Google Cloud Platform Data Destruction via Cloud Build
Summary: Cisco Talos research shows that anyone holding the cloudbuild.builds.create permission can run any gcloud CLI command the Cloud Build service account is permitted to execute, and Talos demonstrated this by pushing a pull request to a GitHub repository configured to trigger a build. In its lab, Talos used that path to delete a Cloud Storage bucket and then recreate it under the same name, which defeats GCP's Soft Delete restoration because the name is reclaimed, and it also encrypted objects with a customer-provided key in a bucket without Object Versioning.
What's compelling: A single permission to submit a build job inherits everything the Cloud Build service account can do, so an attacker who never holds a GCP identity principal can still reach your storage through a pull request. Soft Delete only restores a bucket if its name is still free, and Object Versioning is the difference between an overwritten object being recoverable and being gone.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026