Google Cloud Report Highlights Software Exploitation and Identity-Led Cloud Threats
Summary
Google Cloud’s H1 2026 Threat Horizons report says identity issues featured in 83% of H2 2025 cloud/SaaS incidents and data was targeted in 73%, while software exploitation overtook weak credentials; it details insider risks, intrusion cases and response guidance.
Key points
- In Google Cloud observations, third-party software-based entry accounted for 44.5% of initial-access cases in H2 2025, up from 2.9% in H1; exploitation timelines narrowed from weeks to days.
- Mandiant Incident Response and Threat Defense engagements found identity issues in 83% of H2 2025 cloud and SaaS incidents; data was targeted in 73%.
- An analysis of 1,002 malicious-insider cases drawn from public U.S. legal documents found data exfiltration in 909 cases; the report identifies cloud services as a rapidly growing exfiltration channel.
- Google assesses with moderate confidence that North Korean actor UNC4899 targeted a cryptocurrency organization using social engineering, a trojanized Python application, and Kubernetes access; the incident resulted in theft of several million dollars.
- Mandiant’s UNC6426 case involved the QUIETVAULT credential stealer in a compromised Nx NPM package and abuse of GitHub-to-AWS OpenID Connect trust to obtain administrator access; the victim detected and contained the activity.
- The report recommends controls including phishing-resistant MFA, tighter OAuth and CI/CD permissions, container hardening, monitoring for bulk data movement, and tamper-resistant logging.
- In a Google case study involving a Ray.io test instance, an automated forensic pipeline reduced investigation and containment from days to under 60 minutes.
Article Details
- Publisher
- Report Period
- H1 2026 report; principal intrusion observations cover H2 2025
- Scope
- Cloud and SaaS threats across providers, including initial access, data theft, insider threats, incident response and forensic readiness.
- Sample Size
- Not disclosed for the cloud intrusion analysis; a separate insider-threat study analyzed 1,002 cases.
- Key Statistics
- Software-based entry accounted for 44.5% of observed Google Cloud initial access incidents in H2 2025, up from 2.9% in H1.
- Identity issues were involved in initial access in 83% of H2 2025 Mandiant IR and MTD incidents involving major cloud and SaaS environments.
- Data was targeted in 73% of cloud-related incidents in the H2 2025 Mandiant analysis.
- In the separate insider-threat study, data exfiltration occurred in 909 of 1,002 cases; 35% of exfiltration cases involved multiple pathways.
- Google observed XMRig deployments approximately 48 hours after public disclosure of CVE-2025-55182.
- Recommendations
- Use phishing-resistant MFA, enforce least privilege, and restrict and audit OAuth and third-party integration scopes.
- Automate vulnerability scanning and target mitigation within 24 hours and full patching within 72 hours.
- Monitor bulk API activity and unusual data movement, and audit data-sharing permissions.
- Restrict privileged containers and unmanaged peer-to-peer transfers; replace static container credentials with ephemeral or identity-based access.
- Preserve logs and automate evidence collection, require additional approval for sensitive administrative actions, and maintain frequent backups.
MITRE ATT&CK
T1098 · Account ManipulationUNC6426 created a cloud administrator role through an overly permissive deployment role.T1195.002 · Compromise Software Supply ChainCompromised NPM packages delivered credential-stealing code to developer endpoints.T1485 · Data DestructionUNC6426 terminated production cloud instances during the intrusion.T1496 · Resource HijackingThreat actors deployed cryptocurrency miners after exploiting software vulnerabilities.T1528 · Steal Application Access TokenUNC6395 used compromised OAuth tokens to access Salesforce tenants and exfiltrate data.T1552.001 · Credentials In FilesUNC4899 extracted database credentials stored in a pod's environment variables.T1566.004 · Spearphishing VoiceNamed groups used voice-based social engineering to obtain access or induce authorization of tools.T1611 · Escape to HostUNC4899 abused a privileged pod and cluster privileges to reach node-level services.
CVE
CVE-2020-0688Microsoft · Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 30; Microsoft · Microsoft Exchange Server 2013; +4 moreone case where an Iranian espionage cluster leveraged an unpatched Microsoft Exchange vulnerability (CVE-2020-0688) for illicit initial access before pivoting to the victim’s environment.CVE-2025-24893xwiki · xwiki-platformreferred to as React2Shell) and a critical platform evaluation injection vulnerability in XWiki (CVE-2025-24893) to gain initial access.CVE-2025-55182Meta · react-server-dom-parcel; Meta · react-server-dom-turbopack; +1 morevulnerabilities, such as a critical remote code execution (RCE) in React Server Components (CVE-2025-55182, commonly referred to as React2Shell) and a critical platform evaluation injection vulnerability in
Threat Actors
Akira RaaSA cited joint advisory reported that the group targeted cloud backups and disabled forensic and security tools.ARMORY CASTLEA cluster linked to this China-sponsored actor reportedly deployed BRICKSTORM to harvest source code.DPRK IT WorkersThe report identifies this activity as UNC5267 and says it involved fraudulent employment using stolen identities.Jade SleetGTIG assessed with moderate confidence that this North Korean group compromised a cryptocurrency organization in 2025 and stole several million dollars.QilinIndustry reporting cited in the report said its affiliates targeted backup infrastructure and deleted backups before encryption.STORM-0501According to industry reporting cited in the report, it deleted Azure data and backups while exfiltrating data.UNC1549The report describes an Iran-linked campaign associated with UNC1549 that used stolen VPN credentials and MINIBIKE to exfiltrate data.UNC3944Reportedly impersonated employees to induce help desk credential and MFA resets and exfiltrated data for extortion.UNC5267Tracked as DPRK IT Workers; reportedly used stolen identities to obtain fraudulent employment and generate revenue for the North Korean regime.UNC5356Reportedly used vishing to access SaaS platforms and search mailboxes for sensitive account information.UNC6040Reportedly used vishing to induce authorization of legitimate tools for bulk data collection and extortion.UNC6345Reportedly used employee rewards-themed phishing lures to harvest credentials and conduct MFA fatigue attacks.UNC6361Reportedly used stolen identities and deployed REDBIKE ransomware.UNC6395Reportedly used compromised Salesloft Drift OAuth tokens to discover and exfiltrate Salesforce tenant data.UNC6426Mandiant observed this cluster abuse CI/CD-to-cloud trust to gain AWS administrator access, exfiltrate data and disrupt production resources.UNC6566Mandiant attributed an intrusion involving compromised NPM packages and credential harvesting to this cluster.
Malware
BRICKSTORMSimilarly, a threat cluster with links to the China-sponsored actor UNC5221 deployed the BRICKSTORM backdoor on VMware vCenter servers to harvest source code, remaining undetected for at least 18 months.Minibikewho maintained access to a victim environment for over two years using stolen VPN credentials and the MINIBIKE backdoor to exfiltrate nearly a terabyte of proprietary data.QUIETVAULTThe attack began with a compromised Node Package Manager (NPM) package (QUIETVAULT) that stole a developer’s GitHub token.REDBIKE3% of the incidents involved ransomware, which included threat activity attributed to actors such as UNC6361, which deployed REDBIKE ransomware.
Vendors
Products
AWShuman and non-human identities for initial access. For example, an uncategorized threat cluster used AWS access keys—suspected to have been first exposed during a 2022 security incident involving a passwordGitHubwe attributed to UNC6566 where victims installed compromised NPM packages that eventually deployed GitHub Action workflow and GitHub Runner for novel persistence, and TRUFFLEHOG, among other stealing mechanisms,Google CloudThe Google Cloud Threat Horizons Report provides decision-makers with strategic intelligence on threats to not just Google Cloud, but all cloud service providers. The report focuses on recommendations for mitigatingGoogle Kubernetes EngineThis exploitation of applications on Google Cloud Engine and Google Kubernetes Engine primarily targeted known CVEs, suggesting that threat actors are increasingly opting for faster, more automated paths ofKubernetes- [North Korean Actors Weaponize Kubernetes Workloads for Multimillion-Dollar Cryptocurrency Theft](#north-korean-actors-weaponize-kubernetes-workloads-for-multimillion-dollar-cryptocurrency-theft)Microsoft Exchangeexploitation, including one case where an Iranian espionage cluster leveraged an unpatched Microsoft Exchange vulnerability (CVE-2020-0688) for illicit initial access before pivoting to the victim’sNx#### Phase 1 - Supply Chain Infection (The Nx Compromise)Salesforcevishing to impersonate IT helpdesk staff, deceiving targets into authorizing legitimate tools (e.g., Salesforce Data Loader) to facilitate widespread data collection and exfiltration.XWikicommonly referred to as React2Shell) and a critical platform evaluation injection vulnerability in XWiki (CVE-2025-24893) to gain initial access.
Tools
dfTimewolftools like dfTimewolf and OpenRelik / TurbiniaNORDSTREAMUNC6426 began reconnaissance activities within the client’s GitHub environment using a tool called NORDSTREAM, which is designed to extract secrets from CI/CD environments by deploying malicious pipelines.OpenReliktools like dfTimewolf and OpenRelik / TurbiniaRCloneOther actors employed living-off-the-land (LOTL) tactics such as using the native Windows BitLocker tool to encrypt environments after exfiltrating data via RCLONE.TruffleHogpackages that eventually deployed GitHub Action workflow and GitHub Runner for novel persistence, and TRUFFLEHOG, among other stealing mechanisms, to harvest credentials.Turbiniatools like dfTimewolf and OpenRelik / TurbiniaXMRigFor example, we observed multiple incidents of threat actors deploying XMRig cryptocurrency miners within approximately 48 hours of CVE-2025-55182’s public disclosure.
Countries
ChinaSimilarly, a threat cluster with links to the China-sponsored actor UNC5221 deployed the BRICKSTORM backdoor on VMware vCenter servers to harvest source code, remaining undetected for at least 18 months.IranDPRK Espionage campaigns remained persistent in this period, including one associated with Iran-linked UNC1549, who maintained access to a victim environment for over two years using stolen VPN credentials and theNorth KoreaCryptocurrency theft made up the remaining 2%, with actors such as North Korea-linked UNC4899 compromising environments specifically to steal digital assets.