GENESIS PANDA's Cloud Intrusions: Persistent Control Plane Exploitation and Access Brokerage (Campaign)
ID: 2522566e-1476-5dfe-b919-dd46f549a821
STIX ID: report--2522566e-1476-5dfe-b919-dd46f549a821
Feed Name: Wiz Cloud Threat Landscape
Threat Score
Date Published: 2025-08-24
Date Updated: 2026-05-01
Author: [email protected] (Wiz Threat Research)
...
...
GENESIS PANDA exploits exposed services and queries cloud Instance Metadata Services to steal credentials from compromised VMs, then pivots into cloud control planes to obtain SSH access, enumerate storage, deploy malware, and create persistent users/SSH keys; their activity appears focused on access brokerage rather than large-scale data theft.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.