Casting Light on Shadow Cloud Deployments

Casting Light on Shadow Cloud Deployments

Speakers: Brittney Argirakis, Chapin Bryce

Conference: ShmooCon 2025

YouTube: https://www.youtube.com/watch?v=-_jUZBMeU5w

Overview

In an era of rapid cloud adoption, organizations frequently grapple with the unforeseen security risks posed by unmanaged and unmonitored cloud resources. This talk, "Casting Light on Shadow Cloud Deployments," delivered by incident response experts Brittney Argirakis and Chapin Bryce at ShmooCon 2025, addresses the critical issue of shadow cloud infrastructure – cloud assets spun up outside of official security and governance processes, often becoming prime targets for initial access by threat actors. The speakers highlight how these forgotten or overlooked deployments, ranging from simple proof-of-concept (PoC) instances to test environments, can lead to severe breaches, including ransomware and cryptojacking.

Argirakis and Bryce, drawing from their extensive experience as incident response consultants, reveal a significant gap in existing cloud security tools. While many solutions excel at long-term security posture management, they often fall short in providing the rapid, actionable intelligence needed for incident responders to quickly triage and understand the scope of a breach involving an exposed cloud asset. To fill this void, they developed Luminat, an open-source tool designed specifically for incident response triage, combining internal cloud API data with external reconnaissance techniques to provide a comprehensive view of potentially vulnerable public-facing resources.

The talk underscores the urgent need for organizations to not only establish robust cloud discovery and governance but also to equip their security teams with tools that can quickly identify and contextualize shadow cloud deployments. By demonstrating Luminat's capabilities, Argirakis and Bryce offer a practical solution for defenders to proactively uncover these hidden risks and react more effectively when an incident occurs, ultimately helping leadership make informed decisions during critical security events.

Background

▶ Watch: Welcome and introduction to Shadow Cloud deployments (5:25)

The proliferation of cloud computing has brought unprecedented agility and scalability to organizations, but it has also introduced new security challenges, particularly concerning the visibility and control of deployed resources. The core problem addressed by this talk is the emergence of shadow cloud deployments – instances, services, or entire environments provisioned without proper oversight, often by individual developers or teams operating outside established IT and security protocols. These shadow assets frequently possess public IP addresses, making them accessible from the internet and ripe for exploitation.

Brittney Argirakis and Chapin Bryce detailed several common scenarios that lead to these dangerous exposures:

• Proof-of-Concepts (PoCs) Turning Production: A prevalent issue where a quick PoC, initially intended for internal testing, is left running and eventually becomes a critical, publicly accessible component of the infrastructure without undergoing security review or hardening.
• "Just Test Data" Fallacy: Environments containing copies of production data, often sensitive, are deemed "just test data" and deployed with lax security controls, becoming attractive targets for data exfiltration.
• Dev Account Clones: Production environments cloned into development accounts, often with simplified security configurations, creating a vulnerable replica that can be easily compromised.
• Unauthorized Cloud Account Creation: Especially common with newer employees or those accustomed to personal cloud usage, individuals might spin up cloud environments using personal or unapproved corporate accounts, creating massive blind spots for security teams. This is also exacerbated in M&A contexts where newly acquired entities might bring their own unreviewed cloud infrastructure.
• Lack of Security Review: The rapid pace of cloud adoption often means that security reviews are bypassed or not yet integrated into the deployment pipeline, leading to publicly exposed resources with default or insecure configurations.

The speakers highlighted that while traditional on-premises initial access issues have migrated to the cloud (e.g., a Django instance moving from a "drippy server room" to a publicly exposed EC2 instance), the ease of spinning up cloud environments with public IP addresses exacerbates the problem. Anyone with a credit card, or even utilizing free tiers, can quickly create an exposed environment, expanding the scope and impact of potential breaches.

Existing Cloud Security Posture Management (CSPM) tools, while valuable for maintaining long-term security posture across an entire cloud account, often fall short in the context of immediate incident response triage. These tools are designed to provide a broad overview of configurations and compliance, but incident responders need quick, specific answers: What resources are affected? Who owns them? How long have they been exposed? What services and vulnerabilities are present? Is this an isolated incident or part of a larger compromise? Tools like Perimeterator (which uses Nmap) or Cloud Mapper provide network mapping capabilities, but a more integrated approach tailored for IR triage was missing. This gap motivated the development of Luminat.

Key Findings

▶ Watch: Speakers' background in incident response consulting (6:10)

The central finding presented by Argirakis and Bryce is the critical need for an incident response-focused tool to address the pervasive issue of shadow cloud deployments. They observed that while many excellent cloud security tools exist, they primarily serve Cloud Security Posture Management (CSPM), offering a broad, long-term view of an organization's cloud security. This is invaluable for proactive hardening and compliance, but it doesn't directly cater to the immediate, high-pressure demands of incident triage.

Their experience as IR consultants revealed that during an active incident, security teams are bombarded with questions from leadership, legal, and PR. These questions demand swift answers about the nature and scope of the exposure:

• Are production or just test data impacted?
• How many customers are affected?
• Who is the resource owner?
• What is the exposure timeframe (hours vs. years)?
• What specific services and vulnerabilities are involved?
• Is the incident isolated or widespread?

Existing tools often provide an overwhelming amount of information, making it difficult for responders to quickly extract these crucial details. The speakers found that no single tool offered a streamlined way to combine internal cloud configuration data with external reconnaissance to gain a rapid understanding of publicly exposed assets and their potential impact.

Furthermore, the talk illuminated several real-world consequences of shadow cloud deployments:

• Supply Chain Attacks: Illustrated by a 2024 campaign targeting an Indian bank, where a vulnerable, publicly exposed Jenkins server led to a local file inclusion (LFI) vulnerability. Attackers read credentials.xml, decrypted SSH private keys for an internal GitHub repository, and ultimately accessed customer environments, leading to ransomware and a broader supply chain attack. This highlights how a single overlooked instance can have catastrophic ripple effects.
• Cryptojacking: A more common, though less headline-grabbing, outcome. Threat actors exploit exposed instances to mine cryptocurrency, racking up "millions of dollars of expenses" for the victim organization. The speakers cited a 2017 case where the same C2 infrastructure targeted both Jenkins services and Windows-based Oracle WebLogic instances, emphasizing that the specific service or operating system is less relevant than the fact of its exposure.
• Data Dumps and Ransom Notes: A small organization's Digital Ocean droplets suffered a MongoDB instance exposure, resulting in data exfiltration and a ransom note, demonstrating that even small businesses without dedicated security teams are highly vulnerable.

These findings collectively underscore that shadow cloud deployments are not theoretical risks but active, exploited vectors for various attack types, and current tooling inadequacies exacerbate the challenge for incident responders.

Technical Deep Dive

▶ Watch: Initial access issues moving to cloud infrastructure (7:15)

To address the identified gaps in incident response tooling for shadow cloud deployments, Brittney Argirakis and Chapin Bryce developed Luminat, an open-source tool designed for rapid triage and contextualization of exposed cloud resources. Luminat adopts an "inside-to-outside" detection approach, combining internal cloud configuration analysis with external network scanning to provide a comprehensive picture.

The "inside" component of Luminat begins by querying cloud provider APIs for network interfaces (ENIs) that possess public IP addresses. This initial filtering significantly narrows the scope, focusing only on resources that could potentially be exposed to the internet. Once these ENIs are identified, Luminat expands its internal investigation to gather further context:

• Security Groups: It identifies security groups associated with the ENIs and, crucially, lists out all permissive rules that allow inbound traffic from routable IP addresses (e.g., 0.0.0.0/0) on specific ports and protocols. This immediately highlights potential attack vectors.
• Associated Resources: Luminat then looks for other connected resources, such as EC2 instances and Load Balancers, to understand the full infrastructure chain behind the exposed ENI. The speakers noted that while currently focused on these, the tool is designed to integrate context from many other resource types in the future.
• CloudTrail: To answer "who, what, and when," Luminat queries AWS CloudTrail logs. This provides critical event history, showing who created or modified resources, what specific actions were taken (e.g., opening ports), and the exact timestamps of these changes. This is invaluable for establishing an exposure timeline and identifying the responsible parties.
• AWS Config: If enabled, Luminat also leverages AWS Config to track configuration changes over time, offering another layer of historical context on how a resource's security posture evolved.

The "outside" component of Luminat then takes the identified public IP addresses and performs external reconnaissance, simulating an attacker's perspective:

• Nmap: A staple in network scanning, Nmap is used to actively scan for open ports and services responding on the public IP addresses. This confirms actual network exposure, as internal configurations might theoretically allow traffic, but network routes or other controls could prevent external access. Nmap provides definitive proof of reachability.
• WhatWeb: This powerful application fingerprinter is employed for HTTP service detection. WhatWeb boasts over 1,100 plugins, allowing it to identify web technologies, content management systems, web servers, and their versions with high accuracy. The speakers highlighted its utility for quickly determining what web application is running on an exposed port without manual inspection.
• Shodan: Luminat integrates with Shodan, the "search engine for the internet of things," to gain an attacker's view of the exposed infrastructure. Shodan's historical data can reveal services that were exposed in the past, even if they are no longer active, and provides a global perspective on the resource's visibility. This helps validate findings and understand what information a threat actor might already possess.

Luminat is designed with flexibility in mind, offering several configuration options:

• Scan Type Toggling: Users can enable or disable different internal or external scan types based on their specific needs.
• Allow Listing: The tool supports allow-listing known good or already reviewed network interfaces, preventing redundant scans.
• Tag Filtering: Resources deployed via infrastructure as code (e.g., CDK, Terraform) can often be identified by tags. Luminat allows filtering based on these tags, enabling users to exclude properly managed resources from scans.
• Output Formats: By default, Luminat reports to the terminal, but it also generates comprehensive output in JSON (for detailed programmatic analysis) and a CSV timeline (for easy integration into incident response timelines and further analysis).

The tool is implemented in Python and is available on PyPI and GitHub (with a Docker container for ease of deployment, including Nmap and WhatWeb). It requires AWS credentials with specific read-only IAM permissions to perform its internal API calls, ensuring it adheres to the principle of least privilege. The configuration file uses the TOML format, making it human-readable and easy to manage.

Demo / Proof of Concept

▶ Watch: Common scenarios for publicly exposed cloud infrastructure (8:00)

The live demonstration of Luminat provided a clear illustration of its capabilities and the immediate value it brings to incident response. Chapin Bryce presented the tool running within a Docker container, simplifying setup by pre-installing dependencies like Nmap and WhatWeb.

The demo began by showing Luminat's help command, highlighting its various options. Bryce then executed Luminat, providing an API key for Shodan (stored in a TOML config file) and specifying US East 2 as the target AWS region. He emphasized the importance of not using default AWS profiles for security, though he used one for the demo's convenience.

Luminat quickly identified five ENIs with public IP addresses. The output, designed for clear triage, immediately began displaying details:

1. IP Address and Region: The public IP and AWS region were prominently displayed.
2. Network Interface Information: Details about the ENI itself, including its VPC, Availability Zone, and associated Security Groups.
3. Permissive Security Group Rules: Crucially, Luminat listed specific security group rules that were "permissive," meaning they allowed inbound traffic from routable IP addresses (e.g., 0.0.0.0/0) on particular ports (e.g., TCP 443) and protocols. This immediate identification of open ports is vital. In the demo, a description "web" was associated with a rule for Port 443.
4. Load Balancer Context: The tool identified that a Load Balancer was associated with the network interface. It specified that the load balancer was internet-facing, created on "January 7th," and had listeners configured on Port 443 (HTTPS). This provided an early hint that a web application was involved.
5. CloudTrail Entries: Luminat then presented relevant CloudTrail entries, crucial for understanding the history of the resource. While the terminal output showed a summary, Bryce noted that the full CSV output provides much greater detail. These logs revealed significant activity on "January 7th," with a user identified as "C Bryce Dev" adding rules and, notably, opening "quad zero" (0.0.0.0/0), confirming the broad public exposure.
6. Nmap Results: The external Nmap scan confirmed that Port 443 was indeed open and responding. It further affirmed that "AWS Elastic Load Balancing" was the target, aligning with the internal findings.
7. Shodan Results: Luminat integrated Shodan's findings. An important caveat was highlighted: Shodan might show historical data (e.g., TCP 80 activity from December 22nd) that is no longer current due to IP address recycling. However, more recent data from January 10th confirmed TCP 443 exposure, specifically identifying "Grafana" as the service. Shodan also indicated that a domain, "Luminat.org," was connected to the IP, adding further context.
8. WhatWeb Results: The WhatWeb scan provided specific web application fingerprinting. It successfully identified "Grafana" and, critically, its version number: "114.0." It also scanned various endpoints, including following redirects, which is useful for discovering login pages. This version number is a direct input for vulnerability research (e.g., searching for "Grafana 114.0 vulnerabilities").

The demo concluded by showcasing the CSV timeline and JSON output formats, emphasizing their utility for deeper analysis and integration into existing IR workflows. Bryce also displayed the minimal TOML config file used and the necessary AWS IAM policy with read-only permissions, reinforcing security best practices for tool deployment. The entire scan, from internal API calls to external reconnaissance, completed within minutes, demonstrating Luminat's efficiency for rapid incident triage.

Defensive Implications

▶ Watch: Audience poll: Justifications for exposed cloud resources (9:30)

The insights and tooling presented by Brittney Argirakis and Chapin Bryce offer several critical implications for organizations seeking to strengthen their cloud security posture and improve incident response capabilities:

1. Implement Robust Cloud Discovery and Governance: The most fundamental defensive measure is to establish comprehensive processes for discovering and governing all cloud resources. This includes mandatory security reviews for any new cloud deployment, regardless of its perceived purpose (PoC, test, dev, or production). Organizations must actively prevent "shadow IT" in the cloud by enforcing strict policies around account creation and resource provisioning.
2. Continuous Monitoring of Public-Facing Assets: Organizations should regularly audit and scan their public-facing cloud resources. Tools like Luminat can be invaluable for proactive threat hunting, allowing security teams to periodically scan their AWS accounts and identify previously unknown or forgotten public exposures before threat actors do.
3. Strict Security Group and Network ACL Management: The demo highlighted the danger of permissive security group rules, particularly those allowing inbound traffic from 0.0.0.0/0 (quad zero). Defenders must implement the principle of least privilege for network access, ensuring that only necessary ports are open to the absolute minimum required IP ranges. Regular reviews of security group configurations are essential.
4. Enforce Security Reviews for All Deployments: The "PoC turning production" and "test data" scenarios underscore the need for consistent security reviews across the entire development lifecycle. Even temporary or non-production environments should be treated with caution, especially if they contain sensitive data or can serve as an initial access vector into the broader network.
5. Patch and Update Services Diligently: The Jenkins breach example serves as a stark reminder of the risks associated with running vulnerable software. Organizations must prioritize patching and updating all services, including those in non-production environments. If a critical plugin prevents an update, that dependency must be addressed or the service isolated.
6. Leverage CloudTrail and AWS Config for Auditing: CloudTrail logs and AWS Config records are invaluable sources of truth. Defenders should actively monitor these services for suspicious activity, such as the creation of new public IP addresses, changes to security group rules, or modifications to critical resources. Integrating these logs into a Security Information and Event Management (SIEM) system is crucial for real-time alerting.
7. Educate Developers on Secure Cloud Practices: Many shadow cloud deployments stem from a lack of awareness among developers regarding the security implications of their actions (e.g., spinning up personal cloud accounts, exposing services). Comprehensive security training tailored to cloud environments can empower developers to build securely by design.
8. Prepare for Incident Response Triage: Luminat is built as an IR triage tool. Defenders should integrate such tools into their incident response playbooks. Having the capability to quickly answer critical questions about an exposed asset – its owner, exposure time, associated services, and potential vulnerabilities – significantly reduces response time and helps leadership make informed decisions during a crisis.
9. Understand the Financial Impact of Cryptojacking: While less dramatic than ransomware, cryptojacking can lead to "millions of dollars of expenses." Defenders should educate stakeholders on these hidden costs and prioritize the detection and remediation of any resource being exploited for unauthorized cryptocurrency mining.

By adopting these defensive strategies, organizations can significantly reduce their attack surface in the cloud, minimize the risks posed by shadow deployments, and enhance their ability to respond effectively to cloud-based incidents.

Key Takeaways

• Shadow Cloud Deployments are a Major Initial Access Vector: Unmanaged and unmonitored cloud resources, often spun up for PoCs or testing, are frequently left exposed and become prime targets for threat actors, leading to breaches like ransomware and cryptojacking.
• Existing CSPM Tools Lack IR Triage Focus: While valuable for long-term posture, traditional Cloud Security Posture Management (CSPM) tools are not designed for the rapid, specific intelligence needed by incident responders to quickly understand the "who, what, when, where, and how" of an exposed asset.
• Luminat Provides a Holistic "Inside-to-Outside" View: The open-source tool Luminat addresses this gap by combining internal AWS API data (CloudTrail, AWS Config, ENIs, Security Groups) with external reconnaissance (Nmap, WhatWeb, Shodan) to offer a comprehensive and rapid assessment of public-facing cloud resources.
• Common Causes are Human and Process-Related: Shadow cloud often results from PoCs turning into production, lax handling of "test data," unauthorized account creation, or a lack of integrated security reviews in rapid cloud adoption scenarios.
• Real-World Impacts are Severe: Case studies highlight consequences ranging from supply chain attacks (vulnerable Jenkins leading to SSH key compromise and customer impact) to costly cryptojacking (exposed Oracle WebLogic or MongoDB instances).
• Proactive Governance and Education are Crucial: Effective defense requires robust cloud discovery and governance, continuous monitoring of public assets, strict security group management, diligent patching, and ongoing security education for developers on secure cloud practices.

About the Speaker(s)

Brittney Argirakis is an experienced Incident Response Consultant. Throughout her career, she has navigated both private and public consulting sectors, bringing a wealth of knowledge from dealing with diverse threat actors and incident scenarios across various organizations. Her practical experience heavily informs the understanding of initial access issues moving to cloud infrastructure.

Chapin Bryce is also an accomplished professional who began his career as an Incident Response Consultant alongside Brittney. He has since transitioned into a developer role, applying his deep understanding of incident response challenges to build practical security tools. His background in IR provides a unique perspective on the needs of security teams facing cloud-based threats.

Together, their combined experience provides a comprehensive view of the evolving threat landscape in cloud environments, making them uniquely qualified to discuss and provide solutions for "Shadow Cloud Deployments."