Secrets manager exfiltration campaign targets HashiCorp Vault and AWS Secrets Manager
·CredentialsCritical
A financially motivated group systematically targeted exposed secrets manager APIs across cloud environments, using stolen cloud credentials to enumerate and bulk-download secrets before triggering any existing detection rules.
Deception angle
A decoy Vault instance on port 8200 catches health checks, seal-status probes and auth attempts — the exact sequence automated tools run. The real Vault never sees the attacker if the decoy is found first.
Read about Kandaro Deception, or browse more security news.