CRITICALApt
Verified
Europe

APT29 Targets European Cloud Service Providers in Operation CloudJack

·Source: Microsoft / ANSSI

Updated:

Executive Summary

APT29 compromises two European cloud hosting providers to access customer environments. Hundreds of EU government and enterprise tenants at risk.

Analysis

Microsoft and ANSSI report that APT29 compromised administrative access at two mid-tier European cloud hosting providers, gaining potential access to hundreds of EU government and enterprise customer environments. The operation, dubbed CloudJack, used stolen admin OAuth tokens to move laterally through customer tenants. Affected providers have initiated incident response and customer notifications.

Timeline

Discovered
Mar 15, 2026
Exploitation Detected
Mar 15, 2026
Published
Mar 22, 2026
Source Attribution

Originally published by Microsoft / ANSSI on Mar 22, 2026. Verified by: Microsoft, ANSSI, ENISA.

Related Threats

LOWApt

SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

SAP has released patches to address a maximum-severity security flaw impacting Commerce Cloud (Data Hub Adapter) that could result in arbitrary code execution. The vulnerability, assigned the CVE identifier CVE-2026-58231, is rated 10.0 on the CVSS scoring system. It has been described as a case of insufficient authorization checks and input validation. "SAP Commerce Cloud allows an

CVE-2026-58231
The Hacker News
HIGHApt

Cisco ASA and FTD Flaw Exploited in the Wild Can Trigger Remote DoS

Cisco has warned that a new vulnerability impacting Secure Firewall Adaptive Security Appliance (ASA) Software and Secure Firewall Threat Defense (FTD) Software has been exploited in the wild. The high-severity flaw, tracked as CVE-2026-20349 (CVSS score: 8.6), is a case of insufficient error checking when processing HTTP requests that could allow an unauthenticated, remote attacker to trigger

CVE-2026-20349
The Hacker News
CRITICALApt

Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands

The Computer Emergency Response Team of Ukraine (CERT-UA) has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activity on a threat cluster it tracks as UAC-0145, which is a subgroup within Sandworm (aka APT44,

The Hacker News