Threat Research at WIZ
Israel
Joined March 2016
- Tweets130
- Following224
- Followers171
- Likes1K
Shay Berkovich retweeted
It's been such a tough October for AI Developer Platforms ... that two more disclosed incidents while we were writing up this blog: wiz.io/blog/black-october-fo…
Check it out for details on what we're seeing attacks do with compromised credentials from the recent incidents
Shay Berkovich retweeted
🫂"hugs from TeamPCP."
We're now 47 days and three rounds deep into the Checkmarx incident -- and this time TeamPCP left a message for victims in `~/hugs_from_teamPCP.txt`
Things appear mitigated, but waiting to see if rotation was a bit more atomic this time 🤞
Shay Berkovich retweeted
Preliminary exploit detections for Copy Fail (CVE-2026-31431) based on our tests (these work best in combination):
1. "NET: Registered PF_ALG protocol family" in kern.log & syslog
2. curl for "copy[.]fail/exp" (if attacker is lazy)
3. su record without invoking user in auth.log
Shay Berkovich retweeted
Fork commits keep showing up in supply chain attacks (tj-actions, reviewdog, TeamPCP).
But, I keep seeing incorrect explanations in incident threads/blogs
So I built a microsite to cut through the confusion
🔗in🧵
Shay Berkovich retweeted
UPDATE: Shai-Hulud 2.0 has a long tail, and it may have led to $7M in crypto theft.
Earlier today, our update laid out how sha1-hulud may have caused the Trust Wallet incident.
Trust Wallet just announced the same conclusion 📷Read our analysis >> wiz.io/blog/snipping-the-lon…
Shay Berkovich retweeted
🪱sharing more on sha1-hulud w/@sshaybbc
* 2 packages == ~60% of infections
* 400k unique secrets in truffleSecrets.jsons, only 2.5% verified, & the majority of those short lived JWTs for GitHub Actions!
* 3/4 of impacted workloads were CI/CD, 1/4 were users
🔗below
Shay Berkovich retweeted
More from me on s1ngularity, the Nx supply chain attack.
We @wiz_io took advantage of the break in attacker activity to break down:
* overall impact
* efficacy of the AI usage (not great!)
* TTPs and investigation breadcrumbs we've seen to date
* our work to notify victims
Shay Berkovich retweeted
😱Imagine waking up to see all your private github repositories were published publicly ...
That's what happened overnight for >400 users/orgs and >5000 repositories
s1ngularity (the Nx supply chain attack) continues to bear fruit for attackers.
Rotate ASAP!
ALT diagram of s1ngularity attack
Shay Berkovich retweeted
In light of recent GitHub Actions incidents (Ultralytics, tj-actions...), I wrote up a practical guide to hardening for @wiz_io
Covers permissions, secrets, 3rd-party Actions, ++
Use it to avoid learning these lessons the hard way:
wiz.io/blog/github-actions-s…
Shay Berkovich retweeted
🔍IT'S HERE: #ExfilCola, our cloud IR security CTF challenge!🥤
Your mission:
- Investigate the cloud environment logs
- Research the compromised machines
- Secure the files and save the day
⏰ The Cloud Hunting Games are live >> cloudhuntinggames.com/
Shay Berkovich retweeted
😺 Cat's out of the bag
We've updated our blog post on the `tj-actions` / `reviewdog` incident to disclose the target. We also have new details on the root cause of the `reviewdog` element.
h/t @sshaybbc for a ton of leg work here
Shay Berkovich retweeted
🔥 You can now add TruffleHog to Burp Suite!
🌐 Install it directly from the BApp Store
🔍Scan web traffic for live, verified credentials—active & exploitable
Because secrets don’t just leak in code… 😬
Big Thanks to @PortSwigger ! 🙌
🔗trufflesecurity.com/blog/int…
Shay Berkovich retweeted
Thrilled to finally share this—one of the coolest container escapes I’ve seen! 🔥
wiz.io/blog/nvidia-ai-vulner…
A subtle logic bug that lets you break out to the host on ANY NVIDIA GPU-supported container 🤯
Can’t believe we had to sit on the technical details for so long! Incredible research by @shirtamari @ronenshh @AndresRiancho
A couple of months ago, we at @wiz_io discovered a container escape vulnerability in the NVIDIA Container Toolkit, which impacts many cloud and AI SaaS providers. We're finally able to share the technical details.
wiz.io/blog/nvidia-ai-vulner…
Shay Berkovich retweeted
🚨 Supply chain attack alert: The curious case of #Ultralytics.
A #GitHub Action compromise led to the release of malicious versions (8.3.41, 8.3.42) of the popular Ultralytics Python package, embedding a cryptominer into systems via PyPI.
Shay Berkovich retweeted
🌩️ CLOUD THREAT MONTHLY ROUNDUP 🌩️
🚨Storm-0501 targets hybrid environments, exploiting on-prem vulnerabilities & Microsoft Entra IDs.
🐧REF6138 hits Linux Apache2 with DDoS, cryptominers & malware.
⚠️perfctl hijacks Linux servers stealthily.
Read more: threats.wiz.io
Shay Berkovich retweeted
🎙️ Don't miss the latest #CryingOutCloud episode! @AmitaiCo & Eden dive into cloud security challenges, AI vulnerabilities, Info Stealers Mitigation, and more.
Tune in!
📺 youtube.com/watch?v=RjdZgyLj…
🍏podcasts.apple.com/us/podcas…
Shay Berkovich retweeted
We discovered a container escape vulnerability in the @NVIDIA Container Toolkit. It allows attackers to gain full access to the host's filesystem and achieve Remote Code Execution (RCE).
Here's everything you need to know about CVE-2024-0132 🧵👇
Shay Berkovich retweeted
Check out the first entry in our new blog series on cloud IOCs, a subject I'm quite passionate about.
We've also launched a new open source collection of such indicators, available here (we'll be updating this regularly): github.com/wiz-sec-public/wi…
Atomic #IOCs in Cloud Security ⚛️
Threat detection in the cloud requires new types of indicators of compromise sourced from threat intelligence.
Check out our new blog series from @amitaico and @merav_br to learn more. wiz.io/blog/mastering-cloud-…
Shay Berkovich retweeted
Someone just exploited github.com/stripe-samples/ac… with a Pwn Request and added their payloads to the main branch… @stripe
Shay Berkovich retweeted
We found a Remote Code Execution (RCE) vulnerability in @Ollama - one of the most popular AI inference projects on GitHub. Here is everything you need to know about #Probllama (CVE-2024-37032) 🧵👇
