Identity Compromises Drive Surge in Cloud Attacks

First seen 25 Nov 2025, 08:25 UTC • Thefastmode

•72% similarity •9

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

A report from ReliaQuest reveals that 99% of cloud accounts are over-privileged, leading to a rise in identity-related attacks. In Q3 2025, identity compromises accounted for 44% of true-positive alerts, primarily due to excessive permissions and credential abuse. Organizations are urged to enhance their identity management practices to mitigate these risks.

ThreatCluster AI How this analysis works

Attack Flow

11 entities, 14 inferred relationships (STIX 2.1).

Technique (3)

Data Breach
Malware
Phishing

Campaign (2)

Operation Windigo
Snowflake Campaign

Organization (2)

Google
Microsoft

Malware (2)

Ebury
Linux/Moose

Affected Platform (2)

GitHub
Telegram

Relationships

Operation Windigo uses Ebury
Operation Windigo uses Linux/Moose
Snowflake Campaign uses Ebury
Snowflake Campaign uses Linux/Moose
Ebury targets Google
Ebury targets Microsoft
Linux/Moose targets Google
Linux/Moose targets Microsoft
Data Breach targets GitHub
Data Breach targets Telegram
Malware targets GitHub
Malware targets Telegram
Phishing targets GitHub
Phishing targets Telegram

Community

Browse all →

Tracked Entities in This Story

Ebury Linux/Moose Operation Windigo Snowflake Campaign Google Microsoft GitHub Telegram

Identity Compromises Drive Surge in Cloud Attacks

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story