Threat Feed

dev
28 items•Sources: 8•Tags: 37
Sources:
Tags:
Sort:
CISA
781 hour ago

zero-day exploitation campaign observed targeting AWS workloads in us-east-1

CISA identified zero-day exploitation activity leveraging SocGholish malware targeting AWS CloudTrail infrastructure in us-east-1. Attack pattern aligns with MITRE ATT&CK technique T1548.

zero-day-exploitationsocgholishawscloudtrailzero-daycisa
AWS Security
4010 hours ago

Lazarus Group targets Cloudflare CloudTrail using RedLine Stealer [Dev Alert]

AWS Security identified living-off-the-land activity leveraging RedLine Stealer malware targeting Cloudflare CloudTrail infrastructure in us-west-2. Attack pattern aligns with MITRE ATT&CK technique T1059.001.

living-off-the-landredline-stealercloudflarecloudtraildev
Palo Alto Networks
242 days ago

APT41 deploys AI phishing via compromised Microsoft Azure EKS

Palo Alto Networks identified AI phishing activity leveraging PlugX malware targeting Microsoft Azure EKS infrastructure in us-east-1. Attack pattern aligns with MITRE ATT&CK technique T1071.

ai-phishingplugxmicrosoft-azureeks
AWS Security
412 days ago

Scattered Spider targets Google Cloud S3 using Lumma Stealer [Dev Alert]

AWS Security identified credential harvesting activity leveraging Lumma Stealer malware targeting Google Cloud S3 infrastructure in eu-central-1. Attack pattern aligns with MITRE ATT&CK technique T1566.

credential-harvestinglumma-stealergoogle-clouds3dev
IBM X-Force
12 days ago

Metasploit infrastructure shifts detected by IBM X-Force

IBM X-Force identified zero-day exploitation activity leveraging Metasploit malware targeting Oracle Cloud Bedrock infrastructure in eu-central-1. Attack pattern aligns with MITRE ATT&CK technique T1548.

zero-day-exploitationmetasploitoracle-cloudbedrock
Mandiant
912 days ago

CVE-2025-6112: Active exploitation detected in EC2

Mandiant identified supply chain compromise activity leveraging PlugX malware targeting Cloudflare EC2 infrastructure in ca-central-1. Attack pattern aligns with MITRE ATT&CK technique T1078.

supply-chain-compromiseplugxcloudflareec2cve
AWS Security
152 days ago

CVE-2025-8585: Active exploitation detected in RDS [Dev Alert]

AWS Security identified zero-day exploitation activity leveraging IcedID malware targeting Oracle Cloud RDS infrastructure in ap-northeast-1. Attack pattern aligns with MITRE ATT&CK technique T1133.

zero-day-exploitationicedidoracle-cloudrdscvedev
Mandiant
492 days ago

AsyncRAT infrastructure shifts detected by Mandiant

Mandiant identified API exploitation activity leveraging AsyncRAT malware targeting Cloudflare S3 infrastructure in ap-southeast-1. Attack pattern aligns with MITRE ATT&CK technique T1190.

api-exploitationasyncratcloudflares3
Microsoft Threat Intelligence
32 days ago

APT41 targets Microsoft Azure Secrets Manager using SocGholish

Microsoft Threat Intelligence identified supply chain compromise activity leveraging SocGholish malware targeting Microsoft Azure Secrets Manager infrastructure in eu-west-1. Attack pattern aligns with MITRE ATT&CK technique T1071.

supply-chain-compromisesocgholishmicrosoft-azuresecrets manager