A Candid Perspective on the Cloud Threat Landscape: What’s Real, What’s Not, and What Should Change

A Candid Perspective on the Cloud Threat Landscape: What's Real, What's Not, and What Should Change

Speakers: Curtis Hanson, Managing Partner, Invictus Incident Response

Conference: fwd:cloudsec Europe 2025

YouTube: https://www.youtube.com/watch?v=8c3unhWyFGA

Overview

Curtis Hanson, Managing Partner at Invictus Incident Response and a threat intelligence professional with over 10 years of experience, presented a first-of-its-kind cloud-specific threat landscape for 2025. Compiled exclusively from open-source intelligence across 20+ high-quality sources, the dataset covers 41 real-world cloud attack cases through September 2025, mapped to threat actors, techniques, platforms, and MITRE ATT&CK — an effort that increased cloud-specific ATT&CK coverage from 20% to 80%. The talk delivers both a current-state assessment of who's attacking clouds and how, and a blunt critique of the cloud security community's reporting gaps.

Background

▶ Watch: Methodology explained — open-source only, excluding OS-heavy malware, unexplo... (2:00)

Annual threat reports from major security vendors rarely provide a cloud-native lens — cloud techniques get lumped in with broader threat trends, stripped of context, and reduced to meaningless metrics like "16x increase." There is no consistent signpost telling defenders which threat actors are cloud-fluent, which techniques are cloud-specific, or how to prioritize cloud defenses based on actual observed attacks. Hanson, self-admittedly new to cloud security, brought a seasoned CTI methodology to address this gap.

The research deliberately excluded three categories that often pollute cloud threat reporting:

• OS-heavy malware reports that are just Linux/ELF binary analysis labeled as "cloud malware" — obscuring the unique detection and response requirements of true cloud-native attacks.
• CVE-focused reporting without evidence of wild exploitation — including high-profile vulnerabilities like Ingress Nightmare that generated alarm but no follow-up on real-world exploitation.
• Theoretical techniques demonstrated in red team exercises but not yet observed in incidents — valuable research, but misleading when used to prioritize defensive resources for small teams.

Key Findings

▶ Watch: 50%+ cybercriminals, supply chain at one-third of attack types — SaaS applica... (6:00)

Threat actor distribution. Over 50% of observed cloud attacks are conducted by cybercriminals, suggesting defensive prioritization should center on BEC, cryptojacking, and data exfiltration/extortion. Espionage accounts for roughly a quarter, with another quarter attributed to unknown actors.

25 distinct threat actors identified. The dataset extracted 25 named threat actors operating in cloud environments, including Java Ghost, APT41, and various clustered activity groups (jinxes, UNKs, MUTs). This is the first consolidated list of cloud-native-fluent threat actors derived from open-source reporting.

Platform distribution. AWS and Microsoft environments dominate, consistent with market share. SaaS applications emerged as a significant category — representing the "new data plane" of cloud security. Oracle appeared following its 2025 incident.

Attack type breakdown. Phishing, cryptojacking, and data exfiltration comprise the majority. Supply chain attacks stood out at roughly a third of all cases, driven by GitHub Actions compromises, npm package hijacking, and SaaS integration abuse.

Three key observations for 2025:

1. Identity and long-standing access exploitation at scale. The Datadog blog on persistence-as-a-service using AWS keys demonstrated that Java Ghost — previously considered a script kiddy — has become genuinely sophisticated. A BEC case involving Dropbox showed threat actors establishing persistent mechanisms in third-party SaaS applications outside the victim's tenant, requiring cross-organizational remediation.

1. SaaS is the new data plane. The Salesforce breach exemplifies how attack surfaces are shifting from infrastructure you control to SaaS applications that read/write into your tenant. Device code authentication abuse, documented by Volexity in Russia-based threat actor campaigns, represents an identity attack vector that will likely expand.

1. Pipeline/platform supply chain integrity. GitHub Actions compromises (beginning of 2025) and npm package hijacking (6 hours of exposure, billions of downloads targeting cryptocurrency wallets) demonstrate the fragility of the software supply chain.

Technical Deep Dive

▶ Watch: BEC case study — Dropbox persistent mechanism required cross-organizational r... (10:00)

Hanson evaluated the cloud security community's reporting quality across four dimensions: attribution, MITRE ATT&CK mapping, security considerations/detection logic, and IOCs.

The good: Nearly 75% of reports include detection logic or security considerations plus IOCs — significantly better than traditional threat reporting. Cloud security's natural shift toward behavioral TTPs rather than ephemeral atomic IOCs (IP addresses with limited intelligence value) drives this positive trend.

The bad: Attribution is frequently missing — roughly 80-90% of reports lack threat actor identification or victimology. Without attribution, incident responders cannot answer "who did this?" and threat profiling for purple team exercises becomes impossible. Reports exhibit clear silos — some are written by detection engineers (strong on detection, weak on intel), others by CTI analysts (strong on attribution, weak on detection), and the worst are marketing-driven reports with slapped-on IOCs.

The ugly: Only 20% of cases were mapped to MITRE ATT&CK — a failure Hanson attributes to the community rather than to ATT&CK's limitations. Cloud-to-ATT&CK mapping is difficult, but 80% missing coverage indicates insufficient effort. Additionally, limited reporting from the Big Three cloud providers (who have the most telemetry and visibility) means the community relies on theoretical research to fill gaps that only CSPs can address with real-world data.

Hanson's contribution: He manually mapped the 41 cases to MITRE ATT&CK, bringing coverage from 20% to 80%. The mappings include technique, threat actor, and source reference, published as a living dataset on GitHub. The ATT&CK Navigator visualization reveals which techniques are most commonly exploited (cloud accounts being the dominant one) and can guide detection engineering, mitigation prioritization, and response playbook development.

Demo / Proof of Concept

▶ Watch: Community reporting quality — 75% have detection logic (good) but only 20% ma... (12:00)

No live demonstration was performed. Hanson shared a QR code linking to the complete dataset in a Google Sheet timeline and the MITRE ATT&CK mappings on GitHub. The dataset is designed to be a living, community-maintained resource.

Defensive Implications

▶ Watch: Hanson's MITRE ATT&CK mapping contribution — from 20% to 80% coverage, publis... (18:00)

For security teams:

• Use the cloud-specific ATT&CK mappings to identify coverage gaps in your detection engineering. Techniques you didn't know were being exploited may be relevant to your environment.
• Prioritize BEC, cryptojacking, and data exfiltration defenses — these dominate real-world cloud incidents by cybercriminal actors.
• Recognize that SaaS applications represent an expanding attack surface that may fall outside your tenant's detection perimeter. Persistent mechanisms in third-party SaaS (like the Dropbox BEC case) require cross-organizational remediation.
• Prepare for device code authentication abuse as an emerging identity attack vector.

For the community:

• Map findings to MITRE ATT&CK consistently. AWS has released platform-specific extensions that should serve as a model for other cloud providers.
• Include attribution (threat actor or at minimum victimology) in reports to enable threat profiling.
• Break reporting silos — cross-functional reviews combining CTI, detection engineering, and incident response perspectives produce the most actionable output.
• Pressure the Big Three CSPs to report more frequently on cloud-specific threats using their unparalleled telemetry.

For CSPs:

• Blog more frequently on cloud-specific threats with real-world exploitation data. The community's reliance on theoretical technique research is a direct consequence of CSP reporting silence.

Key Takeaways

• The first cloud-specific threat landscape for 2025 identifies 41 real-world cases, 25 distinct threat actors, and three key observations: identity exploitation at scale, SaaS as the new data plane, and supply chain integrity failures.
• Over 50% of cloud attacks are cybercriminal — prioritize BEC, cryptojacking, and data exfiltration defenses accordingly.
• Community ATT&CK mapping was at 20% — Hanson manually brought it to 80% and published the living dataset on GitHub for community contribution.
• 75% of cloud threat reports include detection logic or IOCs (strong), but attribution and ATT&CK mapping remain weak at 20% or less.
• SaaS applications are creating persistent attack surfaces outside the victim's tenant control, requiring cross-organizational remediation.
• The Big Three CSPs report too infrequently on cloud-specific threats despite having the most relevant telemetry.

About the Speaker(s)

Curtis Hanson is the Managing Partner at Invictus Incident Response, a cloud-focused incident response firm. He has over 10 years of threat intelligence experience and is relatively new to cloud-specific security, bringing traditional CTI best practices to the cloud domain. Invictus is known for cloud IR training and threat intelligence work. The cloud threat landscape dataset is maintained on the Invictus GitHub.