Wiz Report Highlights Familiar Entry Points in Cloud Attacks
Summary
Wiz’s cloud-attack retrospective draws on detections across thousands of environments, highlighting exploitation of exposed PAN-OS appliances, weak PostgreSQL credentials, phishing, and persistence via cron jobs.
Key points
- Wiz says attackers deployed web shells and Sliver implants days after PoCs for PAN-OS CVE-2024-0012 and CVE-2024-9474 became public.
- In Wiz’s analysis, 24% of monitored environments contained vulnerable PAN-OS appliances; 7% were internet-facing and exploitable via unauthenticated RCE.
- The report says the CPU_HU campaign targeted weak PostgreSQL configurations with default or guessable credentials to deploy cryptominers.
- Wiz reports that nearly one-third of analyzed environments had at least one publicly exposed self-managed PostgreSQL instance.
- The article identifies phishing as a leading cause of identity-based cloud breaches, citing 0ktapus credential-harvesting portals and Atlas Lion’s adversary-in-the-middle proxies and smishing.
- Attackers reportedly used cron jobs to relaunch cryptominers in Redis and Jenkins environments, and abused unauthenticated Selenium Grid instances to execute payloads.
- The report covers eight commonly observed MITRE ATT&CK techniques and includes guidance on detecting and disrupting attack chains.
Article Details
- Event Type
- Wiz published a retrospective report analyzing commonly observed cloud attack tactics and incidents.
- Impact
- The report describes exploitation of exposed PAN-OS appliances, weak PostgreSQL credentials, phishing and MFA-bypass activity, and persistence techniques used to deploy or relaunch cryptominers. Wiz reported that 24% of monitored environments contained vulnerable PAN-OS appliances and 7% were internet-facing and exploitable via unauthenticated RCE.
MITRE ATT&CK
T1053.003 · CronAttackers used cron jobs to relaunch cryptominers on reboot in Redis and Jenkins environments.T1078 · Valid AccountsThe CPU_HU campaign used default or guessable PostgreSQL credentials.T1190 · Exploit Public-Facing ApplicationAttackers exploited PAN-OS appliances exposed to unauthenticated remote code execution.T1496 · Resource HijackingAttackers deployed cryptominers after exploiting weak PostgreSQL configurations.T1557.004 · Evil TwinAtlas Lion used adversary-in-the-middle proxies to bypass MFA.T1566 · Phishing0ktapus used spoofed SSO portals to harvest credentials.
CVE
CVE-2024-0012Following the disclosure of CVE-2024-0012 and CVE-2024-9474 in PAN-OS, Wiz observed attackers deploying web shells and Sliver implants just days after PoCs went public. CVE-2024-9474Following the disclosure of CVE-2024-0012 and CVE-2024-9474 in PAN-OS, Wiz observed attackers deploying web shells and Sliver implants just days after PoCs went public.
Threat Actors
0ktapusUsed spoofed SSO portals to harvest credentials.Atlas LionUsed adversary-in-the-middle proxies and smishing to bypass MFA.BapakNamed as a campaign involved in the report; no further activity details are provided in the article.CPU_HUCampaign that targeted weak PostgreSQL configurations to deploy cryptominers.DiicotNamed as a campaign involved in the report; no further activity details are provided in the article.
Malware
Vendors
Products
JenkinsIn Redis and Jenkins environments, attackers used cron jobs to relaunch cryptominers on reboot.PAN-OSFollowing the disclosure of CVE-2024-0012 and CVE-2024-9474 in PAN-OS, Wiz observed attackers deploying web shells and Sliver implants just days after PoCs went public. PostgreSQLThe CPU_HU campaign targeted weak PostgreSQL configurations, exploiting default or guessable credentials to deploy cryptominers. RedisIn Redis and Jenkins environments, attackers used cron jobs to relaunch cryptominers on reboot.Selenium GridSelenium Grid instances without authentication were abused to execute payloads via browser automation.