Security Research

From Remediation to Mitigation: Addressing Insecure-by-Design Flaws

Forget the obscure, some of the sneakiest bugs hide in plain sight. This blog introduces a new vulnerability class in the cloud, Insecure-by-Design Flaws.

Halberd: The Open-Source Tool Democratizing Multi-Cloud Security Testing

Arpan Sarkar

Introducing Halberd—the open-source tool democratizing cloud security testing. Empower your team to efficiently assess multiple cloud platforms.

Transitive Access Abuse - Data Exfiltration via Document AI

The Document AI service unintentionally allows users to read any Cloud Storage object in the same project and write to an attacker-controlled location.

The Unauditable, Unmanageable HMAC Keys in Google Cloud

This blog outlines three vulnerabilities surfaced from how Google Cloud handles user-asociated HMAC keys.

Encrypted Command and Control: Can You Really Cover Your Tracks?

Why uncovering command and control channels is key to stopping today’s cyber attacks.

CSV Injection in Azure Logs

Dmitriy Beryoza

With the global migration to the cloud, enterprises had to rethink how they track malicious activity in their environments.

Challenges in Azure Log Monitoring: Insights for Your SOC

Dmitriy Beryoza

Vectra AI’s Security Research Team identified issues in Entra ID and Microsoft 365 logs that make your job harder — and may help attackers evade detection.

Cloud Threat Detection Capabilities with The DeRF: Bridging the Gap in Current Tools

This new open-source tool bridges common gaps SOC teams face in cloud threat detection. Gain more flexibility to develop custom attack techniques.

Emerging Attacker Exploit: Microsoft Cross-Tenant Synchronization

Arpan Sarkar

Vectra Research recently discovered a method for leveraging functionality newly-released by Microsoft to perform lateral movement to another Microsoft tenant.

Volt Typhoon: LOLBins get serious

Joshua St. Hilaire

The recent Microsoft announcement on “Volt Typhoon” activity brings the reality of persistent threat actors back into the spotlight.

Rethinking Your Threat Models for the Cloud

Attacker techniques are dictated by the characteristics of the tech stack. So what is the approach needed to defend cloud systems?

LastPass Breach: The Pyramid of Pain Perspective

This blog outlines the intel in the LastPass communiques and enumerates the attacker indicators while framing the discussion around the "Pyramid of Pain".

Tracking Passwordless Sign-in Failures in Azure

Dmitriy Beryoza

Recently, we investigated suspicious behavior in an environment where Azure passwordless authentication was set up. Prompting the investigations was several users were hit with unexpected Authenticator app prompts. To their credit, none of the users fell for the ruse or let the attacker in.

You should get MAAD-AF about emulating attacks – it goes a long way

Arpan Sarkar

Security teams need the right tools to test cloud security controls in ways that emulate real attacker behavior to understand the gaps and ensure they have the proper visibility to stop an attacker.

OpenSSL Security Advisory

On November 1st 2022, after teasing the main show the week before, OpenSSL released their advisory describing two risks to OpenSSL 3.0.0 - 3.0.6. This was originally teased as a Critical level alert, which would have been the first Critical since 2015, however this was downgraded to a High owing to what OpenSSL describe as "mitigating factors".

Abusing the Replicator: Silently Exfiltrating Data with the AWS S3 Replication Service

A comprehensive backup strategy is a cornerstone of any DR plan. But how would you distinguish between legitimate backup activity and malicious data exfiltration?

What If there was a Supply Chain Compromise of an IDP like Okta?

What If there was a Supply Chain Compromise of an IDP? The recent security incident at Okta represents yet another perspective on supply chain compromises. This blog provides perspective on the current situation and mitigation and defense strategies to manage such an event.

Russian Cyber Attacks: What We Know so far

Updated perspective on cyberthreats as a result of ongoing Ukrainian/Russian conflict, including specific custom recall queries, and aggregation of common Russian state actor TTPs.

Mitigating, Detecting, and Responding to Russian Cyberactivity

Vectra customers should be aware that current global events related to Russian recognition of separatist regions of the Ukraine carry with them the risk of increased cyber activity conducted by Russian state level actors. This includes evidence that the FSB, the main Intelligence Organization in Russia, is responsible for the DDoS against Ukrainian systems in February 2022.

Log4J’s Unique Impact In The Cloud

Threat actors can use the Log4J vulnerability as a platform for launching attacks, but what does this mean for cloud environments? Find out exactly how attackers are exploiting this vulnerability and what this could mean for your organization.

Log4Shell - The Evolution of an Exploit

A few days after the Log4Shell vulnerability was discovered, we now have more observations about how the exploit is being leveraged. Here's what we know, today.

CVE-2021-44228: Impact of Log4j Zero-Day Vulnerability

Explore the impact of the Log4j zero-day vulnerability (CVE-2021-44228), methods of detection, and the latest exploitation attempts by threat actors.

Putting CVE-2021-1675 PrintNightmare to Rest

A new remote code execution vulnerability in Windows Print Spooler, now known as CVE-2021-1675, or PrintNightmare can be exploited by attackers to take control of affected systems. Find out how to detect and stop this exploit with Vectra.

C2 Evasion Techniques: Understanding Malleable C2 Profiles

Joshua St. Hilaire

Network and endpoint defense technologies will have to either rapidly update signatures or use other investigative ways to detect command and control (C2). Uncover how threat actors evade security tools to execute C2 techniques to learn about what you should look for.

C2 Evasion Techniques: Understanding JA3/S Randomization and Cipher Stunting

Joshua St. Hilaire

Learn how Command and Control (C2) frameworks are continuing to evolve in order to evade detection. Here we will examine a method known as JA3 signature randomization.