Cyber Attacks: How Criminals Exploit SaaS and Cloud to Evade Defenses

New wave of attacks exploiting SaaS platforms and cloud infrastructures

Attackers are increasingly abusing reliable SaaS platforms, cloud infrastructures, and identity systems to blend malicious activities with legitimate business traffic. This tactical evolution represents a qualitative leap in the sophistication of cyber attacks, with significant implications for cyber insurance and breach remediation strategies.

Quick Response

From "Living off the Land" to "Living off the Cloud"

The transition from abusing local binaries like PowerShell to exploiting native cloud tools represents a strategic adaptation to hybrid and cloud IT environments. Arif Khan, head of threat hunting and response services at Mitiga, highlights how attackers now exploit APIs, identity systems, and management consoles to operate using legitimate functionalities, making their detection difficult.

Bypassing traditional defenses

Abusing cloud-based systems eludes traditional defenses that rely on domain reputation and static blocklists. This approach allows attackers to mount attacks more easily, using cloud infrastructure to mask their activities. Fredrik Almroth, security researcher and co-founder of Detectify, highlights how traffic through legitimate cloud platforms appears as routine activity to trusted providers.

Concrete examples of attacks

Researchers from Google and Mandiant recently disrupted a cyber-espionage operation suspected of originating from China (UNC2814) that abused the legitimate functionalities of Google Sheets to evade detection. The malware Gridtide at the center of the campaign connected to a spreadsheet controlled by the threat actor for command and control (C2), allowing it to blend with normal network traffic.

Abuse of OpenAI APIs

Another significant example is the SesameOp backdoor, which redirects C2 traffic through OpenAI's Assistants API. This approach masks C2 communications as legitimate AI development activity, making it difficult to block without disrupting real workflows. Parthiban Jegatheesan, managing director of Peneto Labs, highlights how this type of traffic appears normal to security tools.

Abuse of Microsoft Graph API

Malware such as VEILDrive and malicious variants of the Havoc post-exploitation framework abuse the Microsoft Graph API. The malware authenticates to a legitimate SharePoint or OneDrive tenant, using the Graph API to read command files like cmd.txt and write output files (e.g., results.json) directly into a folder that appears to be a user's personal backup.

Abuse of OAuth tokens and service accounts

Attackers are targeting OAuth tokens, service accounts, and cloud APIs to move within corporate environments undetected. In a recent incident, Veradigm admitted that attackers abused the credentials of a third-party provider to access "personal data of some patients, including, in some cases, social security numbers." The Gentlemen ransomware group claimed responsibility for the attack.

Destructive attacks via cloud endpoint management

In March, the U.S. medical device manufacturer Stryker suffered a destructive attack after attackers gained access to its Microsoft Intune cloud endpoint management platform. The Iranian hacktivist group Handala used the compromised access to wipe thousands of employees' laptops and mobile devices, causing global operational disruptions. The impact also reached healthcare systems, forcing them to reorganize some surgical procedures.

Storage of payloads and configurations

Attackers are increasingly storing second-stage payloads or configuration files in cloud storage services like S3-compatible buckets, instead of using their own servers. These files are downloaded only when necessary, reducing the malware footprint on disk and allowing attackers to swap payloads without redistributing the malware. Nicholas Carroll, cyber incident response manager at Nightwing, highlights how aggressors are using business communication tools like Slack and Discord for exfiltrating large amounts of sensitive data.

Complete campaigns with cloud-native attack chains

Several attacks demonstrate complete cloud-native attack chains. For example, the Chinese cyber-espionage group Genesis Panda systematically instrumentalized cloud services throughout the attack chain, from credential harvesting to C2 routing through domains mimicking legitimate cloud services. Diptamay Sanyal, principal engineer at CrowdStrike, observes how the cloud is no longer just a target but the complete operational backbone of attacks.

Phishing with legitimate cloud infrastructure

Hacking groups like Cozy Bear (APT 29) have delivered phishing links that redirect to authentic Microsoft login pages, eliminating the most common red flag of phishing: suspicious domains. This approach renders traditional URL-based detection useless, necessitating advanced Data Loss Prevention and corporate DLP solutions.

Phishing kits and attack infrastructures

Phishing kits like EvilTokens, Tycoon2FA, and Kali365 rely on platforms like Cloudflare workers.dev to host phishing pages, while AI copies the target's branding from a single URL. Brandon Tirado, VP of GreyMatter Operations at ReliaQuest, highlights how these services have legitimate uses, allowing pages to bypass email gateways and signature-based detection.

Abuse of serverless services

Attackers are increasingly abusing serverless services like AWS Lambda or Azure Functions to conduct various malicious activities. These services, designed to execute code in response to events, offer a flexible and scalable environment that can be exploited to carry out attacks efficiently and discreetly. The abuse of these services represents a significant challenge for incident response teams, who must adapt their strategies to address this new frontier of threats.

Implications for corporate security

The evolution of attackers' tactics requires a rethinking of NIS2 compliance and DORA regulation strategies. Companies must adopt advanced managed SOC and MDR services to address these sophisticated threats. Additionally, the need for zero trust architecture and identity access management solutions becomes increasingly critical to protect cloud environments and prevent the abuse of credentials and tokens.

The abuse of legitimate cloud platforms poses a growing threat to organizations. Attackers are exploiting cloud infrastructure to mask their malicious activities, necessitating a proactive approach to security. Companies must invest in advanced cyber insurance and breach remediation technologies to protect their sensitive data and ensure digital operational resilience.