[Webinar] What Insider Threats Actually Look Like - A Lesson From the Rippling Lawsuit

[WATCH NOW]

Announcing Permiso Discover - A free identity inventory & visibility for human, non-human and AI

[Join the Waitlist]

Platform
Resources
Blog
About

Sign In
Request A Demo

Platform
- Permiso  Platform
  
  Our unified identity security platform combines Identity Security Posture Management (ISPM) with Identity Threat Detection and Response (ITDR) to protect all of your human and non-human identities, wherever they go.
  
  Learn More
- Solutions
  Integrations
  
  Permiso Discover
- Use Cases
- See Permiso in action
  
  Demo, please!
Resources
- Resource Center
  - Report
  - eBook
  - Collateral
  - Webinar
  - Press
- Guides
- Featured Resources
  
  CISO Guide to Detecting and Preventing Identity Attacks
  Learn More
  
  The Human Touch In Creating and Securing Non-Human Identities
  Learn More
Blog
About
- About
  
  P0 Labs
- Careers
  
  Contact
- Hear Ye, Hear Ye
  
  Subscribe to Cloud Chronicles for the latest in cloud security!

© Permiso Security 2022

|Privacy Policy|Terms

Cloud Chronicles

The latest research, reports and releases from the minds at Permiso Security.

module_168716615926221

Ian Ahl

When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying

Ian Ahl | 10.03.24

Key Takeaways Attacks against GenAI Infrastructure like AWS Bedrock have increased substantially over the last six (6) months. Particularly with exposed access keys. Attackers are hijacking victim...

Illustration Cloud

Illustration Cloud

All Categories

Ian Ahl

When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying

Ian Ahl

Featured, Research

When AI Gets Hijacked: Exploiting Hosted Models for Dark Roleplaying

Ian Ahl 10.03.2024

Key Takeaways Attacks against GenAI Infrastructure like AWS Bedrock have increased substantially over the last six (6) months. Particularly with exposed access keys. Attackers are hijacking victim...

Thank You

Credits: Brianne Cartwright

Ian Ahl

Déjà Vu or New View: Latest Okta Credential Stuffing Campaign

Ian Ahl 05.02.2024

Summary On April 26, 2024 Okta reported observing a large scale credential stuffing attack that shares infrastructure with a campaign previously reported by Cisco Talos. The campaign that Cisco...

LUCR-3: Scattered Spider Getting SaaS-y in the Cloud

Ian Ahl

Featured, Featured Research, Research

LUCR-3: Scattered Spider Getting SaaS-y in the Cloud

Ian Ahl 09.20.2023

Summary LUCR-3 overlaps with groups such as Scattered Spider, Oktapus, UNC3944, and STORM-0875 and is a financially motivated attacker that leverages the Identity Provider (IDP) as initial access...

Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor

Ian Ahl

Unmasking GUI-Vil: Financially Motivated Cloud Threat Actor

Ian Ahl 05.22.2023

Summary (the TL;DR) Permiso’s p0 Labs has been tracking a threat actor for the last 18 months. In this article we will describe the attack lifecycle and detection opportunities for the cloud-focused,...

Legion: The Latest Threat in Mass Spam Attacks

Ian Ahl

Legion: The Latest Threat in Mass Spam Attacks

Ian Ahl 04.13.2023

Summary As the old proverb says, “Great minds think alike”. Many people may not know or remember the second half of that proverb, “Fools seldom differ.” Both sides of these adages are very well...

Our Approach to Detection: AndroxGh0st and GreenBot Edition

Ian Ahl

Our Approach to Detection: AndroxGh0st and GreenBot Edition

Ian Ahl 02.23.2023

Introduction The Permiso p0 Labs team has one core focus: know everything we can about cloud attacks, and make that knowledge actionable to our customers via detections in our CDR product. When we...

Permiso 2022 - End of Year Observations

Ian Ahl

Press, Research

Permiso 2022 - End of Year Observations

Ian Ahl 02.06.2023

In 2022, Permiso's Cloud Detection & Response platform detected a multitude of different security events across client cloud infrastructure environments. In all cases, the detected suspicious and...

Gather Round the Watering Hole, We have a story to tell

Ian Ahl

Gather Round the Watering Hole, We have a story to tell

Ian Ahl 01.31.2023

Summary Watering hole attacks are an often underrated technique. On January 29th, 2023 Chris Farris reported to members of the “Cloud Security Forum” slack channel that he saw a google ad delivering...

Cloud Cred Harvesting Campaign - Grinch Edition

Ian Ahl

Cloud Cred Harvesting Campaign - Grinch Edition

Ian Ahl 12.29.2022

Summary Attacks during the holidays are more reliable than Santa eating cookies. On December 28, 2022, Permiso Security’s p0 Labs team identified a credential harvesting campaign targeting cloud...

Password spray enters the Okta-gon

Ian Ahl

Password spray enters the Okta-gon

Ian Ahl 09.16.2022

Identity Providers (IDPs), like Okta have always been a juicy target for threat actors of all skill levels. Attackers often still find success with low sophistication techniques like password...

You down with IDP? Impersonate me!

Ian Ahl

You down with IDP? Impersonate me!

Ian Ahl 08.29.2022

Summary Permiso Security and ACV Auctions, while collaborating on cloud detection efforts, discovered an impersonation technique in Okta application user assignments. Based on “in the wild”...

P0 Labs: Helping stay ahead of cloud adversaries

Ian Ahl

Press, Research

P0 Labs: Helping stay ahead of cloud adversaries

Ian Ahl 06.21.2022

As organizations continue to accelerate the shift to cloud, adversaries are following. Over the past ten (10) years I have had the opportunity to lead some of the largest and most impactful public...

Anatomy of an Attack: Exposed keys to Crypto Mining

Ian Ahl

Anatomy of an Attack: Exposed keys to Crypto Mining

Ian Ahl 06.20.2022

At Permiso, we find that the majority of incidents we discover or respond to, start with exposed access keys. Attackers leverage these keys to gain access, then setup a mechanism to establish...

Cloud vendor supply chain risk - Forecast: Foggy with a chance of thunderstorms

Ian Ahl

Cloud vendor supply chain risk - Forecast: Foggy with a chance of thunderstorms

Ian Ahl 05.05.2022

Attackers are increasingly taking advantage of trusted vendor relationships to perform software and service based supply chain attacks. As cloud adoption continues to grow, we will see sophisticated...

Permiso weighs in on CrowdStrike's LemonDuck malware finding

Ian Ahl

Permiso weighs in on CrowdStrike's LemonDuck malware finding

Ian Ahl 05.03.2022

On April 22, Permiso provided their perspective of CrowdStrike’s recent publication on LemonDuck malware shifting targeting to container and cloud technologies in the CSO Online article “Cryptomining...

Hear Ye, Hear Ye

Subscribe to Cloud Chronicles for the latest in cloud security!

21972-312_SOC_NonCPA

Product
P0 Labs
Request a demo
About
Blog
Contact Us
Join Our Team
Resources
Sign In

© Permiso Security 2025

Security|Privacy Policy|Terms