CloudSEK

Every investigation shouldn’t start with six tabs and three different tools. CloudSEK MCP v1.0 is now live. 🚀 It connects the AI clients security teams already use, including Claude, Gemini CLI, Codex CLI, Kiro and Cursor, directly with live CloudSEK intelligence through the Model Context Protocol. Now analysts can simply ask for the outcome: - Build a morning triage brief. - Enrich an IOC and correlate related incidents. - Review evidence, propose an action and verify it after approval. For SOC, CTI and security teams, this means less tool switching, faster investigations and more context in one workflow. 35+ tools. One hosted endpoint. Setup in minutes. 📖 Setup guide: https://lnkd.in/ga9fNbPk What’s the first security workflow you would hand over to your AI client? #CyberSecurity #ThreatIntelligence #SOC #MCP #AIforSecurity #CloudSEK

We welcome Rashmi Tc as a Customer Success Associate at CloudSEK. Rashmi will be focusing on building strong customer relationships, driving product adoption and engagement, and ensuring customers realize measurable business value from CloudSEK’s platform. Prior to joining CloudSEK, Rashmi brings over six years of experience in the cybersecurity industry, supporting the AMEA partner ecosystem. She has worked closely with partners, distributors, and channel teams across the region, driving enablement initiatives, strengthening cybersecurity capabilities, and supporting the adoption of security solutions. #welcometotheteam #welcomeonboard #cybersecurity #cloudster

More than 2,500 organisations worldwide have been potentially exposed in one of the biggest AI supply-chain incidents of 2026. CloudSEK’s research links the exposure to major organisations across technology, finance, telecom, cybersecurity, manufacturing and logistics — with cloud credentials, source-code access, server keys and AI/API credentials potentially at risk. The bigger concern: even after the malicious package is removed, stolen credentials can remain valid and be reused for future attacks. Read the full research: https://lnkd.in/gPR8KVnH Check exposure: https://lnkd.in/g7r2-NTi

Hi Security community, critical alert: we are disclosing the details of the largest AI supply-chain breach of 2026. Over 2,500+ companies and 434,000 CI/CD pipelines were affected, and thousands of keys exfiltrated. Those exposed range from large AI companies , model providers, large cybersecurity vendors, and enterprises worldwide.  The exposed data is from LiteLLM supply chain attack of March where anyone who tried to self host LLMs are impacted. We are sharing this openly so that every affected organization can act proactively. We have created a free tool that lists all the exposed organizations and a method to get the exposed keys - https://lnkd.in/gx8-w2z6 Detailed blog - https://lnkd.in/gm3DBw2r

CloudSEK uncovered a Russia-nexus threat actor simultaneously operating as an initial access broker for ransomware groups while conducting large-scale collection against Ukrainian defence and critical infrastructure. Organisations whose networks the operator held access to resurfaced on ransomware leak sites weeks later, each claimed by a different group. Rather than serving a single ransomware programme, the operator supplied access across several groups. The investigation reconstructs the operator's workflow from internet-scale exploitation and credential theft to Active Directory compromise, espionage, and AI-assisted offensive tooling. Read the full investigation: https://lnkd.in/gx6aTZ5Q #ThreatIntelligence #CyberSecurity #ThreatResearch #Ransomware #Cybercrime #Espionage #CloudSEK

🏏⚡ Taking it back to the 𝗖𝗹𝗼𝘂𝗱𝗦𝗘𝗞 𝗣𝗿𝗲𝗺𝗶𝗲𝗿 𝗟𝗲𝗮𝗴𝘂𝗲 𝟮𝟬𝟮𝟲—where the big hits were bigger, the close calls were closer, and the cheering never stopped. This is what happens when CloudSters bring their competitive drive off the screen and onto the field. Dive back into the high-octane energy of CPL 2026 below! 👇 #cloudsek #cloudsekpremierleague #cricket

🩺 A medical report should only be seen by two people. The patient and the doctor. 🔓 A large diagnostic service provider inadvertently 𝗲𝘅𝗽𝗼𝘀𝗲𝗱 𝗔𝗣𝗜 𝗸𝗲𝘆𝘀 𝗮𝗻𝗱 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝘁𝗼𝗸𝗲𝗻𝘀 𝗶𝗻𝘀𝗶𝗱𝗲 𝗮 𝗽𝘂𝗯𝗹𝗶𝗰 𝗝𝗮𝘃𝗮𝗦𝗰𝗿𝗶𝗽𝘁 𝗳𝗶𝗹𝗲, making it possible to access sensitive patient information, including names, phone numbers, addresses, medical reports, and even take over ABHA accounts. This wasn’t just a coding mistake. It 𝘁𝘂𝗿𝗻𝗲𝗱 𝗮 𝗵𝗲𝗮𝗹𝘁𝗵𝗰𝗮𝗿𝗲 𝗮𝗽𝗽𝗹𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗶𝗻𝘁𝗼 𝗮 𝗴𝗮𝘁𝗲𝘄𝗮𝘆 𝘁𝗼 𝗱𝗲𝗲𝗽𝗹𝘆 𝗽𝗲𝗿𝘀𝗼𝗻𝗮𝗹 𝗱𝗮𝘁𝗮. 🛡️ 𝗖𝗹𝗼𝘂𝗱𝗦𝗘𝗞'𝘀 𝗕𝗲𝗩𝗶𝗴𝗶𝗹 𝘂𝗻𝗰𝗼𝘃𝗲𝗿𝗲𝗱 𝘁𝗵𝗲 𝗲𝘅𝗽𝗼𝘀𝗲𝗱 𝘀𝗲𝗰𝗿𝗲𝘁𝘀 before they could be exploited, helping prevent unauthorized access to patient records and healthcare accounts. ⚖️ Because in healthcare, protecting privacy isn't just about compliance. ❤️ It's about protecting people. Learn more about #BeVigil, CloudSEK's External Attack Surface Monitoring (#EASM) solution, here: https://lnkd.in/e9i3SRUM #attacksurfacemonitoring #compliance #hipaa #phi #datasecurity

We are giving away AirPod Max and HomePods to the security community at Black Hat. Part of CloudSEK initiative of giving back to the community and we are at Black Hat. Drop a comment if you are around or the next event you want us to show up.

🚨 An unsecured database isn’t just a misconfiguration. It’s an open invitation. 🔓 𝗠𝗼𝗿𝗲 𝘁𝗵𝗮𝗻 𝟵 𝗺𝗶𝗹𝗹𝗶𝗼𝗻 𝗱𝗮𝘁𝗮𝗯𝗮𝘀𝗲 𝗸𝗲𝘆𝘀 𝘄𝗲𝗿𝗲 𝗹𝗲𝗳𝘁 𝗲𝘅𝗽𝗼𝘀𝗲𝗱 𝘁𝗵𝗿𝗼𝘂𝗴𝗵 𝗮𝗻 𝘂𝗻𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗲𝗱 𝗥𝗲𝗱𝗶𝗻𝗜𝗻𝘀𝗶𝗴𝗵𝘁 𝗶𝗻𝘀𝘁𝗮𝗻𝗰𝗲, revealing merchant information, payment details, login IDs, secret tokens, and more. ⚠️ Even worse, an attacker could have read, edited, added, or deleted data without authentication. That’s not just a data exposure. It’s the ability to manipulate systems that businesses rely on every day. 🛡️ 𝗖𝗹𝗼𝘂𝗱𝗦𝗘𝗞'𝘀 𝗦𝗩𝗶𝗴𝗶𝗹 𝗶𝗱𝗲𝗻𝘁𝗶𝗳𝗶𝗲𝗱 𝘁𝗵𝗲 𝗲𝘅𝗽𝗼𝘀𝗲𝗱 𝗥𝗲𝗱𝗶𝘀 𝗶𝗻𝘀𝘁𝗮𝗻𝗰𝗲 through continuous monitoring, helping prevent a simple security oversight from becoming a much larger incident. Because sometimes the biggest risk isn’t sophisticated malware. 💻 It’s a database that was never meant to be public. Learn more about SVigil here: https://lnkd.in/gBV_c83u #tprm #thirdpartyriskmanagement #svigil #ThreatIntelligence #DataSecurity

Hello from cloudsek team Brazil