Navigating the Cloud: Exploring Lateral Movement Techniques
Summary: Unit 42 describes observed cloud lateral movement across AWS, GCP and Azure, where attackers with write-level IAM permissions used APIs such as CreateSnapshot to mount a target EC2 instance's EBS snapshot on an instance they controlled, and AuthorizeSecurityGroupIngress plus SendSSHPublicKey to open SSH and push keys. In other cases attackers used the Azure VMAccess extension to reset SSH keys, serial console access to bypass security group rules, and Systems Manager StartSession and SendCommand to reach managed instances and run credential-harvesting scripts at scale.
Bottom line: The barrier between cloud-level access and the compute instances running inside it is permeable by design: relatively powerful IAM credentials alone were enough to reach instance disks and pivot to further EC2 instances and development environments, without ever logging into the host interactively.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026