Responding to Cloud Incidents: A Step-by-Step Guide From the 2025 Unit 42 Global Incident Response Report
Summary: Unit 42's 2025 Global Incident Response Report states that 29% of incident investigations conducted in 2024 involved cloud or SaaS environments, and one in five incidents involved threat actors adversely impacting cloud environments and assets. Unit 42 says cloud investigations focus on identities, misconfigurations and service interactions rather than endpoints and network activity, and that most cloud breaches begin with compromised and overpermissioned identities.
Why it matters: Unit 42 reports that an organization which mitigated an attack was compromised again shortly after, because threat actors had automated exploitation of a vulnerability in a service used in its cloud products and used anti-forensic techniques to hide activity. A single admin-level account falling into the wrong hands is enough to wipe out business data or infrastructure.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026