Attackers Abuse Trusted Cloud Services to Hide Malicious Traffic

Cybercriminals are increasingly manipulating trusted cloud infrastructure from major providers like Amazon Web Services, Google Cloud, Microsoft Azure, and Cloudflare to hide malicious traffic and sustain command and control operations.

Instead of hosting attacks on easily identifiable malicious servers, threat actors now embed their activities within legitimate cloud service traffic. This makes traditional reputation and blocklist–based security controls less effective and complicates detection for enterprise SOC teams.

Security teams must treat cloud abuse as a serious risk vector, not just a compliance or operational concern.

What Happened:

Recent threat intelligence analyses have exposed a pattern where attackers consistently route malicious traffic through reputable cloud service providers.

Investigations show cloud infrastructure from AWS, Google Cloud, Microsoft, and Cloudflare being used to host command and control (C2) traffic, phishing payloads, credential harvesting pages, and other malicious resources.

This activity blends with normal encrypted HTTPS traffic and often uses valid certificates and trusted IP ranges, making traditional detection methods ineffective.

Why This Issue Is Critical:

When attackers hide malicious activity behind trusted services, network defenders cannot rely on simple IP or domain reputation to block or flag threats.

Cloud providers’ infrastructure is ubiquitous and designed to serve billions of legitimate requests. That same trust implicitly applied by many security controls allows malicious activity to masquerade as normal behavior.

This erodes the effectiveness of perimeter defenses and forces security teams to adopt more advanced behavioral and contextual detection techniques.

How the Abuse Works:

Attackers abuse cloud services in a variety of ways. These abuses may include:

• Command and control traffic routed through Microsoft, AWS, or Google cloud endpoints
• Phishing kits hosted on trusted cloud subdomains
• Malware delivery via cloud storage or CDN services
• Persistent tunnels established using cloud provider features
• SSL/TLS encrypted communication blending malicious and legitimate traffic
• Staging and fallback infrastructure inside cloud APIs and storage buckets

Each of these methods allows attackers to maintain operational resilience and evade reputation‑based blocks by blending malicious traffic with normal cloud service use.

Typical Attack Chain:

A realistic cloud abuse attack chain may include the following steps.

• Attacker obtains access to compromised credentials or registers cloud service accounts
• Legitimate cloud APIs and services are used to deploy malicious infrastructure
• Infrastructure serves commands, phishing pages, or payloads under trusted domains
• Malicious traffic is routed over HTTPS via reputable cloud IP space
• Traditional detection mechanisms fail to flag the interaction
• Attacker maintains long‑lived C2 or exfiltration channels

Unlike traditional attacks that rely on externally flagged malicious servers, this pattern turns cloud providers’ trust into an operational advantage for attackers.

Why This Incident Matters for Cybersecurity:

This trend underscores a major shift in adversary tradecraft.

Cloud platforms are no longer just targets.

They are now essential parts of attacker infrastructure, used to mask malicious activity, evade network security controls, and prolong operations against enterprise environments.

As more organizations adopt cloud services, the sheer volume of legitimate traffic grows. Attackers exploit this scale to hide within noise that security tools and engineers struggle to differentiate from benign requests.

This makes detection, attribution, and response significantly more difficult.

Common Risks Highlighted:

This cloud abuse trend highlights important enterprise security weaknesses.

• Overreliance on reputation‑based blocking
• Lack of behavioral analysis for cloud‑origin traffic
• Insufficient monitoring of API and storage service use
• Weak visibility into cloud workload communications
• Unclear segmentation between trusted service use and attacker abuse
• Ineffective detection of encrypted malicious traffic
• Poor cloud identity and credential governance
• Limited telemetry linking cloud events to endpoint impact

These risks can allow attackers to maintain a foothold and operate under the guise of normal business activity.

Potential Impact:

Abuse of cloud services can lead to several serious enterprise impacts.

• Compromise of credentials and accounts
• Persistent command and control infrastructure
• Credential harvesting and phishing success
• Exfiltration of sensitive data via trusted channels
• Evasion of network defenses and IDS/IPS logic
• Extended dwell time before detection
• Increased operational and incident response costs
• Loss of confidence in perimeter‑centric security controls

Because cloud providers are deeply integrated into modern IT stacks, these impacts can span multiple enterprise layers.

What Organisations Should Do Now:

Enterprises must adapt their security posture to address abuse of cloud infrastructure.

• Inventory cloud service use across all providers and regions
• Adopt behavioral and anomaly detection for cloud traffic
• Monitor for unusual API calls and storage access patterns
• Validate credentials, enforce strong IAM policies, and rotate keys
• Integrate cloud service telemetry into SIEM and SOAR systems
• Enable zero‑trust network access policies for cloud services
• Correlate cloud event logs with endpoint and identity data
• Deploy deception and honeypot strategies for cloud APIs
• Test cloud threat scenarios with red team and purple team exercises
• Establish clear playbooks for cloud abuse and incident response

Traditional network controls are not sufficient when attackers can hide within the very services enterprises depend on for operations.

Detection and Monitoring Strategies:

Defenders should expand monitoring and detection for cloud abuse.

• Track unusual access patterns to cloud storage and CDN services
• Detect anomalous TLS usage patterns tied to trusted cloud IP ranges
• Monitor for API call volume spikes inconsistent with business use
• Review cloud service audit logs for elevated privileges or misuse
• Correlate cloud events with endpoint detections and identity alerts
• Deploy threat intelligence feeds focused on cloud abuse patterns
• Watch for persistent HTTPS connections to unexpected cloud endpoints
• Investigate unusual reverse proxy behavior tied to cloud URLs
• Analyze failed login attempts to cloud consoles and developer tools
• Validate session tokens and MFA behavior for anomalies

Combining telemetry across network, endpoint, identity, and cloud is crucial for visibility.

The Role of Incident Response Planning:

Incident response teams must prepare for cloud abuse scenarios.

Response plans should include procedures for:

• Isolating compromised cloud identities
• Rotating access keys and secrets
• Reconstructing attack timelines across cloud services
• Preserving cloud logs for forensic analysis
• Cross‑tenant threat hunting for suspicious activity
• Engaging cloud provider support and abuse teams
• Aligning cloud and on‑premise incident response workflows

Cloud abuse incidents often span identity, application, and infrastructure domains, requiring coordinated investigation and remediation.

Penetration Testing Insight:

Penetration testers should include cloud abuse scenarios in engagements.

Tests should validate:

• Exposure of public cloud storage and CDN endpoints
• Credential hygiene and API misuse risk
• Privilege escalation in cloud IAM configurations
• Ability to host covert command channels on trusted cloud services
• Effectiveness of IDS/IPS against cloud‑origin malicious traffic
• Resilience against phishing infrastructure hosted inside cloud platforms
• Detection efficacy for cloud telemetry and SIEM correlations

Testing should go beyond misconfigurations to simulate real attacker behavior leveraged in cloud abuse campaigns.

Expert Insight:

James Knight, Senior Principal at Digital Warfare, said:

“Attackers are no longer just probing the perimeter. They are embedding their infrastructure inside the systems organizations trust most. To defend effectively, enterprises must shift from reputation‑centric controls to behavior‑centric visibility.”

Call to Action:

Organizations should not assume that trusted cloud services are safe by default.

Validate cloud service use, test for abuse patterns, correlate telemetry across services, and confirm that malicious activity cannot hide within your cloud footprint.

Contact Digital Warfare to schedule a security consultation and assess whether your cloud infrastructure can withstand emerging cloud abuse threats.