Google’s latest Cloud Threat Horizons Report reveals a significant shift in how attackers gain access to cloud environments. Instead of relying primarily on weak credentials or misconfigurations, adversaries are now exploiting newly disclosed vulnerabilities in third‑party software — and they’re doing it faster than ever.
Key Findings
- Primary access vector:
- Exploited flaws accounted for 44.5% of intrusions.
- Weak credentials dropped to 27% of breaches.
- Exploitation speed:
- Attackers deploy cryptominers within 48 hours of disclosure.
- The window for defenders to patch has collapsed from weeks to days.
- Common vulnerabilities:
- Remote Code Execution (RCE) flaws dominate.
- Examples include React2Shell (CVE‑2025‑55182) and XWiki (CVE‑2025‑24893), leveraged in botnet campaigns.
- Actor objectives:
- Silent exfiltration of large data volumes.
- Long‑term persistence in cloud environments.
Case Studies
- Iran‑linked UNC1549: Maintained access for over two years using stolen VPN credentials and MiniBike malware, stealing nearly 1 TB of proprietary data.
- China‑linked UNC5221: Used BrickStorm malware to persist in VMware vCenter servers for 18 months, stealing source code.
- North Korea’s UNC4899: Pivoted from a developer’s compromised workstation to cloud Kubernetes pods, stealing millions in cryptocurrency.
- Supply chain attack (QuietVault): Abused GitHub‑to‑AWS OpenID Connect trust to escalate privileges, steal API keys, and destroy production data.
Emerging Trends
- Living‑off‑the‑cloud (LotC): Attackers abuse legitimate cloud services and DevOps workflows to blend in.
- Insider threats: Employees and contractors increasingly use cloud services (AWS, Google Cloud, Azure, OneDrive, Dropbox) for data exfiltration.
- Forensic evasion: Attackers delete backups, logs, and artifacts to hinder investigation.
- Automation urgency: Payloads can be deployed within one hour of instance creation, making manual response insufficient.
Defensive Recommendations
- Patch fast: Shrink vulnerability exposure windows with automated patching.
- Automated response: Deploy incident response workflows that trigger within minutes.
- Identity hardening: Enforce phishing‑resistant MFA and context‑aware access.
- Secrets management: Avoid storing credentials in environment variables; use vaults.
- Cloud runtime isolation: Segment workloads and restrict privileged container modes.
- Supply chain vigilance: Monitor npm, GitHub, and CI/CD pipelines for compromised packages.
Final Thought
Cloud attacks are evolving: exploits now outpace weak credentials as the primary entry point, and adversaries weaponize vulnerabilities within days. For defenders, the lesson is clear: speed, automation, and proactive patching are the new cornerstones of cloud security.
Leave a Reply