14 ways attackers abuse cloud services to hack your enterprise

Attackers are routing command-and-control traffic through trusted cloud and AI services, including OpenAI's Assistants API and Google Sheets, to evade domain-reputation and blocklist defenses, according to researchers cited by CSO Online. Google and Mandiant disrupted a suspected Chinese cyber-espionage operation, UNC2814, whose Gridtide malware used a threat actor-controlled Google spreadsheet as a live C2 database, polling cells via a Service Account token for instructions and writing results into adjacent columns. Microsoft separately documented the SesameOp backdoor, which masks C2 communications as legitimate AI development work through OpenAI's Assistants API, while malware such as VEILDrive and malign variants of the Havoc Framework abuse the Microsoft Graph API to authenticate to corporate SharePoint or OneDrive.

Attackers are increasingly abusing trusted SaaS platforms, cloud infrastructure, and identity systems to blend malicious activity into legitimate enterprise traffic. Adversaries are pushing command and control C2 through high-reputation services, including OpenAI and AWS, to blend in with normal business traffic and evade blocklists. The shift from “ living off the land https://www.csoonline.com/article/643617/living-off-the-land-attacks-are-hard-but-not-impossible-to-protect-against.html ” to “living off the cloud” reflects how attackers have adapted to the enterprise’s migration of IT infrastructure to hybrid and cloud environments such as AWS, Azure, and Google Cloud. “Instead of abusing local binaries like PowerShell or WMI Windows Management Instrumentation to evade detection, adversaries now leverage native cloud administrative tools, APIs, identity systems, and management consoles to operate using legitimate functionality,” says Arif Khan, head of threat hunting and response services at Mitiga. “Because cloud environments are inherently API-driven, attackers who obtain valid credentials or tokens can enumerate resources, extract data, escalate privileges, and maintain persistence through routine-looking administrative calls.” Hacking cloud-based systems https://www.csoonline.com/cloud-security/ bypasses traditional defenses that rely heavily on domain reputation and static blocklists. Running attack infrastructure from the cloud also makes attacks easier to mount. “Attackers are increasingly using legitimate cloud services as part of their attack infrastructure,” says Fredrik Almroth, security researcher and co-founder at Detectify. “Instead of operating their own command-and-control servers, they route traffic through trusted platforms like cloud storage, collaboration tools, or AI APIs. To defenders, it can look like routine traffic to a reputable provider.” Below are some examples of how attackers are increasingly abusing cloud-based services to mount a variety of attacks. Researchers from Google and Mandiant recently disrupted a suspected Chinese cyber-espionage operation UNC2814 https://cloud.google.com/blog/topics/threat-intelligence/disrupting-gridtide-global-espionage-campaign that was abusing legitimate Google Sheets functionality to evade detection. The Gridtide malware at the center of the campaign connected to a threat actor–controlled Google spreadsheet for C2, effectively allowing it to blend in with normal network traffic. The malware treats Google Sheets as a live C2 database, using a Service Account token to poll specific cells for instructions before writing results from tasks back into adjacent columns. “This is part of an ongoing trend of actors increasingly finding success in abusing SaaS platforms as an alternative to creating and maintaining their own custom infrastructure,” according to Google’s researchers. Attackers are also forging malware that routes C2 traffic through trusted services such as OpenAI APIs. For example, the SesameOp backdoor routes traffic through OpenAI’s Assistants API https://www.microsoft.com/en-us/security/blog/2025/11/03/sesameop-novel-backdoor-uses-openai-assistants-api-for-command-and-control/ , masking C2 communications as legitimate AI development work. “In cases such as the SesameOp backdoor https://www.csoonline.com/article/4083999/new-backdoor-sesameop-abuses-openai-assistants-api-for-stealthy-c2-operations.html , traffic looks like normal AI development activity,” says Parthiban Jegatheesan, managing director at Peneto Labs. “To security tools, it blends in with legitimate business use, making it much harder to block without breaking real workflows.” Malware such as VEILDrive https://www.hunters.security/en/blog/veildrive-microsoft-services-malware-c2 and malign variants of the Havoc Framework post-exploitation framework abuse the Microsoft Graph API. “The malware authenticates to a legitimate corporate SharePoint or OneDrive tenant where it utilizes Graph API to read command files such as cmd.txt and write ‘output’ files e.g., results.json directly into a folder that looks like a user’s personal backup,” explains Kwangyun Keum, a senior offensive security engineer. Attackers are targeting OAuth tokens, service accounts, and cloud APIs to move through enterprise environments while flying under the radar of conventional malware detection. In September, healthcare technology firm Veradigm admitted attackers abused a third-party vendor’s credentials to access “certain personal data of patients, including, in some instances, Social Security numbers.” The Gentlemen ransomware group claimed responsibility for the attack and threatened to publicly release stolen data. Veradigm played down the significance of the breach https://www.sec.gov/Archives/edgar/data/1124804/000119312526385249/mdrx-20260908.htm , stating only a small number of customers were impacted and stated neither clinical nor medical data was exposed. “The company says the credentials reached only that interface, not its wider network,” says Ronald Lewis, head of cybersecurity governance at application security firm Black Duck. “Attackers didn’t compromise server resources but rather exploited a trusted identity with a path to sensitive data. This is the epitome of ‘living off the cloud.’” US medical-device manufacturer Stryker suffered a destructive cyberattack in March after attackers reportedly gained access to its Microsoft Intune cloud endpoint management platform. Iran-linked hacktivist group Handala reportedly used the compromised access to wipe thousands of employee laptops and mobile devices. Stryker acknowledged the attack had affected its operations and caused global disruption https://www.stryker.com/gb/en/about/news/a-message-to-our-customers-03-2026.html . “The impact reached beyond the company: Health systems rescheduled some surgical procedures when Stryker couldn’t deliver patient-specific implants and components,” says Black Duck’s Lewis. “The cloud management plane is now the attack surface, and a compromised admin account can do what once required custom malware.” Attackers are increasingly storing second-stage payloads or configuration files in cloud storage services — for example, S3-compatible buckets — instead of their own servers. “These files are pulled down only when needed, reducing the malware footprint on disk and allowing attackers to swap payloads without redeploying malware,” Peneto Labs’ Jegatheesan says. Attackers have also shifted from traditional FTP drops or risky pastebin text storage sites to exfiltrating massive troves of sensitive data via everyday cloud-based corporate communication tools such as Slack and Discord, according to Nicholas Carroll, manager cyber incident response at Nightwing. Carroll says that in recent attack campaigns threat actors “configured compromised servers to execute HTTPS POST requests to api.slack.com, hooks.slack.com, or discord.com,” using these endpoints to exfiltrate “heavily monitored secrets such as AWS Access Keys, SSH keys, and internal API tokens directly into attacker-controlled chat channels.” Several campaigns demonstrate full cloud-native attack chains, including one campaign linked to a Chinese cyberespionage group. “Since March 2024, Genesis Panda https://www.crowdstrike.com/en-us/adversaries/genesis-panda/ has systematically weaponized cloud services across the full attack chain — querying AWS Instance Metadata Service IMDS for credential harvesting, using cloud storage for payload hosting, routing C2 through domains impersonating legitimate cloud services, and using cloud compute for data exfiltration,” says Diptamay Sanyal, a principal engineer at CrowdStrike. “The cloud isn’t a target here — it’s the entire operational backbone,” Sanyal adds. Attackers are increasingly hosting lures and login pages on legitimate cloud infrastructure. For example, Russia-nexus hacking group Cozy Bear APT 29 delivered phishing links redirecting to authentic Microsoft login pages, removing the most common phishing red flag — suspicious domains. “Victims only ever saw legitimate Microsoft infrastructure, making traditional URL-based detection useless,” says Sanyal. Trusted cloud platforms are hosting the attack infrastructure of many cybercriminals. “Phishing kits including EvilTokens https://www.csoonline.com/article/4153742/eviltokens-abuses-microsoft-device-code-flow-for-account-takeovers.html , Tycoon2FA, and Kali365 rely heavily on Cloudflare’s workers.dev and similar developer platforms to host phishing pages, while AI copies a target’s branding from a single URL,” says Brandon Tirado, VP of GreyMatter Operations at threat intelligence firm ReliaQuest. “Because these services have legitimate uses, the pages tend to get past email gateways and signature detection.” Attackers are abusing serverless services, such as AWS Lambda or Azure Functions, to conduct network reconnaissance and scanning. The tactic was deployed during the HazyBeacon campaign targeting governmental entities in Southeast Asia https://unit42.paloaltonetworks.com/windows-backdoor-for-novel-c2-communication/ and uncovered by Palo Alto Networks’ Unit 42 threat intel division. “Instead of scanning a target from a single compromised server, which gets its IP blocked immediately, the attacker spins up thousands of ephemeral Lambda functions,” says Kaveh Ranjbar, co-founder and CEO of Whisper Security, and ex-CIO/CTO of RIPE NCC. “Each function scans a small slice of the target network and then dies.” The traffic originates from high-reputation Amazon IPs that rotate constantly. Enterprise firewalls cannot block these IPs without breaking their own access to legitimate AWS services. “The attacker effectively ‘launders’ their traffic through Amazon’s reputation,” Ranjbar adds. Adversaries are bypassing inbound firewall rules by utilizing legitimate “tunnelling” services hosted on major cloud providers. “An attacker compromises an internal server but cannot open a port to listen for commands due to the corporate firewall,” Whisper Security’s Ranjbar explains. “So, they install a Cloudflare Tunnel or ngrok agent. This agent initiates an outbound connection to the cloud provider, which is usually allowed.” Ranjbar adds: “To the security team, this looks like legitimate, encrypted HTTPS traffic going to Cloudflare or AWS. In reality, it is a stable C2 channel that tunnels right through the perimeter defenses using trusted infrastructure as the carrier.” Cybercrime groups such as Scattered Spider https://reliaquest.com/blog/scattered-spider-attack-analysis-account-compromise/ and Storm-0501 abuse the “snapshot sharing technique,” creating a high-impact IaaS attack vector in the process. The approach bypasses traditional network security by weaponizing the cloud’s management layer. “Rather than downloading malicious files, the adversary creates a snap ‘photograph’ of the victim server’s entire hard drive and simply ‘shares’ it using the ModifySnapshotAttribute API with an external cloud account the attackers control,” says offensive security engineer Keum. “The attacker subsequently restores the snapshot and then perform attacks such as ‘offline’ credential dumping.” China-nexus actor Murky Panda https://www.crowdstrike.com/en-us/blog/murky-panda-trusted-relationship-threat-in-cloud/ compromised upstream IT service providers to silently pivot into downstream victims through trusted Entra ID formerly Azure AD tenant connections, according to CrowdStrike. Hacking into Entra ID tenant configurations to gain admin privileges is also a feature of ransomware group Storm-0501’s tradecraft https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/ . Groups such as Storm-0501 have abused cloud-native secrets stores such as AWS Secrets Manager to harvest credentials as part of its broader ransomware and extortion campaigns. “Instead of dumping credentials from endpoints, attackers query secrets directly through cloud APIs,” says Peneto Labs’ Jegatheesan. “This avoids endpoint detection and shifts the attack into places many security teams monitor less closely.” Miscreants have even built cloud-native malware made up of custom loaders, implants, rootkits, and modular plugins, and designed to achieve persistence on compromised targets. For example, VoidLink https://research.checkpoint.com/2026/voidlink-the-cloud-native-malware-framework/ is a highly advanced malware framework purpose-built to compromise major cloud infrastructures such as AWS, Azure, GCP, and Kubernetes clusters. The framework, apparently built and maintained by Chinese-affiliated developers, was first identified by researchers from Check Point.