facing environments, especially when keys are overprivileged or insufficiently monitored. Unit 42’s findings underscore that exposed IAM keys can support sustained unauthorized operations inside cloud tenants, making credential hygiene, least-privilege access, key rotation, and continuous monitoring of anomalous cloud activity critical defensive measures.
Jul 12, 2026