Attackers hide command and control in trusted cloud services
Original title: 14 ways attackers abuse cloud services to hack your enterprise
Cited cases include Gridtide on Google Sheets, SesameOp via OpenAI APIs, and a reported Intune wipe at Stryker.
A CSO Online roundup describes attackers using trusted SaaS, cloud APIs, and identity systems so malicious activity resembles normal enterprise traffic. Google and Mandiant disrupted suspected Chinese espionage group UNC2814, whose Gridtide malware used Google Sheets for command and control. Other examples include SesameOp through OpenAI’s Assistants API and Microsoft Graph abuse by VEILDrive and Havoc variants. It also recounts vendor-credential access at Veradigm and a reported Intune wipe at Stryker.
Unconfirmed: UNC2814 is described as suspected Chinese espionage; the Gentlemen claim and Handala wipe are reported, not independently confirmed here.
- Gridtide polls a threat-actor spreadsheet and writes task results into adjacent columns.
- Veradigm said vendor credentials exposed some patient data, including some Social Security numbers.
- The Gentlemen group claimed the Veradigm attack and threatened to release stolen data.
- Handala reportedly wiped Stryker devices after access to Microsoft Intune in March.
- Stryker said operations were disrupted and some surgeries were rescheduled.
Impact: Command and control, data theft, or remote device wipes
- Organizations
- Mandiant
- Countries
- ChinaIranUnited States
From the original article
7 min read at csoonline.com
Attackers are increasingly abusing trusted SaaS platforms, cloud infrastructure, and identity systems to blend malicious activity into legitimate enterprise traffic. Adversaries are pushing command and control (C2) through high-reputation services, including OpenAI and AWS, to blend in with normal business traffic and evade blocklists.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.