Notifications
Clear all
Topic starter
11/08/2026 3:20 pm
TL;DR: Modern offensive testing now spans web, infrastructure, IAM trust, and cloud service abuse, according to Bishop Fox, whose Mexico team took first place at HackMex Finals 2025 and the EkoParty Red Team Space CTF 2025, with the latter marking a third consecutive win. The signal for practitioners is that cloud identity paths, not just isolated vulnerabilities, determine how small footholds become enterprise impact.
NHIMG editorial — based on content published by Bishop Fox: CTF victories at HackMex Finals 2025 and EkoParty Red Team Space 2025
By the numbers:
- The Bishop Fox Mexico team took first place at both HackMex Finals 2025 and the EkoParty Red Team Space CTF 2025, marking a third consecutive win at EkoParty.
Questions worth separating out
Q: How should security teams assess cloud identity attack paths before attackers chain them?
A: Start with the identities that can already authenticate, then trace where those identities can assume roles, read secrets, access storage, or invoke services.
Q: Why do cloud environments create so much IAM risk?
A: Cloud environments create IAM risk because access changes faster than human review cycles can track.
Q: What do organisations get wrong about temporary cloud credentials?
A: They often treat expiration as the main control, when the real question is what the token can do before it expires.
Practitioner guidance
- Map cloud trust chains end to end Inventory IAM users, roles, policy attachments, AssumeRole relationships, and cross-account trust so you can see every route from low privilege to high impact.
- Audit service-role and workload-role blast radius Review EC2 instance roles, Lambda permissions, and S3 access to identify identities that can read data, assume other roles, or pivot into adjacent accounts.
- Test for privilege chaining, not just single-control failure Run attack-path exercises that start with one weak permission or exposed token and continue until lateral movement or data retrieval becomes possible.
What's in the full article
Bishop Fox's full post covers the competition detail this analysis intentionally leaves at the pattern level:
- Specific challenge breakdowns from HackMex Finals across web, infrastructure, and post-exploitation paths
- The EkoParty cloud identity scenarios that required mapping IAM users, roles, and cross-account trust
- Examples of service abuse involving S3, EC2 instance roles, and Lambda functions
- The team composition and competition context behind each first-place finish
👉 Read Bishop Fox’s post on CTF lessons from HackMex Finals 2025 and EkoParty Red Team Space 2025 →
Cloud identity attack paths in CTFs: what practitioners should notice?
Explore further
11/08/2026 3:31 pm
CTF results are useful because they expose the same trust failures production teams leave untested. Bishop Fox’s CTF summary is less about gaming-style competition and more about how adversaries think: enumeration, chaining, and control bypass. That matters because cloud and application teams often validate controls in isolation, while attackers care about whether those controls can be composed into a working intrusion path. Practitioners should treat CTF-style chaining as a rehearsal for real governance failure, not a novelty.
A question worth separating out:
Q: How should teams respond when cloud service roles are too permissive?
A: Rework the role model so each service identity has only the actions and trust relationships required for its task. Then test whether that identity can be chained into storage access, account pivoting, or data retrieval. If it can, the role is not least-privilege in operational terms, even if the policy looks tidy on paper.
👉 Read our full editorial: CTF wins expose the attack paths cloud identity teams overlook
