In this three part blog series we will explore attack paths that emerge out of Managed Identity assignments in three Azure services.

This write up is about a pentest we did in which we managed to compromise a hybrid GCP hosted infrastructure using native GCP tools for…

Look at a realistic cloud penetration test situation and see how to utilize the AWS CloudTrail service to discover AWS accounts that you could pivot to.

Contribute to wiz-sec-public/cloud-middleware-dataset development by creating an account on GitHub.

The cloud control plane can be difficult to understand. In this article we examine attack scenarios and how to harden your GCP environment. Learn more.

Wiz Research builds upon previous “OMIGOD” findings with a presentation at RSA Conference 2022; details how cloud middleware use across cloud service providers can expose customers' virtual machines to new attack vectors

SynLapse was a vulnerability in the Azure Synapse Analytics service discovered by one of Orca Security’s vulnerability researchers, Tzah Pahima.

Our guide details a GCP incident, from initial attacker access to resolution. Learn our key takeaways for securing your cloud environment.

With this initial analysis, Tempest researchers identified at least 41 actions that can lead to improper data access

Identity and access management is a pillar of security. With the advent of the cloud, it got a lot more complicated. Here is a recap of the best practices to put in place to secure AWS IAM.

Learn more about a potentially harmful Office 365 functionality that allows ransomware to encrypt files stored on SharePoint and OneDrive. Read more with Proofpoint.

The Orca Cloud Security Platform delivers the world's most comprehensive coverage and visibility of risks across the cloud. Read our most recent blog posts!

At Permiso, we find that the majority of incidents we discover or respond to, start with exposed access keys. Attackers leverage these keys to gain access, then setup a mechanism to establish persistence, perform reconnaissance, and complete their mission.

Preventing escalation from initial access in your Active Directory (AD) environment to Domain Admins can feel impossible, especially after…

FabricScape (CVE-2022-30137) is a privilege escalation vulnerability of important severity in Microsoft's Service Fabric, commonly used with Azure.

This will walk through the CloudGoat AWS detection_evasion scenario, detailing how to avoid AWS security detection and response services, such as in Lambda

Cloud vulnerabilities database - an open project to list all known cloud vulnerabilities and Cloud Service Provider security issues