Critical zero-days and criminal alliances are reshaping attack exposure

At a glance

What this is: This weekly threat report ties together active zero-day exploitation, SaaS token abuse, ransomware escalation, and criminal alliance formation across the current attack surface.

Why it matters: It matters to IAM, PAM, and security teams because the report shows how quickly exposed credentials, OAuth tokens, and trusted integrations can become the entry point for broader compromise.

By the numbers:

• The Oracle E-Business Suite zero-day affected 570+ potentially vulnerable instances identified by Shadowserver Foundation.
• Censys detected 2,000+ internet-exposed Oracle E-Business Suite instances during the same exploitation window.
• The Qilin attack on Asahi Group resulted in 27 gigabytes of sensitive information being stolen.

👉 Read FireCompass's weekly report on critical zero-days and attack techniques

Context

The core security problem in this report is not a single vulnerability type, but the speed at which attackers can move from initial exposure to operational impact when internet-facing systems, SaaS tokens, and privileged integrations are left with weak governance. For identity security teams, the important pattern is that compromised access paths now span classic infrastructure, application security, and NHI controls in the same attack window.

The weekly incidents also show why identity and access controls cannot be treated as a back-office review activity. Once attackers abuse OAuth approvals, exposed credentials, or administrator pathways, the difference between a contained incident and a full business outage is often how quickly teams can detect, revoke, and segment that access.

Key questions

Q: What breaks when OAuth tokens are treated as permanent access?

A: Permanent OAuth access turns a delegated token into standing privilege, which means a compromise can be reused until someone revokes it. That increases the chance of cross-platform data exposure, secret harvesting, and lateral movement. Organisations need identity ownership, scope review, and revocation discipline for tokens, not just for human accounts.

Q: Why do public exploits and token abuse create such a fast containment problem?

A: Because the attacker’s first useful action often happens before teams finish triage. Publicly reachable flaws can be scanned and exploited quickly, while OAuth or refresh tokens let attackers keep access even after password resets. The practical answer is to shrink the trust window with segmentation, pre-approved isolation steps, and immediate credential and token revocation.

Q: How do security teams know if supplier access governance is failing?

A: A governance failure shows up when you cannot answer three questions quickly: who has access, what data they can reach, and when that access expires. If the answer depends on email trails, spreadsheets, or a vendor promise, the control is already weak. Frequent breaches through third parties usually indicate that access reviews are not tied to real data flow and credential lifecycle states.

Q: Should organisations prioritise token revocation or password resets after suspected compromise?

A: Token revocation usually comes first when the incident involves OAuth, refresh tokens, API keys, or other delegated access. Password resets help only if the attacker depended on interactive login. When the compromise path includes connected apps, the priority is to cut off every issued credential and consented integration before restoring user access.

Technical breakdown

How zero-day chains turn pre-auth access into code execution

The Oracle E-Business Suite case shows a classic exploit chain built from multiple weaknesses rather than one flaw. Attackers used SSRF to reach internal functionality, then CRLF injection to shape requests, then authentication bypass to skip normal checks, and finally unsafe XSLT handling to execute code when templates were previewed. This pattern matters because pre-auth routes remove the protection that identity systems usually provide. Once an attacker lands inside a trusted management surface, the application itself becomes the privilege boundary.

Practical implication: treat externally reachable administrative workflows as high-risk identity surfaces and monitor them as carefully as privileged accounts.

Why sandbox escapes in Redis become host-level compromise

The Redis RediShell issue illustrates how a memory-safety bug can become infrastructure compromise when an attacker can send malicious Lua code to a server with scripting enabled. The use-after-free condition lets the script escape Redis’s sandbox, reach the host operating system, and establish persistent access such as a reverse shell. In practical terms, the control failure is not only the vulnerability itself but the assumption that authenticated use equals safe use. If scripting privileges and network exposure are broad, the blast radius becomes much larger than the Redis instance.

Practical implication: limit scripting exposure, restrict authenticated access to trusted operators, and segment Redis deployments from broader production networks.

How OAuth token abuse and third-party integrations extend attacker reach

The ShinyHunters and Scattered Spider activity highlights a different mechanism: attackers do not always need to break authentication when they can persuade users or compromise integrations to grant it for them. Voice phishing can trigger OAuth approval, while stolen or refreshed tokens allow persistence even after passwords are changed. This is especially dangerous in SaaS environments because delegated access often sits outside the core IAM visibility model. In that setting, the identity problem is not user login but downstream trust inheritance across connected applications.

Practical implication: inventory OAuth-granted access, review third-party app approvals, and revoke tokens as a distinct control step, not as a password-management task.

Threat narrative

Attacker objective: The objective is to convert exposed software flaws and delegated trust into persistent enterprise access that can be monetised through theft, extortion, or operational disruption.

1. Entry begins with public exploitation of Oracle E-Business Suite, Redis scripting, or cloud social engineering that gives the attacker a trusted foothold in the environment.
2. Escalation follows when attackers bypass authentication, escape application sandboxes, or reuse OAuth and refresh tokens to expand their privileges.
3. Impact occurs through code execution, persistent access, data theft, ransomware disruption, or cross-platform movement into production and SaaS systems.

Breaches seen in the wild

• Salesloft OAuth token breach — hackers stole OAuth tokens to access Salesforce data via Salesloft.
• JetBrains GitHub plugin token exposure — CVE-2024-37051 in JetBrains IntelliJ GitHub plugin exposed GitHub access tokens.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Attackers are now chaining application flaws and identity trust failures in the same intrusion path. This report is not just a vulnerability roundup. It shows that pre-auth RCE, sandbox escape, and OAuth abuse can all serve the same end state: controlled access to enterprise systems. For identity teams, that means privilege governance must extend beyond logins and into administrative workflows, API trust, and delegated SaaS access.

Token governance is becoming a first-class control area, not a niche IAM subproblem. The cloud social-engineering examples in this report show that attackers increasingly prefer issued tokens over password theft because tokens are harder to notice and often survive credential resets. That shifts the governance burden toward approvals, app consent, token revocation, and continuous review of third-party access. Teams that only focus on user authentication will miss the real persistence layer.

Blast-radius control is the named concept this week’s incidents make unavoidable. When Oracle EBS, Redis, or a SaaS integration is exposed, the key question is not whether compromise is possible, but how far it can spread before revocation or isolation occurs. That is a governance and architecture issue, not just a vulnerability management issue. Practitioners should design for containment across identity, network, and workload boundaries.

Criminal consolidation increases the value of reusable access paths. The alliance activity described in the report suggests attackers are specializing roles and sharing infrastructure. That raises the payoff for stolen credentials, consented app access, and exposed admin paths because each can be reused across campaigns. For security governance, this means one compromised trust relationship may now support multiple threat actors and multiple business outcomes.

Operational resilience now depends on identity response speed as much as patch speed. The report’s weekly pattern shows that patching remains essential, but it is no longer sufficient on its own when exploitation windows are measured in minutes or days. Rapid revocation, segmentation, and token hygiene are part of resilience planning. Practitioners should treat identity response as a core element of incident containment.

From our research:

• From our research: When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, according to LLMjacking: How Attackers Hijack AI Using Compromised NHIs.
• Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap.
• For a broader view of how identity trust failures compound across incidents, read The 52 NHI breaches Report for recurring control breakdown patterns.

What this signals

Blast-radius control: security programmes need a faster way to decide which access paths must be isolated first when exploitation windows are measured in minutes, not days. That shifts value toward segmentation, token revocation, and emergency access review rather than waiting for the next patch cycle.

The operational signal for IAM and PAM teams is that delegated trust is now a standing attack surface. OAuth consent, API keys, and service accounts need the same lifecycle discipline as interactive users, because attackers increasingly move through whichever credential type is easiest to reuse.

For practitioners

• Inventory internet-facing administrative surfaces Map every externally reachable management interface, especially ERP, Redis, and SaaS admin surfaces, then classify which ones can lead directly to code execution or access expansion.
• Separate token revocation from password response Build a playbook that revokes OAuth grants, refresh tokens, and third-party app consents independently of user credential resets, because the attack path often persists after passwords change.
• Reduce trust in delegated SaaS integrations Review every connected app, voice-phishing approval path, and privileged integration for scope creep, then remove unnecessary consent and enforce re-approval for high-risk access.
• Constrain scripting and template execution pathways Disable or tightly restrict Redis Lua scripting where it is not required, and monitor template preview or upload functions in business applications as code-execution choke points.
• Align containment plans to exploit speed Assume exposed credentials and public vulnerabilities can be weaponised within minutes, then pre-stage isolation, network segmentation, and emergency access review steps accordingly.

Key takeaways

• This week’s incidents show that exploitation speed, not just vulnerability severity, is now the main driver of breach impact.
• OAuth tokens, service credentials, and exposed administrative workflows are becoming the most reusable paths for persistence and lateral movement.
• Teams that can revoke, isolate, and segment access faster than attackers can exploit it will reduce the damage window most effectively.

Key terms

• OAuth Token Abuse: The misuse of valid OAuth access or refresh tokens to gain unauthorized access without repeating the original login. In NHI terms, the token becomes the credential, so the real control problem is issuance, storage, scope, and revocation rather than passwords alone.
• AI Control-Plane Blast Radius: AI control-plane blast radius is the range of data, actions, and behaviours that can be affected when one AI control fails. It extends beyond records and credentials to include prompts, tool invocation paths, retrieval sources, and backend configuration.
• Sandbox Escape: A sandbox escape is when code breaks out of its intended isolation boundary and gains access to host capabilities. In identity terms, it turns a constrained non-human execution path into a privileged runtime that can touch files, secrets, or downstream systems.
• Pre-Authentication Exploit Chain: A sequence of weaknesses that lets an attacker reach code execution or sensitive functionality before any legitimate login occurs. These chains are high risk because they bypass identity controls and can give attackers immediate access to administrative or internal operations.

What's in the full report

FireCompass's full article covers the operational detail this post intentionally leaves for the source:

• Step-by-step exploit breakdowns for Oracle EBS, Redis, and Unity vulnerabilities across the week’s incidents
• Specific indicators of compromise, including suspicious XML Publisher activity, malicious Lua execution, and token abuse patterns
• The article’s own incident-by-incident summaries of ransomware activity, alliance formation, and supply-chain access paths
• FireCompass’s practitioner takeaways on patching, threat hunting, and incident response sequencing

👉 The full FireCompass report covers exploit details, attacker alliances, and response priorities in one weekly view.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, secrets management, and access lifecycle controls. It is designed for practitioners who need to connect identity discipline to real-world attack containment and governance.