VERY IMPORTANT

Permiso’s p0 Labs has been tracking a threat actor for the last 18 months. In this article Permisos p0 Labs will describe the attack lifecycle and detection opportunities for the cloud-focused, financially motivated threat actor we have dubbed as p0-LUCR-1, aka GUI-vil (Goo-ee-vil).