Amazon AWS
-
Crimson Collective targets AWS cloud instances to steal data and extort firms
Researchers at Rapid7 said the Crimson Collective has been exploiting exposed AWS credentials to create privileged IAM users, export database and storage snapshots for exfiltration, and issue extortion demands; AWS recommended using short‑term, least‑privileged credentials and provided remediation guidance.
-
Security firm flags in-the-wild exploitation of Pandoc flaw CVE-2025-51591 to target AWS IMDS
Security researchers at Wiz have observed in-the-wild exploitation of CVE-2025-51591, a Pandoc flaw that enables SSRF against AWS EC2 IMDS, with attackers attempting to exfiltrate data via crafted iframes. The activity underscores the importance of IMDSv2 and least-privilege IAM roles to mitigate cloud credential exposure.
-
GhostAction: GitHub supply-chain attack exposes 3,325 secrets across hundreds of repositories
Researchers say a GitHub supply-chain campaign named GhostAction stole about 3,325 secrets across PyPI, npm, DockerHub, GitHub tokens, Cloudflare, and AWS keys, by compromising maintainer accounts to inject malicious GitHub Actions workflows that exfiltrate secrets to an attacker-controlled endpoint.
-
Critical Amazon ECS Vulnerability Exposed: Researchers Present ECScape Attack Method
A critical vulnerability in Amazon Elastic Container Service (ECS) has been discovered, enabling attackers to exploit an ‘end-to-end privilege escalation chain.’ Dubbed ECScape by researchers, the attack could allow malicious containers to gain higher privileges and access sensitive data within cloud environments.
-
KiranaPro CEO Reports Targeted Cyberattack Leading to Loss of Critical Infrastructure
KiranaPro CEO Deepak Ravindran reported a targeted cyberattack that deleted vital data from the grocery app’s GitHub and AWS accounts, raising concerns about insider threats and prompting an overhaul of security measures.
-
Coordinated Scanning Operation Targets Exposed Systems in Japan
A recent coordinated reconnaissance campaign involving 251 malicious IP addresses aims at exploiting vulnerabilities in web infrastructure, according to cybersecurity firm GreyNoise. The firm warns that organizations should take immediate action to block these IPs to reduce exposure.
