FulcrumSec Playbook: Sådan opdager og stopper du gruppen bag Novo Nordisk-bruddet

This report profiles FulcrumSec, a financially motivated group that targets cloud-native organizations by exploiting exposed credentials, unpatched internet-facing apps (e.g., CVE-2025-55182), and misconfigured cloud storage to harvest secrets, quietly collect and exfiltrate large volumes of sensitive data (multiple terabytes), and then extort victims using a “steal and squeeze” model; it documents their multi-stage playbook and provides detection and mitigation recommendations focused on secret management, least-privilege for machine identities, accelerated patching, and behavioral detection across identity, cloud control plane, and runtime.