The Cybersecurity and Infrastructure Security Agency on Wednesday said organizations and individuals should take steps to protect their environments from a potential compromise of a legacy Oracle cloud environment. 

CISA’s alert acknowledged public reporting of alleged threat activity targeting Oracle customers but said the scope and impact of that activity was unconfirmed. The FBI earlier this month declined to comment on the reported attacks. 

CISA warned the nature of the reported threat activity posed a risk to organizations and individuals, particularly in situations where credential material could be exposed, reused across separate and unaffiliated systems, or embedded into applications and tools. 

CISA said embedded situations could involve credential material that has been hardcoded into scripts, applications, infrastructure templates or automation tools. The agency said embedded credential material can be hard to detect and can enable long-term access by an unauthorized actor. 

“The compromise of credential material, including usernames, emails, passwords, authentication tokens and encryption keys, can pose significant risk to enterprise environments,” according to the guidance. 

CISA said organizations should take the following steps: 

• Reset passwords for known affected users, particularly in cases where local credentials may not be federated through enterprise identity solutions. 
• Review source code, infrastructure as code templates, automation scripts and configuration files for hardcoded or embedded credentials. They should be replaced using secure authentication methods supported by centralized secret management.
• Authentication logs should be monitored for anomalous activity, especially using privileged, service or federated identity accounts.
• Phishing resistant multifactor authentication should be enforced for all user and administrator accounts when possible. 

The CISA guidance comes more than a month after a threat actor claimed a massive breach involving up to 6 million records, potentially affecting up to 140,000 tenants. Security firm CloudSek issued research pointing to a hacker exploiting a vulnerability in Oracle Cloud’s login endpoint.

TrustWave Spiderlabs provided additional research supporting the claimed breach after analyzing a dataset in March. 

Oracle has denied any breach of the Oracle Cloud environment but has given no clear explanation after multiple research firms reviewed evidence of the alleged breach. 

A class-action lawsuit was filed against Oracle Health in the U.S. District Court in Western District of Missouri, and a separate case was filed in March against Oracle Corp. in U.S. District Court for the Western District of Texas. 

Oracle has not provided any public advisories or guidance on what customers should do in response to these claims. Information security officials told Cybersecurity Dive the company has privately advised certain customers that sought help but has not issued any public advisories.

“There has been no breach of Oracle Cloud (OCI),” an Oracle spokesperson told Cybersecurity Dive earlier this month via email. “The published credentials are not for OCI. No OCI customers have experienced a breach or lost any data.”

Information security leaders said they are still seeking more transparency from Oracle, which has declined to publicly explain these reports beyond issuing denials that Oracle Cloud was breached. 

Jonathan Braley, director of threat intelligence at IT-ISAC, said the organization has continued to engage with members with the information that has been made available. 

“The advisory is helpful in that we have a credible report we can share, though it appears CISA has taken a proactive stance of mitigating " potential unauthorized access" as we all await details from Oracle,” Braley said via email.

“We’re disappointed with the lack of transparency from Oracle,” Errol Weiss, chief security officer at Health-Information Sharing and Analysis Center, told Cybersecurity Dive via email. “We’ve invited them to share through our member-only community, but that offer has not been acted upon yet.”