Hackers Use Cloud Services Like AWS, Microsoft to Evade Corporate Security

Attackers are increasingly routing malicious command-and-control traffic through trusted cloud platforms including OpenAI and AWS to blend in with normal business activity and bypass traditional security defenses, according to a new analysis published by CSO Online. The shift represents an evolution from "living off the land" — where adversaries abused local system tools — to "living off the cloud," where they weaponize the same SaaS platforms, cloud infrastructure, and identity systems that enterprises depend on daily. The approach allows malicious activity to masquerade as routine corporate traffic while evading blocklists and reputation-based filters.

The analysis documents twelve distinct methods attackers use to abuse cloud services. A suspected Chinese cyber-espionage operation disrupted by Google and Mandiant used malware called Gridtide that connected to an attacker-controlled Google spreadsheet for command and control, treating the spreadsheet as a live database by polling specific cells for instructions and writing task results back into adjacent columns. The SesameOp backdoor routed traffic through OpenAI's Assistants API, making communications appear as legitimate AI development work. Other malware variants abuse Microsoft Graph API to authenticate to corporate SharePoint or OneDrive tenants, reading command files and writing output files directly into folders that resemble user backups. Attackers also store second-stage payloads in S3-compatible cloud storage buckets instead of their own servers, pulling files down only when needed to reduce the malware footprint on disk. Data exfiltration has shifted from traditional FTP drops to everyday corporate communication tools like Slack and Discord, with recent campaigns configuring compromised servers to execute HTTPS POST requests to Slack and Discord APIs to steal AWS access keys, SSH keys, and internal API tokens directly into attacker-controlled chat channels.

"Instead of abusing local binaries like PowerShell or WMI to evade detection, adversaries now leverage native cloud administrative tools, APIs, identity systems, and management consoles to operate using legitimate functionality," says Arif Khan, head of threat hunting and response services at Mitiga, according to the report. Attackers who obtain valid credentials or tokens can enumerate resources, extract data, escalate privileges, and maintain persistence through routine-looking administrative calls because cloud environments are inherently API-driven. The report notes that one campaign linked to Chinese cyber-espionage group Genesis Panda has systematically weaponized cloud services across the full attack chain since March 2024, querying AWS Instance Metadata Service for credential harvesting, using cloud storage for payload hosting, routing command and control through domains impersonating legitimate cloud services, and using cloud compute for data exfiltration. Google's researchers describe this as "an ongoing trend of actors increasingly finding success in abusing SaaS platforms as an alternative to creating and maintaining their own custom infrastructure."

The approach bypasses traditional defenses that rely heavily on domain reputation and static blocklists. During the HazyBeacon campaign targeting governmental entities in Southeast Asia, attackers abused serverless services like AWS Lambda to spin up thousands of ephemeral functions for network reconnaissance, with each function scanning a small slice of the target network before terminating. The traffic originated from high-reputation Amazon IP addresses that rotated constantly, effectively "laundering" their traffic through Amazon's reputation in a way that prevented enterprise firewalls from blocking the IPs without breaking their own access to legitimate AWS services. Attackers also bypass inbound firewall rules by installing legitimate tunneling services like Cloudflare Tunnel or ngrok agents on compromised internal servers, initiating outbound connections that appear to security teams as legitimate encrypted HTTPS traffic to Cloudflare or AWS while actually establishing stable command-and-control channels that tunnel through perimeter defenses. Iran-linked hacktivist group Handala reportedly gained access to medical-device manufacturer Stryker's Microsoft Intune cloud endpoint management platform in March, using the compromised access to wipe thousands of employee laptops and mobile devices in an attack that caused health systems to reschedule surgical procedures when Stryker couldn't deliver patient-specific implants and components.

The report also documents advanced techniques including snapshot sharing attacks by groups like Scattered Spider and Storm-0501, where adversaries create snapshots of victim servers' entire hard drives and share them using cloud APIs with external attacker-controlled accounts, then restore the snapshots to perform offline credential dumping. China-nexus actor Murky Panda compromised upstream IT service providers to silently pivot into downstream victims through trusted Entra ID tenant connections, while Storm-0501 has abused cloud-native secrets stores like AWS Secrets Manager to harvest credentials directly through cloud APIs, avoiding endpoint detection by shifting attacks into areas many security teams monitor less closely. Check Point researchers identified VoidLink, a highly advanced malware framework purpose-built to compromise AWS, Azure, Google Cloud, and Kubernetes clusters, apparently built and maintained by Chinese-affiliated developers. Traditional URL-based detection becomes useless when phishing kits host attack infrastructure on legitimate cloud platforms — Russia-nexus hacking group Cozy Bear delivered phishing links redirecting to authentic Microsoft login pages, ensuring victims only ever saw legitimate Microsoft infrastructure and removing the most common phishing red flag of suspicious domains. For organizations that have migrated IT infrastructure to hybrid and cloud environments, the cloud management plane has become the attack surface, where a compromised admin account can achieve what once required custom malware. Security teams face a fundamental dilemma: they can't block high-reputation cloud provider traffic without disrupting their own essential business operations, yet that same trusted infrastructure now serves as the carrier for sophisticated attack campaigns.