FULCRUMSEC - A LOOK AT THEIR TRADECRAFT

Summary from the TLDR InfoSec newsletter

FulcrumSec, a financially motivated data extortion gang behind breaches at Manchester Airports Group, Arup, and Novo Nordisk, told Lab539 it runs up to 250 servers scanning client-side JavaScript and fresh bugs like React2Shell, then bulk-tests harvested credentials before picking victims. From there, it chains pivots through GitHub repos, AWS, Azure, and Secrets Manager without touching an endpoint, with a single Arup PAT reportedly opening about 10,000 private repositories. Defenders should baseline normal identity behavior and flag tokens that suddenly clone thousands of repos or enumerate unrelated secrets from unfamiliar infrastructure, since this activity relies on valid credentials rather than malware.