Threat intelligence, cloud security research & product updates
The Red Team was silently reading the SOC emails to monitor whether their malicious activity had been detected. They did this by compromising a workload identity and logging into to Entra as the identity.
When securing Microsoft Entra ID, most security teams spend their energy configuring user-focused controls: enforcing Multi-Factor Authentication (MFA), setting up risk-based sign-in policies, and blocking legacy authentication.
The Cybersecurity and Infrastructure Security Agency (CISA) recently released an eye-opening report. The report emphasizes that even some of the most advanced red teamers (the ones government agencies look to for advice) rely on everyday techniques that have been in the public domain for years. In this post, we’ll break down what a PRT is, demonstrate how attackers extract and use it, and outline how you can protect your organization using the findings from the report.
The Cybersecurity and Infrastructure Security Agency (CISA) recently released an eye-opening report, "A Tale of Two SOCs". The results are striking. Not because they reveal groundbreaking zero-days, but because they emphasize that even some of the most advanced red teamers (the ones government agencies look to for advice) rely on everyday techniques that have been in the public domain for months, if not years.
CISA conducted concurrent red team assessments at two major organizations: Organization A and Organization B. The assessments yielded two drastically different stories of on-premises defense. Here are the lessons learned for CISOs.
This is part 1 of a multi series blog post.
A practitioner-led guide to Azure penetration testing, the real attack lifecycle, the common misconfigurations, and what a proper Azure security assessment covers.
Most Azure security assessments stop at the perimeter. A real penetration tester starts where a real attacker starts: with the identity layer, the overprivileged service principals, and the misconfigured role assignments that almost every Azure tenant has accumulated without knowing it.
Many organizations set "Users can register applications" to No, assuming this stops users from interacting with rogue apps. The Result: Our testing showed this has no impact on OAuth phishing.
In the modern threat landscape,
The Azure cyber threat landscape has shifted from opportunistic incidents to highly coordinated campaigns. During the Microsoft fiscal year 2025 (July 1, 2024 – June 30, 2025), Microsoft actively tracked over: 60 nation-state actors, 50 ransomware groups, 368 access brokers operating globally within the same year. We reviewed and analyzed Microsoft’s findings, technical writings and recommendations and here’s what we found.
The Azure cyber threat landscape has shifted from opportunistic incidents to highly coordinated campaigns. During the Microsoft fiscal year 2025 (July 1, 2024 – June 30, 2025), Microsoft actively tracked over:
We previously detailed how a pro-Iran hacktivist group compromised a single administrative account and weaponized legitimate Microsoft Intune features to remotely wipe over 200,000 devices across 79 countries. In this post we detail what admins can do to protect themselves and what loopholes they should be aware of.
The 2026 Stryker incident serves as a critical warning for organizations relying on cloud-based management planes.
On March 11, 2026, the medical technology giant Stryker fell victim to a massive, geopolitically motivated cyberattack that paralyzed its global operations. Claimed by the Iran-linked group Handala. The incident stands as a landmark case of a corporation’s own administrative tools being turned into a weapon.
On March 11, 2026, the medical technology giant
