Cloud services are not as secure as you think
Cloud services are not as secure as you think#### In Security Sunday, I break down the latest threats. This time, I’m writing about ECScape, zero-day attacks on SonicWall, vishing attacks on Cisco, and new Android malware that has already infected 11,000 devices
ECScape is one of the most serious cloud service vulnerabilities discovered in 2025. This vulnerability in Amazon Elastic Container Service (ECS) allows attackers to perform privilege escalation between containers running on the same EC2 instance and steal login credentials of other tasks.
The vulnerability was discovered by researcher Naor Haziz from Sweet Security during the development of an eBPF-based monitoring tool and was disclosed at the Black Hat USA conference in Las Vegas.
ECScape exploits an undocumented internal Agent Communication Service (ACS) protocol that the ECS agent uses to communicate with the AWS control plane. Haziz discovered this protocol while investigating how ECS tasks obtain metadata.
The attack begins by obtaining the host’s IAM role credentials (EC2 Instance Role), followed by discovering the ECS control plane endpoint and collecting the necessary identifiers, including the cluster name/ARN, container instance ARN, and other parameters. The key step is to forge an ACS WebSocket request with the sendCredentials=true parameter, which allows the attacker to obtain credentials for all running tasks on the instance. The entire process is extremely inconspicuous — it mimics normal agent behavior, acknowledges messages, increments sequence numbers, and sends heartbeats, so all actions appear legitimate from AWS’s perspective.
The security implications of ECScape are extensive. A malicious container with a low-privileged IAM role can gain the privileges of a higher-privileged container, completely undermining the ECS trust model. An attacker can perform cross-task privilege escalation, exfiltrate secrets and metadata, or use the obtained credentials for lateral movement throughout the cloud environment. Particularly dangerous is the possibility of indirect data exfiltration through the theft of execution-role credentials — an attacker can access private container images in ECR, secrets in Secrets Manager or Parameter Store, or read and write CloudWatch logs of other tasks.
It is important to disable or restrict access to the Instance Metadata Service (IMDS) and implement CloudTrail alerting to detect unusual use of IAM roles.
After responsible reporting, Amazon emphasized that there is no task isolation in EC2 launch types and that securing access to instance-level credentials is the customer’s responsibility.
ECScape is not an isolated case, but part of a series of critical cloud vulnerabilities discovered in recent months, including Leaky Vessels in runC and BuildKit, issues in Google Cloud Build, Oracle Cloud Infrastructure, and Microsoft Azure. This trend demonstrates the growing sophistication of attacks on cloud infrastructures.
When “Zero-Day” is not Zero-Day: The Case of CVE-2024–40766 and SonicWall
In cybersecurity, there are few things more frightening than the words “zero-day vulnerability.” When Arctic Wolf Labs detected a massive wave of attacks on SonicWall SSL VPN, affecting even fully updated devices with the latest security patches, the initial conclusion was that this was a previously unknown critical zero-day vulnerability. However, the reality turned out to be a little more complicated.
CVE-2024–40766 is not new. This critical vulnerability with a CVSS score of 9.3 was officially disclosed in August 2024 and relates to improper access control in the SonicOS management system. The problem is that while many organizations applied the security update, they did not follow all the recommendations that came with the patch. In particular, a critical step — resetting all local user passwords after migrating from Gen 6 to Gen 7 firewalls — was often overlooked, leaving systems vulnerable despite having the “latest” firmware version.
Analysis of the attacks revealed interesting timing correlations. While a massive wave of attacks was recorded starting on July 15, 2025, similar suspicious VPN connection activity had been observed since October 2024. This suggests that the attackers had sufficient time to map vulnerable systems and prepare coordinated attacks. SonicWall later confirmed that it was investigating 40 incidents related to this activity, which is a relatively small number given the widespread use of its devices.
Vishing attack on Cisco leads to user data leak from CRM system
Cisco confirmed a data leak from its CRM system as a result of a sophisticated vishing attack. During a voice call, the attacker manipulated one of Cisco’s employees and gained access to user profiles registered on cisco[.]com.
This allowed the attacker to obtain basic personal information about users, such as names, contact emails, phone numbers, addresses, user IDs, and account metadata.
Fortunately, no passwords, sensitive data, trade secrets, or internal company information were compromised. Cisco responded immediately to the incident, blocked unauthorized access, and launched a security investigation.
Beware of PlayPraetor: New malware targeting Android
Researchers have uncovered dangerous malware targeting Android phone owners. The malware, called PlayPraetor, has already infected more than 11,000 devices worldwide.
The scammers have created fake websites that look exactly like the official Google Play Store. These sites are spread through fake Facebook ads and fraudulent SMS messages.
The malware is extremely dangerous because it can steal money from bank accounts, track everything you do on your phone, steal SMS messages, and completely control your phone remotely.