iTWire – Google Cloud Security Threat Outlook Report

Cloud environments face an evolving threat from threat actors who prioritize data leakage, identity exploitation as a new perimeter, and adapt tactics to evade detection and attribution. This edition of the Google Cloud Threat Horizons report provides cloud security professionals with a deeper understanding of the threat through intelligence and actionable risk mitigations from Google's security experts. Ransomware and data threats in the cloud are nothing new. In February 2024, Google Cloud security and intelligence experts revealed trends in their Threat Outlook report, including threat actors prioritizing data exfiltration over encryption and exploiting server-side vulnerabilities.

Furthermore, our experts have cited ransomware incidents and data theft or associated risks in cloud environments in our previous 10 Threat Outlook reports. Despite the continued presence of ransomware and data theft risks, the trends we have observed in the latter half of 2024 reveal a worrying shift. Not only are threat actors improving their tactics, techniques, and procedures within cloud environments, they are also becoming more adept at concealing their identities.

This development makes it more difficult for defenders to counter their attacks and increases the likelihood of ransom payments. Recognizing our shared destiny in defending against evolving cloud threats, this Google Cloud Threat Horizons report provides timely analysis and actionable mitigations of recent ransomware and data theft trends identified by our security and threat intelligence experts that are disrupting them in today's threat landscape:

Risks to service accounts: Google Cloud research shows that service accounts with excessive privileges and lateral movement tactics represent increasingly significant threats, although credentials and misconfiguration issues remain common upon initial access. Identity Exploitation: Compromised user identities in hybrid environments can lead to persistent access and lateral movement between on-premises and cloud environments, subsequently leading to multi-faceted extortion. Cloud databases are under attack: Threat actors are actively exploiting vulnerabilities and weak credentials to access sensitive information. Increased Adaptability: Threat actors are taking advantage of ransomware-as-a-service (RaaS) offerings and adjusting tactics to evade detection and attribution. Diverse attack methods: The threat actor group we track as TRIPLESTRENGTH uses escalation of privilege, including charging fees to victims' billing accounts to maximize profits from compromised accounts. Threat actors are using increasingly sophisticated methods to steal data and extort organizations in the cloud: Threat actors are using Multi-Factor Authentication (MFA) bypass in cloud-based services to compromise accounts and aggressive communication strategies with victims to maximize their profits.

To stay ahead in 2025, a strong cloud security strategy must prioritize data leakage and identity protection. The report provides cloud security decision-makers with the latest information on threat actors' tactics and actionable mitigations to better guide cloud data security strategies.

The full report can be downloaded here: https://services.google.com/fh/files/misc/threat_horizons_report_h1_2025.pdf