CloudSEK Updates

A Dependency Confusion Campaign Against Tinkoff Bank's Private Package Namespace

CloudSEK’s latest research examines the LiteLLM AI supply-chain attack, which potentially exposed 2,500+ organisations and 434,000 CI/CD pipelines worldwide. The report details the risks to cloud credentials, source-code repositories, Kubernetes environments and AI infrastructure, while highlighting how compromised AI dependencies can create enterprise-wide security exposure.

CloudSEK researchers uncovered an exposed server linked to a Russian-speaking initial access broker, revealing months of operations targeting internet-facing infrastructure across multiple sectors. The investigation connects credential theft, Active Directory compromise, and access sales to ransomware groups, while also uncovering surveillance activity targeting Ukrainian defence and aerospace organizations.

A tax-season malware campaign is impersonating the Income Tax Department, sending fake penalty notices over WhatsApp. Victims who tap "Download Documents" install malware capable of harvesting OTPs and banking credentials. The advisory also covers a wider ecosystem of refund SMS fraud, cloned e-Filing portals, and fake e-PAN emails targeting Indian taxpayers this season.

France’s underground cyber threat activity has surged more than fourfold in two years, driven largely by stolen credentials, infostealer logs, ransomware, and pro-Russian hacktivism. CloudSEK’s latest report reveals how government bodies, financial institutions, and smaller organisations are becoming increasingly exposed to a fast-growing cybercrime economy.

Tomorrowland 2026 sold out fast, and scammers moved faster. CloudSEK uncovered a dozen fake ticket shops and travel sites mimicking the festival, complete with countdown timers and fake "biometric checks." Some sites harvest identity data and payments; others quietly earn commissions. Read the full breakdown of how each scam works.

Uncover how an 18-day honeypot captured 15 million automated attacks targeting telephony ecosystems in the "Copy of SIP Honeypot Report.pdf". Download the full report to expose active VoIP fraud networks and access 277,632 recovered attacker passwords.

An exposed attacker server has revealed FortiBleed’s complete operation—from credential harvesting and GPU-powered cracking to network intrusion and access sales. CloudSEK’s analysis separates verified compromises from inflated claims, uncovering what the attackers actually achieved.

An exposed attacker server revealed the inner workings of Operation Escaneo—a sophisticated campaign targeting Latin American governments and financial institutions. CloudSEK maps its custom tools, exploitation chain, persistence tactics and suspected links to MexicanMafia. Read the full investigation.