"Research from Pentera Labs reveals evidence of active exploitation in customer-managed business cloud environments, particularly within Fortune 500 companies and cybersecurity vendors. This exploitation is targeting training applications utilized by said organizations. These are applications typically deployed for security demos and training, including OWASP Juice Shop, DVWA and Hackazon. The research discovered thousands of systems exposed, with several hosted on enterprise infrastructure using Azure, AWS and GCP cloud platforms."
"Of these exposed systems, around 20% were determined to "contain artifacts deployed by malicious actors." Oftentimes, these applications were customer-deployed with minimal isolation, default configurations, and permissive cloud roles. The research further uncovered that several exposed training environments were directly linked to active cloud identities and privileged roles, which could allow malicious actors to move from the vulnerable applications into the customer's cloud infrastructure."
"Moreover, within the compromised hosts, the research identified obfuscated scripts, webshells and persistence mechanisms - evidence of active exploitation. Nivedita Murthy, Associate Principal Security Consultant at Black Duck, advises, "Organizations should isolate which versions of these apps are being used and have them reviewed before providing them to their teams. Teams can keep a verified version of these apps internally and make it available to the user base instead of allowing the user to download directly from a legitimate site.""
Evidence shows active exploitation of customer-managed business cloud environments, including Fortune 500 companies and cybersecurity vendors, targeting training applications like OWASP Juice Shop, DVWA and Hackazon. Thousands of exposed systems exist across Azure, AWS and GCP, with around 20% containing artifacts deployed by malicious actors. Exposed apps often use minimal isolation, default configurations, and permissive cloud roles. Several training environments were linked to active cloud identities and privileged roles, enabling potential lateral movement into enterprise cloud infrastructure. Compromised hosts contained obfuscated scripts, webshells and persistence mechanisms.
Read at Securitymagazine
Unable to calculate read time
Collection
[
|
...
]