Attackers are hiding command channels, stealing data and wiping devices through trusted cloud services, putting identity and management controls at the center of defense.
The cloud has become more than a place attackers break into. It can also supply their command channels, payload storage, scanning capacity and route to stolen data. By operating through services employees and security teams already trust, attackers can make malicious activity resemble ordinary business traffic.
That shift—from “living off the land” to living off the cloud—changes what defenders need to watch. In hybrid environments built on AWS, Azure and Google Cloud, an attacker with valid credentials or tokens may use native APIs and administrative tools to inspect resources, take data, expand access or persist. The activity can look like routine cloud administration rather than malware running on an endpoint.
“Because cloud environments are inherently API-driven, attackers who obtain valid credentials or tokens can enumerate resources, extract data, escalate privileges, and maintain persistence through routine-looking administrative calls,” says Arif Khan, head of threat hunting and response services at Mitiga.
Trusted services carry commands and stolen data
One clear example is Gridtide, malware used in a suspected Chinese cyber-espionage operation tracked as UNC2814. Google and Mandiant said they disrupted the campaign, which used Google Sheets as a command-and-control channel. The malware authenticated with a Service Account token, checked designated spreadsheet cells for instructions, then wrote task results into neighboring columns. To network monitoring, that exchange could resemble normal Google traffic.
Google’s researchers described the approach as part of a trend toward abusing SaaS platforms instead of building and maintaining custom infrastructure. The same logic applies to APIs. Microsoft reported that the SesameOp backdoor routes communications through OpenAI’s Assistants API, making its traffic resemble AI development work. “To security tools, it blends in with legitimate business use,” says Parthiban Jegatheesan, managing director at Peneto Labs.
Other malware, including VEILDrive and malicious variants of the Havoc post-exploitation framework, has abused Microsoft Graph. According to senior offensive security engineer Kwangyun Keum, malware can authenticate to a corporate SharePoint or OneDrive tenant, retrieve command files such as cmd.txt, and place results such as results.json in a folder made to resemble a user’s backup.
Cloud collaboration tools can also become delivery channels for stolen information. Nicholas Carroll, manager of cyber incident response at Nightwing, says attackers have used HTTPS POST requests to Slack and Discord endpoints, including api.slack.com, hooks.slack.com and discord.com. Data sent to attacker-controlled chat channels can include AWS access keys, SSH keys and internal API tokens. The familiar service may make the transfer harder to distinguish from legitimate use.
Identity and management access can have direct consequences
Some cloud attacks hinge less on custom malware than on credentials with access to a useful interface. In September, healthcare technology firm Veradigm said attackers used a third-party vendor’s credentials to reach certain patient data, including Social Security numbers in some cases. The Gentlemen ransomware group claimed the attack and threatened to publish stolen data. Veradigm said a small number of customers were affected and that clinical and medical data were not exposed.
Black Duck cybersecurity governance lead Ronald Lewis characterized the incident as the abuse of a trusted identity with a path to sensitive data. Veradigm said the credentials reached a particular interface rather than its wider network. That boundary matters, but the episode still shows how a narrowly scoped account can expose information without an attacker first taking over servers.
A cloud administrator account can also control devices at scale. In March, US medical-device manufacturer Stryker suffered a destructive cyberattack after attackers reportedly accessed its Microsoft Intune endpoint management platform. The Iran-linked hacktivist group Handala reportedly used that access to wipe thousands of employee laptops and mobile devices. Stryker acknowledged operational effects and global disruption. Lewis said health systems rescheduled some procedures when the company could not deliver patient-specific implants and components.
The broader lesson is practical: endpoint security alone cannot account for the authority held by cloud management tools. A compromised account with permission to remotely wipe devices can cause damage through legitimate platform features, without deploying custom destructive code to each machine.
Cloud infrastructure supplies scale, cover and persistence
Attackers are using cloud storage to stage second-stage payloads and configuration files, including in S3-compatible buckets. The files can be downloaded only when needed, reducing what sits on an infected device and letting an attacker replace payloads without redeploying the original malware.
Some campaigns use cloud services across nearly every step. CrowdStrike principal engineer Diptamay Sanyal says the China-linked group Genesis Panda has, since March 2024, queried AWS Instance Metadata Service for credentials, hosted payloads in cloud storage, routed command traffic through domains impersonating cloud services, and used cloud compute for data exfiltration. “The cloud isn’t a target here — it’s the entire operational backbone,” Sanyal says.
Ephemeral computing can make reconnaissance harder to trace. During the HazyBeacon campaign targeting government entities in Southeast Asia, attackers reportedly used AWS Lambda functions to scan networks. Instead of routing scans through one compromised server, the approach described by Whisper Security CEO Kaveh Ranjbar distributes work across many short-lived functions. Traffic from frequently changing Amazon IP addresses can be difficult to block without also affecting legitimate AWS use.
Cloud tunneling offers another way around perimeter rules. An attacker on an internal server can run a Cloudflare Tunnel or ngrok agent that initiates an outbound connection, which firewalls often permit. The resulting encrypted traffic may look like an ordinary connection to a known provider while carrying a persistent command channel.
Cloud management APIs can expose data without moving it through conventional network paths. In an “EBS snapshot sharing” technique associated with groups including Scattered Spider and Storm-0501, an attacker creates a disk snapshot and uses the ModifySnapshotAttribute API to share it with an external cloud account. The attacker can then restore the copy and conduct offline credential theft.
Trust relationships between organizations create another route. CrowdStrike says China-linked Murky Panda compromised upstream IT service providers to reach downstream victims through trusted Entra ID tenant connections. Storm-0501 has also targeted Entra ID configurations to gain administrative access. Separately, the group has queried cloud secrets stores such as AWS Secrets Manager for credentials, shifting credential theft from endpoints to APIs that some security teams monitor less closely.
Phishing inherits the reputation of cloud platforms
Attackers also host lures and login flows on legitimate services. Russia-linked group Cozy Bear, also known as APT 29, has used links that lead victims to authentic Microsoft login pages. Because the destination belongs to Microsoft, URL reputation checks may miss the deception.
Phishing kits such as EvilTokens, Tycoon2FA and Kali365 have relied on Cloudflare’s workers.dev and similar developer platforms to host pages. ReliaQuest executive Brandon Tirado says these platforms’ legitimate uses can help phishing pages pass email gateways and signature detection. Cloud-hosted pages can also imitate a target’s branding.
VoidLink pushes the cloud-native idea into malware design. Check Point researchers identified the framework, which is built from loaders, implants, rootkits and modular plugins and is designed for persistence across environments including AWS, Azure, Google Cloud and Kubernetes. The attribution in the source report describes its developers as Chinese-affiliated.
Across these cases, reputation and infrastructure are part of the attack surface. Blocking every request to a major cloud provider would disrupt ordinary work, so defenders need visibility into which identities call which APIs, what those identities are allowed to do, and whether the resulting activity fits their normal patterns. The practical security boundary now includes SaaS accounts, tenant relationships, service tokens and management consoles—not just the devices and networks they control.
Discussion
Sign in to join the discussion.