Cloud Red Team Archives

JUMPSEC LABS

The JUMPSEC Lab is a place where the technical team get creative and showcase their latest security research, publications, interesting news and general thoughts! We love what we do and are passionate about security, with some great upcoming projects planned, bookmark our site and stick around to see what we are working on.

How Cloud Migration is Affecting AppSec – A Red Teamer’s Perspective

by Max Corbridge | Jul 4, 2024 | Application Security, Azure Cloud, Azure DevOps, Cloud Red Team, Initial Access, Jumpsec, Red Teaming

Introduction I’ve recently spoken at several conferences about the changes that are underway within red teaming as a result of cloud migration. My team and I have been delivering majority cloud red team work over the last year and the differences are becoming more apparent by the day. One point I’ve mentioned as ‘controversial’ at several of these events is that cloud migration has actually made AppSec more important than ever. I went some way to trying to explain why I think this is during my...

Poisoning Pipelines: Azure DevOps Edition

by Francesco Iulio | May 9, 2024 | Azure Cloud, Azure DevOps, Cloud Red Team

Introduction In the ever-evolving realm of cloud services, organisations are ditching the headaches of physical infrastructure management and diving headfirst into the possibilities of cloud platforms. From the humble beginnings of deploying virtual machines and servers, we now find ourselves in a dynamic space with everything from serverless architectures to cloud-based active directories, seamless SaaS integrations, architectural blueprints, collaboration tools, AI assistants, and more....

Why sneak when you can walk through the front door – A Love letter to Password Spraying against M365 in Red Team Engagements

by Sunny Chau | May 2, 2024 | Azure Cloud, Cloud Red Team, Initial Access

In 2023 through 2024, JUMPSEC's red team gained access to Microsft 365 (M365) environments of sophisticated clients during adversarial engagements with an approach that breathes life into the decades-old technique of password spraying. With threat actors increasingly using similar approaches in the wild, being able to compromise the even likes of Microsoft themselves, it is my opinion that red teams might benefit from incorporating some of these techniques into their initial access arsenal, or...

JUMPSEC LABS

Why sneak when you can walk through the front door – A Love letter to Password Spraying against M365 in Red Team Engagements

[Latest Posts]

[Categories]

GitHub

Follow JumpsecLabs

Disclaimer