Cloud Attacks Hide in SaaS, APIs and Enterprise Identity Systems

Cloud services now give attackers a way to make malicious operations resemble ordinary business activity. By using familiar SaaS platforms, provider APIs and management consoles, they can move data and commands through systems that companies depend on every day. My read is that the biggest shift is operational: cloud services aren’t just places to break into. They can become the infrastructure attackers use to run an entire campaign.

This approach, often called “living off the cloud,” extends the older practice of living off the land, in which attackers misuse tools already installed on a victim’s systems. In cloud environments such as AWS, Azure and Google Cloud, the equivalents are valid credentials, tokens, administrative APIs and management interfaces. Arif Khan, head of threat hunting and response services at Mitiga, says an attacker with working credentials can enumerate resources, extract information, raise privileges and establish persistence through administrative calls that may look routine.

That creates a detection problem. Blocking a suspicious server or domain is harder when command traffic passes through a reputable provider. Attackers can also draw on cloud infrastructure to mount activity at scale, while defenders must distinguish abuse from legitimate service use. Here are several ways that trust is being turned into an attack path.

Cloud tools as command channels

Google and Mandiant disrupted a suspected Chinese cyberespionage operation, UNC2814, that used Google Sheets to manage commands for Gridtide malware. The malware connected to an actor-controlled spreadsheet, authenticated with a Service Account token and checked specific cells for instructions. It then placed task results in neighboring columns.

The arrangement turns a familiar productivity tool into a live control system. Network requests to Google can blend into ordinary traffic, while the spreadsheet gives operators a place to update commands and receive results. Google researchers described the campaign as part of a broader pattern: attackers are finding value in abusing SaaS platforms instead of building and maintaining their own infrastructure.

Other campaigns put command traffic through APIs used by enterprise teams. The SesameOp backdoor, for example, routes communications through OpenAI’s Assistants API, making its traffic resemble AI development activity. Malware such as VEILDrive and malicious variants of the Havoc post-exploitation framework have used Microsoft Graph. In one described setup, malware signs in to a corporate SharePoint or OneDrive tenant, reads command files such as cmd.txt and writes results, including results.json, into a folder that can resemble a user’s backup.

As Peneto Labs managing director Parthiban Jegatheesan observes, this can make blocking difficult: the same API may support legitimate work. The risk is that tools focused on provider reputation or static blocklists will see a trusted destination without seeing the purpose of the traffic.

Identity and the cloud management plane

Valid identities can be more useful to an attacker than a custom exploit. OAuth tokens, service accounts and vendor credentials can provide access through the same interfaces employees and administrators use. In September, healthcare technology company Veradigm said attackers had used a third-party vendor’s credentials to reach certain patient personal data, including Social Security numbers in some cases. The Gentlemen ransomware group claimed responsibility and threatened to release stolen information. Veradigm said only a small number of customers were affected and that clinical and medical data were not exposed.

Black Duck cybersecurity governance head Ronald Lewis characterized the incident as abuse of a trusted identity with a route to sensitive data. According to Lewis, the credentials reached a particular interface rather than the company’s wider network. That distinction matters for incident analysis, but it also shows why perimeter defenses alone may miss the path an attacker took.

Cloud administration rights can also enable destructive actions. In March, US medical-device manufacturer Stryker suffered a cyberattack after attackers reportedly accessed its Microsoft Intune endpoint management platform. The Iran-linked hacktivist group Handala reportedly used that access to wipe thousands of employee laptops and mobile devices. Stryker said the incident disrupted operations globally. Lewis said health systems rescheduled some surgical procedures when the company could not deliver patient-specific implants and components.

In this kind of incident, the management plane itself becomes a powerful attack surface. A compromised administrator account may be able to issue commands across many devices without custom malware on each one. Entra ID tenant relationships create another route: CrowdStrike says China-nexus actor Murky Panda compromised upstream IT service providers and used trusted connections between Entra ID tenants to reach downstream victims. Storm-0501 has also used Entra ID configuration changes to obtain administrative privileges.

Moving payloads and stolen data through familiar services

Cloud object storage can host second-stage payloads and configuration files. Attackers may retrieve these files only when needed, limiting what sits on a compromised device and making it possible to change a payload without reinstalling the initial malware. S3-compatible storage is one example cited by researchers.

Everyday communication platforms can serve a different purpose: moving stolen information out. Nightwing cyber incident response manager Nicholas Carroll says recent campaigns have sent HTTPS POST requests to endpoints including api.slack.com, hooks.slack.com and discord.com. The attackers used those services to send secrets such as AWS access keys, SSH keys and internal API tokens into chat channels they controlled. Traffic to common collaboration services may attract less suspicion than transfers to an unfamiliar file-sharing site.

Attackers can also copy a victim’s infrastructure into their own cloud account. Scattered Spider and Storm-0501 have been associated with abuse of AWS Elastic Block Store snapshot sharing. In this technique, an attacker uses the ModifySnapshotAttribute API to share a snapshot of a victim server’s disk with an external account. The attacker can restore that snapshot and examine its contents offline, including for credentials, without first downloading files through the victim’s usual network paths.

Cloud secrets stores present a more direct source of credentials. Storm-0501 has queried services such as AWS Secrets Manager as part of broader ransomware and extortion activity. Jegatheesan says that pulling secrets through cloud APIs shifts credential theft away from endpoints, where security teams may have stronger monitoring, and into services they may watch less closely.

Cloud infrastructure as the attack network

Some campaigns use cloud services at multiple stages, from finding credentials to removing data. CrowdStrike says Genesis Panda has done so since March 2024: querying AWS Instance Metadata Service for credentials, hosting payloads in cloud storage, routing command traffic through domains that imitate legitimate cloud services and using cloud compute for data exfiltration. Principal engineer Diptamay Sanyal’s description captures the change: “The cloud isn’t a target here — it’s the entire operational backbone.”

Serverless compute can help distribute reconnaissance. During the HazyBeacon campaign targeting government entities in Southeast Asia, attackers reportedly used AWS Lambda or similar functions to scan parts of a target network. Whisper Security co-founder Kaveh Ranjbar describes a model in which many short-lived functions each scan a small portion before stopping. The resulting traffic comes from Amazon IP addresses that change over time, making it difficult to block without affecting legitimate AWS access.

Cloud tunneling services offer another way around inbound firewall rules. An attacker on an internal server can install a Cloudflare Tunnel or ngrok agent that opens an outbound connection to the provider. Since outbound HTTPS traffic is commonly allowed, the connection can carry commands through trusted infrastructure while appearing ordinary to network controls.

Phishing hosted on trusted platforms

Legitimate cloud infrastructure can also lend credibility to phishing. Russia-nexus group Cozy Bear, also known as APT 29, has sent phishing links that redirect users to authentic Microsoft login pages. CrowdStrike’s Sanyal says victims saw Microsoft infrastructure, leaving URL-based detection with little to flag.

Phishing kits including EvilTokens, Tycoon2FA and Kali365 have used Cloudflare’s workers.dev and similar developer platforms to host pages. ReliaQuest executive Brandon Tirado says these services can help pages pass email gateway and signature checks because the platforms have legitimate uses. He also says AI can reproduce a target’s branding from a single URL, making the lure look familiar.

The practical takeaway for security teams is to treat identity, API activity and cloud administration as connected parts of the same attack surface. A trusted provider domain does not establish that a request is benign, and a valid account does not guarantee that its actions match the user’s normal work. The campaigns described here point toward closer attention to who is calling cloud APIs, what permissions they use and where those actions lead.

VoidLink shows how far this model can extend. Check Point researchers identified the cloud-native malware framework, which includes loaders, implants, rootkits and modular plugins designed for persistence across AWS, Azure, Google Cloud and Kubernetes environments. The framework was apparently built and maintained by Chinese-affiliated developers. As attackers build more of their operations around cloud services, defenders will need visibility into how trusted identities and management tools are being used, not just which destinations appear on the network.