Dead Assets Walking : Two Silent Roads Into a Billion-Dollar Enterprise | AltSecCON 2026
Source: YouTube · Altered Security · published Nov 3, 2026 · 30:48
[BLUF] A red team engagement compromised a $1 billion enterprise by exploiting "dead assets" from a 2022 acquisition, leveraging insecure routers and exposed source code to gain Domain Admin and cloud access 2:15-2:21.
Key Takeaways:
• The Initial Breach: Attackers found a leaked password in a public code repository from a past acquisition, which allowed root access to four routers running SAS 5:00-5:48. One router lacked a DMZ, providing direct access to internal domain controllers and unauthenticated NFS shares 3:07-3:27.
• Active Directory Compromise: Using the router access, attackers performed a password spray (finding users with username=password) and exploited an SMB misconfiguration to relay authentication and add a rogue admin 7:13-9:58. This led to Domain Admin access via certificate abuse 11:52-12:07.
• Cloud & Identity Takeover: A synchronization server exposed credentials for the Entra ID sync account, allowing modification of Global Admin display names 12:20-13:13. Additionally, unauthenticated NFS shares contained user bash histories with GitLab PAT tokens, granting admin access to internal GitLab and subsequently AWS infrastructure 13:40-15:55.
• The Second Road (Cognito): Independently, a trial version of a product exposed JavaScript source maps containing AWS Cognito user/identity pool details. Self-registration on the production pool granted temporary AWS credentials, which were escalated to full AWS account control via an overly permissive IAM policy 19:49-24:05.
• Prevention & AI in Red Teaming: Key defenses include tracking acquired assets, securing source code secrets, and mandating segmentation. The speaker highlights how AI agents are transforming red teaming by automating recon, JavaScript parsing, and attack correlation 26:02-27:23.
[Closing statement] This case demonstrates how legacy acquisitions and misconfigurations can serve as backdoors to high-value targets, emphasizing the need for rigorous asset management and cloud security hygiene. The integration of AI agents in red teaming is becoming a critical capability for identifying complex, chained vulnerabilities.
Sources:
- 2:15-2:21 Overview of the engagement objectives: gaining internal network access and compromising crown jewels.
- 3:07-3:27 Compromise of an external router lacking DMZ protection, leading to internal network access.
- 5:00-5:48 Discovery of a leaked password in a public code repository from a 2022 acquisition.
- 7:13-9:58 Exploitation of SMB misconfigurations and password spraying to achieve Domain Admin.
- 12:20-13:13 Lateral movement to Entra ID via a compromised synchronization server.
- 13:40-15:55 Extraction of GitLab tokens from unauthenticated NFS shares to access cloud infrastructure.
- 19:49-24:05 Exploitation of exposed Cognito pools and IAM policies to compromise AWS accounts.
- 26:02-27:23 Discussion on the evolving role of AI agents in red teaming and adversary simulation.
Generate CPE Credits
Generate a professional CPE document from this video's transcript.
Estimated credit: 0.5 CPE hours
Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.
Topic: Penetration Testing. Commonly maps to: Security Assessment and Testing, Security Operations. Exact CISSP domains are assigned during generation.
Free account. One generation at a time, with a daily limit.
CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.
Transcript Preview
First 800 characters of the transcript
His talk is titled Dead Assets Walking two Silent Roads
into $1 billion Enterprise. Hello. Good morning. Today I wanted to share my experience on one of the red team
engagement that I did where we had two inactive assets
kind of considered as dead. But, that led us on two distinct growths of compromising $1 billion enterprise. A quick note about myself. My name is. And I hold couple of red
teaming certifications. Many of it was from Altered Security,
and I have around seven plus years of experience
on security research. My area of interest include adversary
simulation, Active Directory, intra ID and other identities
and cloud related stuff. I also have around 20 odd zero day
discoveries that I did. I also published my research
at a couple of conferences that I had, done in the past. So a q…