cloud security9 articles
ConnectWise Pulls Cloud Backup Offline After Attackers Hijack Microsoft 365 Tenants
ConnectWise disabled seven application identities and suspended its Cloud Backup and Cloud Management services after unknown threat actors compromised the application credentials and used them to gain unauthorized access to Microsoft 365 customer tenants. The attack is particularly dangerous because the stolen application credentials allowed attackers to authenticate as ConnectWise's own applications and request access tokens from Microsoft Entra ID, potentially enabling access to mailboxes, SharePoint, Teams, and directory data — and even establish persistence by adding new credentials or applications within compromised tenants. Security firm Huntress has confirmed malicious activity across nearly 1,000 Entra tenants, with successful sign-ins in approximately 300, and identified a second targeted wave of attempts focused on 16 tenants in sensitive sectors including national security and critical minerals.
Fake Passkeys and CEO Impersonation: Microsoft Exposes Two Nasty Cloud Attack Campaigns
Microsoft has revealed two threat actor campaigns targeting organizations: one involving over a million scam emails impersonating CEOs to trick finance departments into making fraudulent ACH transfers, and another using passkey-themed social engineering to compromise Microsoft cloud accounts. The second campaign involves attackers posing as IT helpdesk staff to lure employees into fake Microsoft sign-in pages, enabling credential theft or unauthorized account access, after which they establish persistent MFA footholds and exfiltrate data from SharePoint, OneDrive, and Exchange. Microsoft has linked the activity to multiple threat actors, including Storm-3032 (identified as UNC6671), with overlaps noted in shared phishing infrastructure associated with the cybercrime collective also tracked as Cordial Spider.
Two Criminal Groups Are Quietly Gutting Brazil's Financial Infrastructure
A newly identified threat actor called **Slim Spider** has been conducting sophisticated attacks on Brazilian financial institutions since at least March 2026, targeting cryptocurrency assets and instant payment accounts linked to Brazil's Pix system. The group demonstrates advanced cloud security knowledge, using custom scripts to steal cloud credentials, enumerate secrets, and derive Ethereum wallet addresses, while deploying backdoors and malicious pipelines to maintain access and evade detection. Separately, another cybercrime group called **Breeze Comet** has been infiltrating Brazilian financial systems since 2024 to execute fraudulent transactions via Pix and other payment infrastructure, with both groups highlighting a broader shift from retail banking fraud toward direct attacks on core financial infrastructure.
Heights Finance Breach Exposes Data of 1.2 Million Borrowers
Consumer lender Heights Finance Holdings suffered a data breach in early May when hackers accessed a third-party cloud-based storage platform, compromising the personal and financial information of over 1.2 million individuals. Stolen data includes names, Social Security numbers, bank account details, and other sensitive information belonging to current and former borrowers. Heights has secured the platform, notified federal law enforcement, and is offering affected individuals 24 months of free credit monitoring and identity protection services.
AI-Written PowerShell Scripts Are Now a Burglar's Tool of Choice
An unknown threat actor used an AI-generated PowerShell script to enumerate Active Directory environments, gaining RDP access via stolen credentials before systematically harvesting user, computer, and group data and exfiltrating it to a remote server. The script's telltale signs — such as its iteration-style title, over-engineered code, and colour-formatted output — strongly suggest it was produced through repeated prompting of a large language model. While AI is not introducing entirely new attack techniques, it is lowering the barrier to entry for cybercriminals and accelerating attack timelines, allowing less-skilled actors to deploy capable tooling faster than defenders can respond.
NadMesh Botnet Is Raiding Exposed AI Services for Cloud Keys, and the Numbers Don't Add Up
A Go-based botnet called NadMesh, discovered in early July 2025, systematically scans for exposed AI services (such as ComfyUI, Ollama, and n8n) to steal cloud credentials, Kubernetes tokens, and environment variable secrets, with the operator's own dashboard claiming over 3,800 harvested AWS keys. While the botnet prioritises AI service endpoints and MCP tools, the majority of its observed exploit traffic actually targets more traditional attack surfaces like Docker APIs and Jenkins consoles, with MCP exploitation accounting for less than 1% of recorded attempts. Defenders are urged to place exposed services behind authentication, check systems for persistence artefacts, and immediately revoke — not merely rotate — any credentials that may have been exposed.
Accenture Breached: Hacker Claims 35GB Haul Including Source Code and Azure Keys
Accenture has confirmed a data breach after a hacker claimed on PwnForums to have stolen 35 gigabytes of data, including source code, Azure access keys, RSA/SSH keys, and configuration files from the company. Accenture stated the incident has been remediated and that there is no impact on its operations, though it provided few further details. Security experts warn the stolen data could be leveraged for future attacks, given Accenture's close proximity to major enterprise clients' systems and infrastructure.
Meet CAI: The Cloud Worm That Mugs Other Malware Before Robbing You
A new cloud-targeting botnet called Cloud AI Infrastructure Attack Framework (CAI) has emerged, designed to steal credentials and mine cryptocurrency while actively eliminating competing malware like TeamPCP and PCPJack from compromised systems. It targets cloud-native tools such as Docker, Kubernetes, and Redis, using a centralized command-and-control structure and showing signs of LLM-assisted development. Security researchers warn that CAI's emergence alongside rival threat actors signals a growing and increasingly competitive landscape of malicious actors targeting cloud infrastructure and developer secrets.
AdaptHealth Blames Social Engineering After Patient Data Walks Out the Door
Medical equipment provider AdaptHealth suffered a cyberattack in which criminals used social engineering to compromise a third-party contractor and gain access to the company's cloud systems. Attackers stole sensitive patient data, including personally identifiable information, protected health information, and a password file linked to insurance billing, though Social Security numbers and payment details are believed to be unaffected. AdaptHealth disclosed the breach to the SEC on June 27, deeming it material due to the potential volume of data at risk, while investigations into the full scope of the incident are ongoing.