Cloud tunneling
Adversaries are bypassing inbound firewall rules by utilizing legitimate “tunnelling” services hosted on major cloud providers.
“An attacker compromises an internal server but cannot open a port to listen for commands due to the corporate firewall,” Whisper Security’s Ranjbar explains. “So, they install a Cloudflare Tunnel or ngrok agent. This agent initiates an outbound connection to the cloud provider, which is usually allowed.”
Ranjbar adds: “To the security team, this looks like legitimate, encrypted HTTPS traffic going to Cloudflare or AWS. In reality, it is a stable C2 channel that tunnels right through the perimeter defenses using trusted infrastructure as the carrier.”
EBS snapshot sharing
Cybercrime groups such as Scattered Spider and Storm-0501 abuse the “snapshot sharing technique,” creating a high-impact IaaS attack vector in the process.
The approach bypasses traditional network security by weaponizing the cloud’s management layer.
“Rather than downloading malicious files, the adversary creates a snap ‘photograph’ of the victim server’s entire hard drive and simply ‘shares’ it using the ModifySnapshotAttribute API with an external cloud account the attackers control,” says offensive security engineer Keum. “The attacker subsequently restores the snapshot and then perform attacks such as ‘offline’ credential dumping.”
Trust abuse via Entra ID tenant relationships
China-nexus actor Murky Panda compromised upstream IT service providers to silently pivot into downstream victims through trusted Entra ID (formerly Azure AD) tenant connections, according to CrowdStrike.
Hacking into Entra ID tenant configurations to gain admin privileges is also a feature of ransomware group Storm-0501’s tradecraft.
Pulling secrets directly from cloud vaults
Groups such as Storm-0501 have abused cloud-native secrets stores such as AWS Secrets Manager to harvest credentials as part of its broader ransomware and extortion campaigns.
“Instead of dumping credentials from endpoints, attackers query secrets directly through cloud APIs,” says Peneto Labs’ Jegatheesan. “This avoids endpoint detection and shifts the attack into places many security teams monitor less closely.”
Touching the void
Miscreants have even built cloud-native malware made up of custom loaders, implants, rootkits, and modular plugins, and designed to achieve persistence on compromised targets.
For example, VoidLink is a highly advanced malware framework purpose-built to compromise major cloud infrastructures such as AWS, Azure, GCP, and Kubernetes clusters. The framework, apparently built and maintained by Chinese-affiliated developers, was first identified by researchers from Check Point.
