This assessment identified 35 total findings across Customer. The Cloud Security Posture Score is 21/100 — URGENT – Attention Needed.
| # | ID | Severity | Alert | Type | Time | IP or Domain Reputation | Description | Why It Matters | Recommended Next Action |
|---|---|---|---|---|---|---|---|---|---|
| 1 | 3130949 | Critical | Bad external server host connection | NewExternalServerBadDNSConn | April 28, 2026 at 1:00 AM | Malicious | External connection made to known bad host xmr.pool.minergate.com (and 2 more) at TCP port HTTP(80) (and 3 more) from application curl (and 1 more) running on host aittt53-watchtower (and 42 more) as | This alert indicates anomalous behavior that may represent an active security incident or policy violation. | Investigate the alert in FortiCNAPP; correlate with cloud activity logs; escalate if the activity is unauthorized. |
| 2 | 3110421 | Critical | Bad external server host connection | NewExternalServerBadDNSConn | April 23, 2026 at 9:00 PM | Malicious | External connection made to known bad host monerohash.com at TCP port High Ports (3333) from application nc.openbsd running on host sdl51-watchtower as user root . If applicable, the complete list of | This alert indicates anomalous behavior that may represent an active security incident or policy violation. | Investigate the alert in FortiCNAPP; correlate with cloud activity logs; escalate if the activity is unauthorized. |
| 3 | 3090128 | Critical | Potentially Compromised Host | PotentiallyCompromisedHost | April 22, 2026 at 12:00 AM | Malicious | Host machines may have been compromised. The following entities are suspected. Hosts: imontes20-watchtower, aittt26-watchtower, dzam2220-watchtower (and 92 others). | This alert indicates anomalous behavior that may represent an active security incident or policy violation. | Investigate the alert in FortiCNAPP; correlate with cloud activity logs; escalate if the activity is unauthorized. |
| 4 | 3069439 | Critical | Bad external server host connection | NewExternalServerBadDNSConn | April 18, 2026 at 7:00 AM | Malicious | External connection made to known bad host pool.xmr.pt at TCP port HTTP(80) from application curl running on host watchtower-s10 as user root . If applicable, the complete list of DNS-resolved hosts i | This alert indicates anomalous behavior that may represent an active security incident or policy violation. | Investigate the alert in FortiCNAPP; correlate with cloud activity logs; escalate if the activity is unauthorized. |
| 5 | 3069237 | Critical | Bad external server host connection | NewExternalServerBadDNSConn | April 16, 2026 at 9:00 PM | Malicious | External connection made to known bad host xmrpool.eu at TCP port High Ports (9999) from application nc.openbsd running on host sdl20-watchtower as user root . If applicable, the complete list of DNS- | This alert indicates anomalous behavior that may represent an active security incident or policy violation. | Investigate the alert in FortiCNAPP; correlate with cloud activity logs; escalate if the activity is unauthorized. |
| 6 | 3069072 | Critical | Potentially Compromised Host | PotentiallyCompromisedHost | April 15, 2026 at 10:00 PM | Malicious | Host machines may have been compromised. The following entities are suspected. Hosts: watchtower-s12, sdl34-watchtower, dzam2220-watchtower (and 53 others). | This alert indicates anomalous behavior that may represent an active security incident or policy violation. | Investigate the alert in FortiCNAPP; correlate with cloud activity logs; escalate if the activity is unauthorized. |
| 7 | 3069072 | Critical | Potentially Compromised Host | PotentiallyCompromisedHost | April 15, 2026 at 10:00 PM | Malicious | Host machines may have been compromised. The following entities are suspected. Hosts: watchtower-s12, sdl34-watchtower, dzam2220-watchtower (and 53 others). | This alert indicates anomalous behavior that may represent an active security incident or policy violation. | Investigate the alert in FortiCNAPP; correlate with cloud activity logs; escalate if the activity is unauthorized. |
| 8 | 3048866 | Critical | Bad external server host connection | NewExternalServerBadDNSConn | April 14, 2026 at 10:00 PM | Malicious | External connection made to known bad host xmrpool.eu at TCP port HTTP(80) from application curl running on host theta24-watchtower as user root . If applicable, the complete list of DNS-resolved host | This alert indicates anomalous behavior that may represent an active security incident or policy violation. | Investigate the alert in FortiCNAPP; correlate with cloud activity logs; escalate if the activity is unauthorized. |
| 9 | 3021301 | Critical | Potentially Compromised Host | PotentiallyCompromisedHost | April 8, 2026 at 11:09 PM | Malicious | Host machines may have been compromised. The following entities are suspected. Hosts: omega66-watchtower, watchtower-s12, theta21-watchtower (and 12 others). | This alert indicates anomalous behavior that may represent an active security incident or policy violation. | Investigate the alert in FortiCNAPP; correlate with cloud activity logs; escalate if the activity is unauthorized. |
| # | Severity | Finding | Cloud Scope | Service Area | Contextual Risk | Business Impact | Recommended Fix | Priority | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Critical | Azure Resource Out of Canada▼ 100 Violating Resources
| CLOUD fortinetcanadademo-default-15 | Cloud Security | Misconfigured or non-compliant control expands the attack surface, enabling unauthorized access or data exposure across CLOUD resources. | Regulatory non-compliance, potential data breach, audit failure, and reputational risk. | Alert on which Virtual Machines are deployed outside of Canadian Regions | Immediate | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 2 | Critical | Data Residency based on Country of Origin▼ 96 Violating Resources
| CLOUD fortinetcanadademo-default-14 | Cloud Security | Misconfigured or non-compliant control expands the attack surface, enabling unauthorized access or data exposure across CLOUD resources. | Regulatory non-compliance, potential data breach, audit failure, and reputational risk. | This aims to confirm all resources belong to the Country of Origin - this rules is based on CANADA Data Sovereignty | Immediate | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 3 | Critical | Use locked immutability policies for Storage Accounts Blobs with business critical data▼ 86 Violating Resources
| AZURE lacework-global-1085 | Storage Security | Misconfigured or non-compliant control expands the attack surface, enabling unauthorized access or data exposure across AZURE resources. | Regulatory non-compliance, potential data breach, audit failure, and reputational risk. | Apply locked immutability policies to all containers that store business-critical blob data. This measure protects the data from modifications or deletions and ensures that critical information remain | Immediate | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 4 | Critical | Samv Resource Out of Canada▼ 59 Violating Resources
| CLOUD fortinetcanadademo-default-13 | Cloud Security | Misconfigured or non-compliant control expands the attack surface, enabling unauthorized access or data exposure across CLOUD resources. | Regulatory non-compliance, potential data breach, audit failure, and reputational risk. | Out of Canada | Immediate | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 5 | Critical | Ensure no security groups allow ingress from 0.0.0.0/0 to web servers▼ 12 Violating Resources
| CLOUD fortinetcanadademo-default-5 | Network Security | Misconfigured or non-compliant control expands the attack surface, enabling unauthorized access or data exposure across CLOUD resources. | Regulatory non-compliance, potential data breach, audit failure, and reputational risk. | Security groups provide stateful filtering of ingress and egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access to web services http and | Immediate | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 6 | Critical | Enable immutability for Recovery Services vaults▼ 4 Violating Resources
| AZURE lacework-global-1069 | Resilience | Misconfigured or non-compliant control expands the attack surface, enabling unauthorized access or data exposure across AZURE resources. | Regulatory non-compliance, potential data breach, audit failure, and reputational risk. | Enabling the immutable vault protects backup data from unauthorized or accidental deletion. Locking the setting and making it irreversible prevents malicious actors from disabling it and deleting back | Immediate | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| 7 | Critical | Security groups should not allow unrestricted access to Telnet (port 23)▼ 2 Violating Resources
| AWS lacework-global-1168 | Identity & Access | Misconfigured or non-compliant control expands the attack surface, enabling unauthorized access or data exposure across AWS resources. | Regulatory non-compliance, potential data breach, audit failure, and reputational risk. | This policy checks for security groups allowing unrestricted ingress to Telnet (port 23). A security group is non-compliant if any inbound rule allows traffic from '0.0.0.0/0' or '::/0' to port 23 ov | Immediate | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| # | Severity | Vulnerability (CVE) | Risk Score | Affected Resource | Package / Version | Attacker Outcome if Exploited | Recommended Fix | Priority |
|---|---|---|---|---|---|---|---|---|
| 1 | Critical | CVE-2021-45046 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | horizon | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Update horizon to 29.0.3 | Immediate |
| 2 | Critical | CVE-2017-14493 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | neutron | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Vendor fix available — apply immediately | Immediate |
| 3 | Critical | CVE-2021-44530 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | horizon | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Update horizon to 29.0.3 | Immediate |
| 4 | Critical | CVE-2021-44228 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | horizon | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Update horizon to 29.0.3 | Immediate |
| 5 | Critical | CVE-2024-23049 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | horizon | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Update horizon to 29.0.3 | Immediate |
| 6 | Critical | CVE-2015-8914 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | neutron | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Vendor fix available — apply immediately | Immediate |
| 7 | Critical | CVE-2025-59681 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | django | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Update django to 4.2.25 | Immediate |
| 8 | Critical | CVE-2017-14492 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | neutron | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Vendor fix available — apply immediately | Immediate |
| 9 | Critical | CVE-2017-14491 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | neutron | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Vendor fix available — apply immediately | Immediate |
| 10 | Critical | CVE-2026-22797 Host | 9.0 | ip-172-31-27-195.ca-central-1.compute.internal | keystonemiddleware | Remote code execution enabling host compromise, data exfiltration, or privilege escalation. | Update keystonemiddleware to 10.7.2 | Immediate |
| Identity | Privilege | MFA | Last Login | Idle Entitlements | Risk | Recommended Fix |
|---|---|---|---|---|---|---|
| root arn:aws:iam::014386698427:root | Admin | No MFA | Never / Unknown | 100% idle | CRITICAL: Full admin with no MFA — single credential theft enables complete environment compromise. | Enforce MFA immediately. Replace standing admin with JIT privilege escalation. |
| root arn:aws:iam::363412468025:root | Admin | No MFA | Never / Unknown | 100% idle | CRITICAL: Full admin with no MFA — single credential theft enables complete environment compromise. | Enforce MFA immediately. Replace standing admin with JIT privilege escalation. |
| root arn:aws:iam::958932064649:root | Admin | No MFA | Never / Unknown | 100% idle | CRITICAL: Full admin with no MFA — single credential theft enables complete environment compromise. | Enforce MFA immediately. Replace standing admin with JIT privilege escalation. |
| Eduar Moran emoran_adm@emoranlabs.info | Admin | No MFA | Jul 10, 2025 | 100% idle | CRITICAL: Full admin with no MFA — single credential theft enables complete environment compromise. | Enforce MFA immediately. Replace standing admin with JIT privilege escalation. |
| root arn:aws:iam::188333028786:root | Admin | No MFA | Never / Unknown | 100% idle | CRITICAL: Full admin with no MFA — single credential theft enables complete environment compromise. | Enforce MFA immediately. Replace standing admin with JIT privilege escalation. |
| emoran gcp-ciem-2 emoran-gcp-ciem-2@emoran.online | Privileged | No MFA | Never / Unknown | 100% idle | HIGH: No MFA on privileged account — credential theft risk with no second factor protection. | Enable MFA immediately; rotate credentials; review recent activity. |
| emoran gcp-ciem-1 emoran-gcp-ciem-1@emoran.online | Privileged | No MFA | Never / Unknown | 100% idle | HIGH: No MFA on privileged account — credential theft risk with no second factor protection. | Enable MFA immediately; rotate credentials; review recent activity. |
| emoran gcp-ciem-3 emoran-gcp-ciem-3@emoran.online | Privileged | No MFA | Never / Unknown | 100% idle | HIGH: No MFA on privileged account — credential theft risk with no second factor protection. | Enable MFA immediately; rotate credentials; review recent activity. |
| emoran admin emoran@emoranlabs.info | Privileged | No MFA | Apr 29, 2025 | 100% idle | HIGH: No MFA on privileged account — credential theft risk with no second factor protection. | Enable MFA immediately; rotate credentials; review recent activity. |
| Hostname | Instance ID | OS | Secret Type | Secret Identifier | Last Seen Time |
|---|---|---|---|---|---|
| ip-172-31-16-80.ca-central-1.compute.internal | 8882067935430363505 | — | ssh_private_key | — | — |
| ip-10-0-0-24.ec2.internal | 1391890404822208179 | — | ssh_private_key | — | — |
| ip-172-16-31-10.ec2.internal | 6336969980309744348 | — | ssh_private_key | — | — |
| ip-192-168-101-155.ec2.internal | 1110203269945398414 | — | ssh_private_key | — | — |
| ip-172-31-19-180.ca-central-1.compute.internal | 216782677137093634 | — | aws_secret_access_key | — | — |
| ip-172-16-1-143.us-east-2.compute.internal | 4389931018425171806 | — | ssh_private_key | — | — |
| ip-10-1-5-192.us-east-2.compute.internal | 1711733174034484178 | — | ssh_private_key | — | — |
| ip-192-168-101-155.ec2.internal | 1110203269945398414 | — | ssh_private_key | — | — |
| ip-172-31-16-80.ca-central-1.compute.internal | 8882067935430363505 | — | ssh_private_key | — | — |
| FortiNac-node1 | 2028872358863050201 | — | ssh_private_key | — | — |
| ip-10-0-5-149.ec2.internal | 5506094839792441080 | — | ssh_private_key | — | — |
| ip-172-31-19-180.ca-central-1.compute.internal | 216782677137093634 | — | aws_secret_access_key | — | — |
| ip-172-16-31-10.ec2.internal | 6336969980309744348 | — | ssh_private_key | — | — |
| ip-10-0-5-149.ec2.internal | 5506094839792441080 | — | ssh_private_key | — | — |
| ip-10-0-5-192.ec2.internal | 8536655422750920941 | — | ssh_private_key | — | — |
| ip-10-50-11-60.ec2.internal | 4289947608531085312 | — | ssh_private_key | — | — |
| ip-172-31-18-225.ca-central-1.compute.internal | 6695603917103504826 | — | ssh_private_key | — | — |
| ip-172-31-69-98.ec2.internal | 5846318357252178766 | — | ssh_private_key | — | — |
| FortiNac-node1 | 2028872358863050201 | — | ssh_private_key | — | — |
| ip-10-50-11-40.ec2.internal | 1656144959977708298 | — | ssh_private_key | — | — |
| ip-172-31-19-180.ca-central-1.compute.internal | 216782677137093634 | — | aws_secret_access_key | — | — |
| ip-10-50-11-60.ec2.internal | 4289947608531085312 | — | ssh_private_key | — | — |
| FortiNac-node2 | 4787988893852278048 | — | ssh_private_key | — | — |
| ip-10-0-5-124.ec2.internal | 4234948394681180638 | — | ssh_private_key | — | — |
| ip-10-0-5-192.ec2.internal | 8536655422750920941 | — | ssh_private_key | — | — |
| ip-172-31-65-35.ec2.internal | 6003285167974367993 | — | aws_secret_access_key | — | — |
| ip-192-168-74-68.ec2.internal | 5158834657716594795 | — | ssh_private_key | — | — |
| ip-10-50-11-20.ec2.internal | 1205502313378143188 | — | ssh_private_key | — | — |
| ip-10-1-5-192.us-east-2.compute.internal | 1711733174034484178 | — | ssh_private_key | — | — |
| ip-172-31-19-180.ca-central-1.compute.internal | 216782677137093634 | — | aws_secret_access_key | — | — |
| FortiNac-node1 | 2028872358863050201 | — | ssh_private_key | — | — |
| ip-10-0-5-90.ec2.internal | 8217047534414232901 | — | ssh_private_key | — | — |
| ip-172-16-31-10.ec2.internal | 6336969980309744348 | — | ssh_private_key | — | — |
| FortiNac-node2 | 4787988893852278048 | — | ssh_private_key | — | — |
| ip-10-0-0-24.ec2.internal | 1391890404822208179 | — | ssh_private_key | — | — |
| ip-172-31-18-225.ca-central-1.compute.internal | 6695603917103504826 | — | ssh_private_key | — | — |
| ip-192-168-74-68.ec2.internal | 5158834657716594795 | — | ssh_private_key | — | — |
| ip-10-50-11-40.ec2.internal | 1656144959977708298 | — | ssh_private_key | — | — |
| ip-172-31-16-80.ca-central-1.compute.internal | 8882067935430363505 | — | ssh_private_key | — | — |
| ip-10-0-5-124.ec2.internal | 4234948394681180638 | — | ssh_private_key | — | — |
| ip-10-50-11-20.ec2.internal | 1205502313378143188 | — | ssh_private_key | — | — |
| ip-10-0-5-90.ec2.internal | 8217047534414232901 | — | ssh_private_key | — | — |
| FortiNac-node2 | 4787988893852278048 | — | ssh_private_key | — | — |
| FortiNac-node1 | 2028872358863050201 | — | ssh_private_key | — | — |
| ip-172-31-69-98.ec2.internal | 5846318357252178766 | — | ssh_private_key | — | — |
| ip-10-0-5-124.ec2.internal | 4234948394681180638 | — | ssh_private_key | — | — |
| ip-172-16-1-143.us-east-2.compute.internal | 4389931018425171806 | — | ssh_private_key | — | — |
| ip-172-31-100-11.ca-central-1.compute.internal | 338511882696796048 | — | aws_secret_access_key | — | — |
| ip-10-1-5-192.us-east-2.compute.internal | 1711733174034484178 | — | ssh_private_key | — | — |
| FortiNac-node2 | 4787988893852278048 | — | ssh_private_key | — | — |
