Loading story…
Microsoft released a Cloud web applications threat matrix, a MITRE ATT&CK-aligned framework for identifying, prioritizing, investigating, and mitigating attacks targeting cloud-hosted web applications and serverless platforms. The framework maps attack paths across application code, managed runtimes, workload identities, deployment pipelines, and connected cloud resources—areas that can be overlooked when application and cloud-platform security are assessed independently.
The matrix covers techniques including application exploitation, source-repository and container-image compromise, serverless-trigger abuse, credential and workload-identity token theft, logging suppression, connector reuse, data theft, resource hijacking, and denial of wallet. Microsoft recommends enforcing MFA and least privilege; hardening repositories and CI/CD pipelines; using trusted package sources and secrets management; protecting centralized logs; restricting network access; implementing cost controls; and testing backup and recovery plans.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft introduced a MITRE ATT&CK-aligned threat matrix for cloud-hosted web applications and serverless platforms. The framework maps attack paths across application code, managed runtimes, workload identities, deployment pipelines, and connected cloud resources, and includes recommended mitigations.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemicrosoft.com
Open sourceaka.ms
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Microsoft observed intrusions targeting exposed **LiteLLM**, **RAGFlow**, and **Kestra** AI control-plane workloads to obtain credentials, establish persistence, access downstream data, and deploy cryptocurrency-mining tools. In the LiteLLM case, attackers likely exploited an exposed gateway, harvested runtime and PostgreSQL secrets, deployed XMRig-like tooling, and persisted through SSH keys, cron modifications, hidden files, and immutable file attributes. In a RAGFlow environment, attackers conducted SSRF-style reconnaissance and modified the application to persistently intercept newly configured LLM-provider credentials; Microsoft did not confirm the code-execution vulnerability used. A Kestra intrusion was assessed as likely exploiting `CVE-2026-49869` to bypass authentication, run malicious workflows, access Docker container environments, deploy XMRig, and collect data through Kestra's key-value interface. Microsoft advised treating AI gateways, retrieval platforms, and workflow orchestrators as critical control-plane infrastructure because they centralize privileged execution and high-value secrets.
Aug 29, 2026
Microsoft disclosed three cloud-service vulnerabilities affecting **Azure Databricks**, **Microsoft Purview eDiscovery**, and **Microsoft Entra ID Entitlement Management**. The issues are tracked as **`CVE-2026-33107`**, an elevation-of-privilege flaw in Azure Databricks; **`CVE-2026-26150`**, an elevation-of-privilege flaw in Microsoft Purview eDiscovery; and **`CVE-2026-35431`**, a spoofing flaw in Microsoft Entra ID Entitlement Management. Microsoft published the advisories through its Security Update Guide, indicating that multiple enterprise cloud components required security attention at the same time. The affected products span analytics, compliance, and identity governance functions that are widely used in Microsoft-centric environments. While Microsoft provided limited public technical detail in the advisories, the vulnerability classifications indicate potential risks including unauthorized privilege gains in Databricks and Purview workflows, as well as identity or trust abuse scenarios involving Entra ID Entitlement Management. Organizations using these services should review the relevant Microsoft advisories, assess exposure in tenant configurations, and apply available mitigations or service updates through normal cloud security and change-management processes.
Jul 12, 2026
Microsoft's 2025 Digital Defense Report emphasizes the urgent need for organizations to elevate cybersecurity to a boardroom-level priority, citing the increasing frequency and sophistication of cyberattacks. The report urges IT leaders to frame cybersecurity as a business risk equivalent to financial or legal challenges, advocating for direct engagement with corporate boards and CEOs to address organizational security weaknesses. Microsoft recommends tracking key security metrics such as multi-factor authentication (MFA) coverage, patch latency, incident counts, and incident response times to provide a comprehensive view of an organization's vulnerability and preparedness. The report highlights the importance of enforcing phishing-resistant MFA across all accounts, including those with administrative privileges, and regularly auditing third-party perimeter access. Over the past year, Microsoft observed a surge in the development of novel attack techniques by threat actors, who continue to exploit known security gaps opportunistically. The majority of attacks in the last six months have targeted the United States, United Kingdom, Israel, and Germany, reflecting a global threat landscape. According to the report, 80% of cyber incidents investigated by Microsoft involved data theft, with over half of attacks driven by extortion or ransomware motives, underscoring the financial incentives behind most cybercrime. Only a small fraction—about 4%—of attacks were attributed solely to espionage. The proliferation of automation, off-the-shelf hacking tools, and AI has enabled even low-skilled cybercriminals to scale their operations, making cybercrime a pervasive threat to organizations of all sizes. Microsoft processes over 100 trillion signals daily, blocks 4.5 million new malware attempts, analyzes 38 million identity risk detections, and screens 5 billion emails for threats, illustrating the scale of the challenge. The report stresses that legacy security measures are insufficient, advocating for modern, AI-driven defenses and cross-sector collaboration to keep pace with evolving threats. Organizational leaders are encouraged to build resilience into their technology and operations from the outset, treating cybersecurity as a strategic imperative. The report also notes that while nation-state actors remain a persistent concern, the immediate risk to most organizations comes from financially motivated, opportunistic criminals. Microsoft’s recommendations aim to help organizations better understand their risk posture and improve their ability to detect, prevent, and respond to cyber incidents. The report’s findings are informed by Microsoft’s extensive threat intelligence and security operations, providing actionable insights for both technical and executive audiences. The emphasis on board-level engagement reflects a broader industry trend recognizing that cybersecurity is integral to overall business resilience and continuity. By adopting the recommended practices, organizations can better defend against the growing spectrum of cyber threats and minimize the impact of potential breaches.
Jul 12, 2026