Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Nathaniel Quist
Novel Technique to Detect Cloud Threat Actor Operations
Executive Summary Cloud-based alerting systems often struggle to distinguish between normal cloud activity and targeted malicious operations by known threat actors. The difficulty doesn’t lie in an inability to identify complex alerting operations across thousands of cloud resources or in a failure to follow identity resources, the problem lies in the accurate detection of known persistent threat actor group techniques specifically within cloud environments.
Trusted Connections, Hidden Risks: Token Management in the Third-Party Supply Chain
A Day in the Life of a Security Defender You are about to log off for the weekend when a high-severity alert flashes on your cloud security tool’s dashboard. A single, unfamiliar OAuth token is making hundreds of connections from three different IP addresses, two of which are flagged as belonging to an unknown VPN service. The token belongs to a third-party application integrated with the company's Salesforce instance, one of those forgotten dormant integrations.
The Evolution of Linux Binaries in Targeted Cloud Operations
Executive Summary Unit 42 researchers have identified a growing threat to cloud security: Linux Executable and Linkage Format (ELF) files that threat actors are developing to target cloud infrastructure. We predict that threat actors targeting cloud environments will start using more complex tools in their exploits. This will include reworking, improving and tailoring existing tools that historically only targeted Linux operating systems (OS).
Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration
Cloud Cybersecurity Research 11 min read Related Products CortexCortex CloudUnit 42 Incident Response Executive Summary The attacks against cloud-hosted infrastructure are increasing, and the proof is in the analysis of security alert trends. Recent research reveals that organizations saw nearly five times as many daily cloud-based alerts at the end of 2024 compared to the start of the year.
CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys
Executive Summary Unit 42 researchers have identified an active campaign we are calling EleKtra-Leak, which performs automated targeting of exposed identity and access management (IAM) credentials within public GitHub repositories. As a result of this, the threat actor associated with the campaign was able to create multiple AWS Elastic Compute (EC2) instances that they used for wide-ranging and long-lasting cryptojacking operations.
P2PInfect: The Rusty Peer-to-Peer Self-Replicating Worm
Executive Summary On July 11, 2023, Unit 42 cloud researchers discovered a new peer-to-peer (P2P) worm we call P2PInfect. Written in Rust, a highly scalable and cloud-friendly programming language, this worm is capable of cross-platform infections and targets Redis, a popular open-source database application that is heavily used within cloud environments. Redis instances can be run on both Linux and Windows operating systems.
Unit 42 Finds Three Vulnerabilities in OpenLiteSpeed Web Server
This post is also available in: 日本語 (Japanese) Executive Summary The Unit 42 research team has researched and discovered three different vulnerabilities in the open source OpenLiteSpeed Web Server. These vulnerabilities also affect the enterprise version, LiteSpeed Web Server. By chaining and exploiting the vulnerabilities, adversaries could compromise the web server and gain fully privileged remote code execution.
Prisma Cloud Mitigations for SpringShell and Recent Spring Vulnerabilities: CVE-2022-22963, CVE-2022-22965
This post is also available in: 日本語 (Japanese) Executive Summary In the past week, multiple vulnerabilities affecting the Spring Framework have been disclosed to the public. Among four vulnerabilities released since the beginning of March, CVE-2022-22965, which was uncovered on March 31, 2022, had the most critical impact and was dubbed SpringShell. The SpringShell vulnerability allows attackers unauthenticated remote code execution (RCE) to affected systems.
TeamTNT Using WatchDog Operations TTPs in Cryptojacking
This post is also available in: 日本語 (Japanese) Executive Summary The copying and incorporation of cryptomining operational codebase or script functions have become a central behavioral indicator of cryptojacking groups and their operations. However, the use of command and control (C2) infrastructure, full tool sets and directory infrastructure patterns is a different matter.
TeamTNT Operations Actively Enumerating Cloud Environments
This post is also available in: 日本語 (Japanese) Executive Summary TeamTNT has been evolving their cloud-focused cryptojacking operations for some time now. TeamTNT operations have targeted and, after compromise, exfiltrated AWS credentials, targeted Kubernetes clusters and created new malware called Black-T that integrates open source cloud native tools to assist in their cryptojacking operations.
WatchDog: Exposing a Cryptojacking Campaign That’s Operated for Two Years
This post is also available in: 日本語 (Japanese) Executive Summary Unit 42 researchers are exposing one of the largest and longest-lasting Monero cryptojacking operations known to exist. The operation is called WatchDog, taken from the name of a Linux daemon called watchdogd. The WatchDog mining operation has been running since Jan. 27, 2019, and has collected at least 209 Monero (XMR), valued to be around $32,056 USD.
Black-T: New Cryptojacking Variant from TeamTnT
Executive Summary Unit 42 researchers discovered a new variant of cryptojacking malware named Black-T, authored by TeamTnT, a group known to target AWS credential files on compromised cloud systems and mine for Monero (XMR). Black-T follows the traditional TeamTnT tactics, techniques and procedures (TTPs) of targeting exposed Docker daemon APIs and performing scanning and cryptojacking operations on vulnerable systems of affected organizations.
Unit 42 CTR: Sensitive Data Exposed in GitHub
Executive Summary The Unit 42 Cloud Threat Report: Spring 2020 focused on the practices of DevOps to determine where misconfigurations are happening in the cloud. This blog offers a detailed analysis of GitHub repositories and the immediate need to “shift-left” security checks to enable all teams – DevOps, engineering and security – to discover and remediate issues earlier. Few data repositories are more widely leveraged for fast-tracking code from development into production than GitHub.
Cloud - Unit42
This post is based on additional findings from the Unit 42 Cloud Threat Report which shows how misconfigured Docker registries could leak confidential data, lead to a full-scale compromise, and interrupt the business operations.
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Nathaniel
Contact Nathaniel, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack