This article highlights the cybersecurity vulnerabilities that arise when financial institutions rely on third-party vendors. It details how CloudSEK’s SVigil platform discovered exposed credentials of a key communication service provider, which led to a significant data breach affecting a major banking entity. The timely detection helped prevent potential misuse of sensitive data and loss of customer trust. Affected: Banking sector, Communication service provider
Keypoints :
- Financial institutions depend on third-party vendors for communication.
- SVigil uncovered exposed credentials of a third-party communication service provider.
- The credentials provided access to sensitive customer data and call recordings.
- The breach risked operational disruption and data theft for major banking entities.
- Timely response prevented misuse of sensitive cloud configurations and operational credits.
- System prompts were compromised leading to severe risks for clients.
- Immediate credential revocation and tightening of cloud access controls are recommended.
MITRE Techniques :
- Credential Dumping (T1003) – Use of leaked credentials from the dark web to gain unauthorized access to sensitive systems.
- Account Access from External Location (T1071) – Malicious actors accessed the Central Portal from unauthorized locations, manipulating contact center operations.
- Data Exfiltration (T1041) – Use of privileged accounts to exfiltrate sensitive data and records.
- Persistence (T1136) – Malicious access allowed persistent manipulation of cloud configurations and sensitive data.
Indicator of Compromise :
- Credentials for AWS, GCP, and Azure services (specific credentials not listed)
- Exposed sensitive call recordings accessible via unsecured cloud storage buckets
- GCP service accounts like supplier-software-verified-smspcpl-speech-to-text
- Access logs indicating no Multi-Factor Authentication (MFA) employed
- Potentially leaked employee email addresses relevant to accessing the compromised systems
Full Story: https://www.cloudsek.com/blog/how-svigil-prevented-a-massive-supply-chain-breach-in-banking-infrastructure