Last Week in Cloud Security December 19 2024

[Omer_Shliva]

Vulnerabilities and Case Studies Dirty DAG: New Vulnerabilities in Azure Data Factory’s Apache Airflow Integration While classified as low severity vulnerabilities by Microsoft, the risk still carries significant potential impact for organizations that use Azure Data Factory. The vulnerabilities can provide attackers with shadow admin control over Azure infrastructure, which could lead to data exfiltration, malware deployment and unauthorized data access. READ MORE Escalating privileges to read secrets with Azure Key Vault access policies During our ongoing security research to explore, identify, and document new methods attackers may use to attack cloud resources, we identified a method of privilege escalation in Azure Key Vault. This could allow a user with the Key Vault Contributor RBAC role, which is not intended to have access to Key Vault data, to read all Key Vault secrets, keys, and certificates. READ MORE HubSpot phishing targets 20,000 Microsoft Azure accounts A phishing campaign targeting automotive, chemical, and industrial manufacturing companies in Germany and the UK is abusing HubSpot to steal Microsoft Azure account credentials. READ MORE New Developments in LLM Hijacking Activity Discover the latest in LLM hijacking activity, including a dive into the JINX-2401 campaign targeting AWS environments with IAM privilege escalation tactics. READ MORE

Worth Knowing Cloud Threat Landscape Report: AI-generated attacks low for the cloud For the last couple of years, a lot of attention has been placed on the evolutionary state of artificial intelligence (AI) technology and its impact on cybersecurity. In many industries, the risks associated with AI-generated attacks are still present and concerning, especially with the global average of data breach costs increasing by 10% from last year. READ MORE From Detection to Enforcement: Migrating from IMDSv1 to IMDSv2 Migrating from IMDSv1 to IMDSv2—and ultimately disabling IMDSv1 access—is an important security best practice. However, organizations often encounter challenges with discovering and updating workloads that still rely on IMDSv1. The complexity increases in environments with diverse EC2 instances and containerized workloads, where visibility into IMDSv1 usage can be limited. Without addressing these dependencies, enforcing IMDSv2 across all workloads may disrupt critical services. READ MORE Cloud Security Trends: Predictions and Strategies for Resilience In 2025, cloud native security is set to undergo transformative progress. As Chief Information Security Officer at Aqua, I’ve seen how rapidly evolving threats and operational demands are driving organizations to redefine their approach to security. The focus is no longer just on adapting to challenges—it’s about deeply embedding security into every facet of development pipelines, runtime environments, and cloud ecosystems. READ MORE Key Cloud Security Predictions for 2025: What to Expect and How to Prepare 2024 welcomed a variety of developments in cloud security, with no shortage of risks, innovations, and collaborations among them. Yet with 2025 rapidly approaching and annual planning already underway, organizations need to prepare for what the New Year may bring. And who better to help than some of the industry’s top experts at Orca Security, who developed their key cloud security predictions for 2025. READ MORE

[the_rock]

Super interesting!

Andy