Threat Actor Exploits Vulnerabilities to Abuse Elastic Cloud SIEM for Data Theft

Cybersecurity researchers from Huntress have uncovered a campaign where a threat actor exploited multiple software vulnerabilities, including the SolarWinds Web Help Desk, to exfiltrate data to a free trial instance of Elastic Cloud's SIEM platform. This incident affects numerous organizations as the attacker utilized the SIEM for victim triage, revealing connections to disposable email services and a Russian-registered temporary email network.