Cloud PBX Breach Blast Radius & Extortion Triage Workbench

ACTIVE INTEL FEED: 1.6M Cloud PBX credentials dumped. Attackers actively harvesting Session Tokens, Webhook secrets, and Call Audio archives.

SEVERITY: CRITICAL-P1 REGULATORY CLOCK: 71h 59m remaining

Tenant Blast Radius

84% Critical Spread

Compromised Credentials

3 / 3 Accounts In Scope

SSO + Direct Dialing exposed

High-Risk Pivot Vectors

5 Active OAuth / SIP / Vishing

Secondary extortion danger

Exposed Voice & PII Recordings

367 GDPR / HIPAA Risk

Audio archives accessible

Communication Asset Topology

Click node to inspect & triage:

DISCOVERED VOIP & CLOUD EXTENSIONS: SIMULATION TARGETS

SIP Trunk Router UNRESTRICTED

Direct Inward Dialing (DID) gateway allowing external PBX forwarding.

Call Recording Store OPEN ACCESS

S3-backed voicemail archive containing unredacted financial & customer audio.

Webhook Dispatcher EXPOSED SECRETS

Live event streams broadcasting call logs & SMS payloads to external SaaS.

SELECTED: ACC-8812

Executive Suite

DID: +1-555-0190

Risk: 88/100

SSO Bound: Yes

MFA: Active

Credential Compromised in Dump Password/hash present in ShinyHunters dataset

Session Token Hijacked Live active session cookie leaked

High-Value Vishing / SIM Target Executive spoofing or voice cloning threat

Execute incident response controls to neutralize threat vectors and reduce blast radius.

1. OAuth Token Revocation PENDING

Invalidate third-party SaaS tokens (Zoom, Salesforce, Zendesk) across cloud PBX.

2. Enforce SIP Trunk ACL OPEN

Restrict SIP trunk routing strictly to verified corporate egress IP ranges.

3. Global SSO Session Invalidation ACTIVE SESSIONS

Terminate all active web/softphone sessions and force mandatory re-auth with FIDO2.

4. Isolate Recording Store PUBLIC READ

Disable public presigned audio URLs and rotate Cloud PBX storage encryption keys.

Synchronized with Threat Simulator

ID	Role / Identity	Department	DID Extension	Active Risk	Dump Status	Voicemails	Connected Integrations