Threat Actors Exploit Elastic Cloud’s SIEM for Data Theft

Huntress researchers identified a campaign where a threat actor exploited vulnerabilities to steal data and used Elastic Cloud’s SIEM (Security Information and Event Management) as a hub for managing the stolen information. The attack leveraged Elastic Cloud’s infrastructure to organize and exfiltrate compromised data, though no specific vulnerabilities, CVE IDs, or affected Elastic Cloud versions were disclosed. The discovery highlights the misuse of legitimate cloud-based security tools by adversaries to facilitate data theft. No exact timeline, victim details, or geographic scope of the campaign were provided in the report. The impact involves unauthorized data access and potential exposure of sensitive information through Elastic Cloud’s platform.