Identifying & Analysing Emerging Cloud Threats

A new report from Aqua Security analysed 700,000 attacks in the wild and an analysis of threat actors’ changing tactics, techniques, and procedures. It provides security practitioners with greater insight into the mind of the attacker to help you make better, faster decisions to protect your entire cloud native stack
  
Cloud computing has transformed how businesses design, develop, deploy, and manage their applications for improved scalability, flexibility, and agility.

However, the sheer speed and scope of the cloud native environment demands smarter decisions when prioritising limited resources. Moreover, its enlarged attack surface and level of complexity attract additional risk, which must be addressed to meet the original purpose of deciding to migrate to the cloud.

Of the many findings in the report, one of the most significant demonstrates that threat actors are heavily investing resources to avoid detection and establish a stronger foothold in compromised systems. The research found that in one year there has been a 1,400% surge in fileless or memory-based attacks, which exploit existing software, applications, and protocols to perform malicious activities.

The tricky part is that the distributed nature of cloud native applications and associated components make it difficult to identify and mitigate potential threats. That’s why learning from the wider experiences of other companies can help bolster your defences. We have grouped our findings around three distinct areas based on this wider feedback.

Software Supply Chain Threats

The development and distribution of software in a cloud-based environment is characterised by intricate networks of dependencies involving multiple entities. These entities include cloud service providers, source-code management applications, CI/CD tools, and registries, all playing crucial roles at different stages of the SDLC process. Cloud-based software systems are highly interconnected, comprising numerous layers of components that interact with one another. Consequently, ensuring the security of the software supply chain becomes a formidable challenge.

This complexity introduces a vast attack surface, encompassing various applications, which can potentially result in misconfigurations and vulnerabilities. According to our research, instances of software supply-chain attacks have seen a staggering year-over-year growth rate of over 300%. Gartner predicts that by 2025, 45% of organizations would have experienced a software supply chain attack.

We found that malicious intruders can hijack software packages as attack vectors to disrupt the supply chain. At the same time, package planting enables attackers to disguise malicious payloads as legitimate. Additional recent research demonstrated how registries, which are a key part of the software supply chain in the cloud, can act as first access to expand across the cloud.

Risk Posture Assessment

It is crucial to introduce robust and consistent cloud security protocols, such as identifying and patching vulnerabilities while repairing any misconfigurations. That’s because the development of cloud-first software, while transforming how we do business, has also opened us up to new threat actors and new weak spots.

There are many variations when it comes to the potential impact of these new vulnerabilities. Some enable privilege escalation, some expose data, but attackers often look to vulnerabilities that enable remote code execution because these can allow them to gain access to virtually any server and malicious action they want to trigger. Once malicious forces gain initial access, there are many techniques in their toolbox to evade detection, bypass restrictions, and build persistence.

Our research showed that the top ten vulnerabilities scanned in 2022 (excepting Log4Shell which was overwhelmingly high compared to the rest) were mostly related to the ability to conduct remote code execution. This supports the theory that attackers are looking for initial access to run malicious code on remote systems.

The Importance Of Monitoring Runtime

Defending workloads in a runtime environment (where code executes) is vital to securing the integrity of your business data and applications. It is a tantalising opportunity for bad actors to seize data and cause disruption so we mustn’t leave runtime environments exposed to attack vectors.

Begin by introducing a monitoring protocol which includes scanning for known malicious files and network communications, then blocking them and alerting when they surface. Add monitoring for markers that indicate malicious behaviours, such as unauthorised attempts to access sensitive data, efforts to conceal processes while promoting privileges, and opening back doors to unvalidated IP addresses.

At the end of the day, it is crucial to deploy robust, reliable defence mechanisms from code to cloud to ensure that both data and applications are well protected against malicious attacks.

Key Takeaways

  • Threats are now focusing on avoiding detection to build a stronger presence in compromised systems.
  • Even minor misconfigurations in the software supply chain can open the door to vulnerabilities across the application’s lifecycle.
  •  More threats are targeting the runtime environment, which continues to be attack surface with most immediate blast impact.

Nurit Bielorai is Product Manager at Aqua Security

You Might Also Read: 

Open Source Software In The Cloud:

___________________________________________________________________________________________

If you like this website and use the comprehensive 6,500-plus service supplier Directory, you can get unrestricted access, including the exclusive in-depth Directors Report series, by signing up for a Premium Subscription.

  • Individual £5 per month or £50 per year. Sign Up
  • Multi-User, Corporate & Library Accounts Available on Request

Cyber Security Intelligence: Captured Organised & Accessible


 

« Major Sporting Events Are Open Targets
AI Is The Next Big Thing For Browser Security   »

Infosecurity Europe
CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Infosecurity Europe, 3-5 June 2025, ExCel London

Infosecurity Europe, 3-5 June 2025, ExCel London

This year, Infosecurity Europe marks 30 years of bringing the global cybersecurity community together to further our joint mission of Building a Safer Cyber World.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

TechInsurance

TechInsurance

TechInsurance is America's top technology insurance company offering a range of technology related products including Cyber Liability insurance.

Cyber Security Network

Cyber Security Network

Cyber Security Network provide specialist cyber security recruitment services.

Technology Ireland ICT Skillnet

Technology Ireland ICT Skillnet

Technology Ireland ICT Skillnet is a network of companies who collaborate to address skills needs within the technology sector.

Alpine Security

Alpine Security

Alpine Security provides penetration testing, security assessments and cybersecurity training services.

Citalid

Citalid

The Citalid cyber risk management platform combines threat and business intelligence to identify the risks scenarios you face.

InterGuard

InterGuard

As the pioneer for Unified Insider Threat Prevention and productivity monitoring tools, InterGuard offers on premise and SaaS-based services that are easily available and affordable.

Tapestry Technologies

Tapestry Technologies

Tapestry Technologies supports the Department of Defense in shaping its approach to cybersecurity.

Cognyte

Cognyte

Cognyte is a global leader in investigative analytics software that empowers a variety of government and other organizations with Actionable Intelligence for a Safer World.

Trianz

Trianz

Trianz Cybersecurity Services are Powered by One of the World’s Largest Databases on Digital Transformation. We Understand Evolving Risks, Technologies and Best Practices.

Moss Adams

Moss Adams

Moss Adams is a fully integrated professional services firm dedicated to assisting clients with growing, managing, and protecting prosperity.

Valimail

Valimail

Valimail delivers the only complete, cloud-native platform for validating and authenticating sender identity to stop phishing, protect and amplify brands, and ensure compliance.

Artjoker

Artjoker

Artjoker is a full cycle software development partner specialized in Blockchain projects and smart contract development including full cycle information security of all projects.

Flare Systems

Flare Systems

Flare proactively detects and remediates exposure across the clear & dark web, providing organizations with the equivalent of an automated cyber reconnaissance team.

CyberMaxx

CyberMaxx

At CyberMaxx, our approach to cybersecurity provides end-to-end coverage for our customers – we use offense to fuel defense.

Verastel

Verastel

Specializing in the niche space of proactive cyber-defense, and adaptive resilience, team Verastel is bolstering enterprise digital security like never before.

Ampsight

Ampsight

Ampsight specializes in enabling cloud integration, securing data, and navigating complications that drive critical-mission success.