The Cado Blog

Read timely commentary on the latest in digital forensics from the Cado Security team.

Blog

September 17, 2021

Azure OMI Vulnerability OMIGOD (CVE-2021-38647) Now Under Exploitation

Azure users running Linux virtual machines are at risk of compromise unless they upgrade now. A vulnerable piece of management software in the Open Management Infrastructure (OMI) framework can be remotely exploited by attackers enabling them to escalate to root privileges and remotely execute malicious...

Free Resources, Research & Threat Intel

Cloud DFIR, Free Resources

September 16, 2021

The Ultimate Guide to Docker & Kubernetes Forensics

Introduction As organizations continue to migrate their computing resources to cloud and container environments, attackers...

Free Resources, Research & Threat Intel

September 14, 2021

TeamTNT Script Employed to Grab AWS Credentials

A TeamTNT script has been employed to target a Confluence vulnerability that grabs AWS credentials including those from ECS. ...

Cloud DFIR, Research & Threat Intel

September 9, 2021

Quick Recap: Azurescape

As you may have seen today, Palo Alto published a brilliant technical report: Finding Azurescape – Cross-Account Container...

Cloud DFIR

September 7, 2021

Your Questions Answered: Cloud & Kubernetes Memory Forensics

Last week, James Campbell, Cado Security’s Co-Founder and CEO and Al Carchrie, Digital Forensics Solutions Engineer, hosted...

Announcements, Cloud DFIR

August 26, 2021

Cado Security Offers Organizations a Free Cloud Investigation

It is with great excitement that we announce a new offering that provides enterprises a free cloud investigation. The Cado...

Free Resources

August 16, 2021

It's Time to Buff Your Cloud Game

Last month James Campbell, Cado Security’s Co-Founder and CEO, and Al Carchrie, Digital Forensics Solutions Engineer, provided...

Announcements, Cloud DFIR

August 3, 2021

Cado Security Unveils Memory Forensics For Enhanced Visibility and Context

We’re excited to announce the addition of memory forensics capabilities to the Cado Response platform. Cado’s...

Research & Threat Intel

July 14, 2021

Triage analysis of Serv-U FTP user backdoor deployed by CVE-2021-35211

Last night, Microsoft published a blog titled Microsoft discovers threat actor targeting SolarWinds Serv-U software with...

Cloud DFIR, Free Resources

July 13, 2021

Resources for Investigating Cloud and Container Penetration Testing Tools

Cloud and container penetration testing tools are frequently used by real-world attackers. Some of these toolsets are quite...