Request a DemoEmergency Assistance
Or Aspir

Or Aspir

Director of Research

As the Director of Research at Mitiga, Or leads the Research group. With a long history in the cybersecurity industry—working as a developer and as a security researcher—his primary mission is to bolster the cybersecurity capabilities within Mitiga’s products, ensuring they remain robust defenses in today's digital landscape Or and his group are dedicated to deepening their understanding of security within the platforms Mitiga supports, to stay ahead of emerging threats and vulnerabilities. Outside of his professional responsibilities, Or finds fulfillment in his passion for playing the piano, drawing upon his previous experience as a Salsa dancing teacher.

Understanding the Sisense Breach: A Guide to Cloud Threat Hunting for Sisense Customers

On April 11, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) announced its collaboration with private industry partners to address a significant security breach affecting Sisense, a prominent provider of data analytics services. This compromise, unearthed by independent security researchers, raised alarms within the cybersecurity community, prompting swift action from both government agencies and affected organizations.

Mitiga Security Advisory: Abusing the SSM Agent as a Remote Access Trojan

Mitiga's research discovered a significant new post-exploitation security concept: involving the use of Systems Manager (SSM) agent as a Remote Access Trojan (RAT) on Linux and Windows machines, controlling them using another AWS account. We shared our research with the AWS security team and included some of their feedback to this advisory.

More on Abusing the Amazon Web Services SSM Agent as a Remote Access Trojan

Imagine that you’re a SOC (Security Operations Center) analyst receiving an alert about suspicious behavior from a binary on an EC2 instance. After checking the binary on VirusTotal, you find it was an AWS-developed software signed by Amazon. Further investigation reveals that it communicated only with Amazon-owned IP addresses.

Mitiga Security Advisory: Lack of Forensic Visibility with the Basic License in Google Drive

After gaining initial access to any platform, data theft (exfiltration) is one of the most common attack vectors used by threat actors.

How Okta Passwords Can Be Compromised: Uncovering a Risk to User Data

Mitiga's research team uncovered a data risk to Okta users due to passwords that can be present in logs. This article outlines the risk and attack method.

Elastic IP Hijacking — A New Attack Vector in AWS

Mitiga Researchers found a new post-exploitation attack method, a novel way in AWS that may enable adversaries to hijack static public IP addresses for malicious purposes.

Uber Cybersecurity Incident: Which Logs Do IR Teams Need to Focus On?

On September the 16th, Uber announced they experienced a major breach in their organization in which malicious actor was able to log in and take over multiple services and internal tools used at Uber. What are some of the logs that IR teams should be focusing on in their investigation?

How Transit Gateway VPC Flow Logs Help Incident & Response Readiness

In this blog, we will focus on the security and forensic aspects of Transit Gateway VPC flow logs and expand the way they can be used by organizations to respond to cloud incidents.

Log4Shell - identify vulnerable external-facing workloads in AWS

Cloud-based systems should be thoroughly searched for the new Log4j vulnerability (CVE-2021-44228). But this is a daunting task, since you need to search each and every compute instance, from the biggest EC2 instance to the smallest Lambda function. This is where Mitiga can help.