Posts under the Adversary Intelligence

Articles in Blog Posts

June 4, 2025

AMOS Variant Distributed Via Clickfix In Spectrum-Themed Dynamic Delivery Campaign By Russian Speaking Hackers

CloudSEK researchers have uncovered a sophisticated campaign leveraging typo-squatted “Spectrum” domains to spread a new Atomic macOS Stealer (AMOS) variant. Disguised as a CAPTCHA verification, the attack uses dynamic payloads tailored to the victim's OS—stealing passwords, bypassing macOS security, and executing malware. With Russian-language comments found in the code and flawed delivery logic, the campaign reflects both growing cross-platform ambitions and rushed execution. Dive into how this multi-platform threat operates—and why your organization should stay alert.

Written by

Koushik Pal

April 29, 2025

Inside the BWSSB Incident : How An Exposed Environment File Enabled the Sale of 290K+ Applicant Records and Database Root Access

A small security slip — an exposed file and an open admin panel — gave a hacker full access to BWSSB’s database, putting over 290,000 people’s personal details at risk. CloudSEK’s STRIKE Team breaks down how it happened, what went wrong, and what can be done to prevent such breaches.

Written by

Sourajeet Majumder

March 21, 2025

The Biggest Supply Chain Hack Of 2025: 6M Records Exfiltrated from Oracle Cloud affecting over 140k Tenants

CloudSEK uncovers a major breach targeting Oracle Cloud, with 6 million records exfiltrated via a suspected undisclosed vulnerability. Over 140,000 tenants are impacted, as the attacker demands ransom and markets sensitive data online. Learn the full scope, risks, and how to respond. Are you worried your organization might be affected? Check your exposure here - https://exposure.cloudsek.com/oracle

Written by

CloudSEK TRIAD

March 11, 2025

The Dark Side of eCommerce: How Fake Review Networks Manipulate Online Shopping

Ever bought a product online, convinced by its glowing five-star reviews, only to receive something completely different—or worse, useless? You're not alone. The rise of fake review networks is distorting the trust we place in eCommerce platforms. Behind the scenes, sellers and marketing agencies are orchestrating elaborate scams, using WhatsApp and Telegram groups to flood product listings with deceptive praise. From refund-for-review schemes to “empty box deals,” these tactics don’t just trick shoppers—they undermine honest businesses and erode trust in online shopping. Let’s dive into the dark underbelly of eCommerce and uncover how fake reviews are shaping what we buy.

Written by

Mayank Sahariya

January 16, 2025

15K Fortigate Firewall Configs Leaked By Belsen Group: Dumped Using Zero-Day in 2022

Discover how the Belsen Group exploited a zero-day vulnerability in 2022 to leak over 15,000 Fortigate firewall configurations, exposing sensitive credentials, firewall rules, and management certificates. This high-impact cyber incident, detailed in our analysis, highlights the risks of authentication bypass vulnerabilities and offers crucial mitigation strategies, including credential updates, firewall audits, and certificate rotation. Stay informed and secure your network against evolving threats with actionable insights from this comprehensive report.

Written by

Koushik Pal

March 24, 2025

Part 2: Validating the Breach Oracle Cloud Denied – CloudSEK’s Follow-Up Analysis

On March 21, 2025, CloudSEK’s XVigil platform flagged a significant threat—a threat actor offering 6 million exfiltrated records from Oracle Cloud for sale. Despite Oracle’s public denial, our deep-dive investigation reveals a compromised production SSO endpoint, affecting over 140,000 tenants and exposing sensitive SSO and LDAP data. Our report outlines verified evidence of the breach. At CloudSEK, we prioritize transparency and preparedness. This detailed follow-up not only challenges initial denials but equips enterprises with actionable steps to assess and secure their environments. Read the full report to uncover the evidence, understand the impact, and strengthen your defenses.

Written by

Rahul Sasi

Adversary Intelligence

Articles in Blog Posts

AMOS Variant Distributed Via Clickfix In Spectrum-Themed Dynamic Delivery Campaign By Russian Speaking Hackers

Inside the BWSSB Incident : How An Exposed Environment File Enabled the Sale of 290K+ Applicant Records and Database Root Access

The Biggest Supply Chain Hack Of 2025: 6M Records Exfiltrated from Oracle Cloud affecting over 140k Tenants

The Dark Side of eCommerce: How Fake Review Networks Manipulate Online Shopping

15K Fortigate Firewall Configs Leaked By Belsen Group: Dumped Using Zero-Day in 2022

Part 2: Validating the Breach Oracle Cloud Denied – CloudSEK’s Follow-Up Analysis

Articles in Threat Intelligence

Cowin data leak claim and CloudSEK analysis

Anonymous Sudan Claims Successful Takedown of First Abu Dhabi Bank Website & Application Via DDoS Attacks

What they do in the ShadowSEO: An Underground SEO from Russia

3,20,000+ Patient Records From Ayush Jharkhand Gov. In Shared On Dark Web Hacking Forums

CVE-2023-4197 Vulnerability in Dolibarr ERP CRM 18.0.1 Allows PHP Code Injection

Rogue Scripts Are Exploiting OTP Verification APIs To Send Heaps of OTP SMSes, Hold The Potential Of Triggering Service Disruptions.

انضم إلى أكثر من 10,000 مشترك