HACKERS EXPLOIT SECURITY TESTING APPS TO BREACH FORTUNE 500 FIRMS

Summary from the TLDR InfoSec newsletter

Automated pentest company Pentera discovered nearly 2K instances of exposed security testing apps, such as OWASP Juice Shop and DVWA, publicly exposed in the networks of Fortune 500 companies. Many of these web apps are used for security training and are deployed in cloud environments with overly permissive IAM roles and default credentials. Pentera found evidence that 20% of exposed DVWA apps had malicious artifacts such as webshells and cryptominers deployed.