The Yeti Journal on Yeti.Security — Pen-testing & security consulting

Crampon-7: credential-stuffing wave targeting fleet-management SaaS

Thu, 07 May 2026 00:00:00 +0000

// TLP:AMBER · limited distribution This brief contains active-campaign indicators. Share inside your organization and with trusted partners only. Do not redistribute publicly.

A coordinated credential-stuffing campaign is targeting US-based fleet-management platforms. Yeti has observed activity against three customers in the last 72 hours. Recommended actions are at the bottom of this post.

HIGH severity 11 known victims ~3% success rate 05.04 first seen

Summary

Threat actor CRAMPON-7 is replaying credentials harvested from a 2025 unrelated SaaS breach against fleet-management login endpoints. Distributed across approximately 4,200 residential proxies; rate-limited at 1.5 requests/second per IP — well below typical naive rate-limiting thresholds.

The first six findings we see, every time

Fri, 10 Apr 2026 00:00:00 +0000

Eighteen months in, we’ve completed 38 engagements. They span fintechs, fleet- management SaaS, two robotics companies, and a healthtech firm we can’t name. Different stacks, different teams, very different threat models.

And yet — the same six findings appear in roughly the same order, every time.

Treat this list as a pre-emptive remediation roadmap. If you can knock these out before our next visit (or, ideally, before someone else’s first visit), the rest of the engagement is materially more useful.

Northstar Robotics: fixing twelve findings before the report shipped

Sun, 22 Mar 2026 00:00:00 +0000

In Q2 2026 we ran a four-week penetration test against Northstar Robotics, a fleet-management SaaS for autonomous logistics vehicles. The engagement covered their production web app, the operator mobile apps (iOS + Android), and their customer-facing API.

We found 28 issues — two critical, four high, nine medium, eight low, five informational. None of those numbers are unusual. The unusual part: by the time we sent the final report, 20 of the 28 were already fixed. Six more had open PRs. Two were deferred deliberately, with a documented exception.