Forensic incident reports have corroborated data extortion claims following widespread exfiltration targeting low-code enterprise web portals. Threat actors systematically target misconfigured permissions across public web instances to extract millions of sensitive customer and organizational records from connected cloud databases.
The activity, conducted by extortion cluster ExfilSquad, focuses on exposed Microsoft Power Pages portals connected to Microsoft Dynamics 365 environments. Misconfigured default table permissions enabled anonymous web visitors to execute unauthorized OData API queries against backend tables. Exfiltrated datasets include over 36 gigabytes of municipal data containing 3 million records and over 15 gigabytes of insurance policy records. Because no binary exploit or malware payload was required, security monitoring tools failed to trigger initial access alerts.
Exposing public access controls on cloud portal frameworks introduces severe corporate data confidentiality risks. When low-code public web portals share direct database queries with core enterprise resource planning platforms, administrative misconfigurations grant public threat actors unmonitored access to sensitive customer databases.
– Perform immediate access control audits across all public-facing Microsoft Power Pages portals to verify anonymous read permissions on custom tables.
– Restrict Dynamics 365 entity permissions to enforce strict user-authenticated row-level security controls.
– Inspect portal API gateway logs for high-volume OData queries originating from unrecognized public IP ranges.
– Implement web application firewall inspection rules to throttle bulk database query requests targeting public endpoints.
Cloud web application security relies on continuous permission auditing and strict zero-trust data access models to ensure low-code public web portals do not expose internal enterprise databases. #CodeDefence #Microsoft #PowerPages #Dynamics365 #DataExfiltration #AppSec #CloudSecurity #Extortion
/
