When Your Partner Betrays You - Trusted Relationship Compromise in the Cloud

Explore how nation-state adversaries and cybercriminals exploit trusted relationship compromises in cloud environments through this 21-minute conference talk by cloud threat intelligence expert Sebastian Walla. Learn about two real-world incident response cases where threat actors compromised a Microsoft Cloud Solution Provider and a SaaS Provider to gain lateral access to downstream customers' Office 365 email environments. Discover the techniques used by attackers including COZY BEAR's methods for accessing Entra ID environments, understand how to hunt for these attack patterns in your own environment, and examine effective mitigation strategies. Gain insights into the unique challenges and defensive shortcomings when protecting against supply chain attacks in cloud infrastructure, moving beyond traditional endpoint-focused trusted relationship compromises to understand the evolving threat landscape in cloud environments.