Google Finds Cloud Attacks Increasingly Exploit Software Flaws Over Weak Credentials
Summary
Google’s analysis found exploits were the primary initial access vector in 44.5% of investigated cloud intrusions, versus credentials at 27%. It also describes faster exploitation, persistent espionage, supply-chain abuse and rising insider use of cloud services for exfi
Key points
- Google says software exploits were the primary initial access vector in 44.5% of investigated intrusions in the second half of 2025, compared with credentials at 27%.
- Remote code execution flaws including React2Shell (CVE-2025-55182) and the XWiki flaw (CVE-2025-24893) were exploited, including in RondoDox botnet activity.
- Google observed cryptominers deployed within 48 hours of vulnerability disclosure and some payloads appearing within an hour of a new cloud instance’s creation.
- Google describes espionage cases involving UNC1549, which reportedly maintained access for more than two years and stole nearly a terabyte of data, and UNC5221, which reportedly accessed VMware vCenter servers and stole source code.
- Google attributes a cryptocurrency theft of several million dollars to UNC4899, which allegedly used a malicious archive to gain a workstation foothold and then move into a cloud environment.
- A compromised npm package called QuietVault reportedly enabled abuse of GitHub-to-AWS OpenID Connect and CI/CD access; the article links the incident to the s1ngularity supply-chain attack.
- Google’s analysis of 1,002 insider data-theft incidents found growing use of cloud services for exfiltration; it says faster attacks make automated incident response increasingly important.
Article Details
- Publisher
- Report Period
- Second half of 2025
- Scope
- Cloud intrusions and insider data theft, including exploitation trends, persistence, supply-chain attacks, and data exfiltration.
- Sample Size
- 1,002 insider data-theft incidents; the number of investigated cloud intrusions is not disclosed.
- Key Statistics
- Bug exploits were the primary access vector in 44.5% of investigated intrusions; credentials accounted for 27%.
- Google attributed 3% of intrusions analyzed in the second half of 2025 to North Korean IT workers tracked as UNC5267.
- Cryptominers were observed within 48 hours of vulnerability disclosure; some payloads appeared within one hour of a new instance being created.
- The QuietVault-related incident exposed information from 2,180 accounts and 7,200 repositories.
- In the analysis of 1,002 insider data-theft incidents, 771 occurred while the insider was employed and 255 after employment ended.
- Recommendations
- Implement automated incident response because attack and payload-deployment speeds can exceed manual response capabilities.
- Implement data-protection mechanisms against both internal and external threats.
MITRE ATT&CK
T1070.004 · File DeletionThe report says attackers deleted backups, log files, and forensic artifacts to hinder recovery and evidence collection.T1078 · Valid AccountsAttackers used compromised identities, including stolen VPN credentials, to access cloud environments.T1098 · Account ManipulationIn the QuietVault incident, the attacker used a GitHub token and an OpenID Connect trust to create a new cloud admin account.T1195.002 · Compromise Software Supply ChainThe report describes compromised npm packages as part of the s1ngularity supply-chain attack.T1566.001 · Spearphishing AttachmentThe report says attackers used phishing to obtain access to target organizations' cloud platforms.T1566.004 · Spearphishing VoiceThe report says attackers used vishing while impersonating IT help desk staff to obtain access.T1567.002 · Exfiltration to Cloud StorageThe report describes insiders using cloud services to exfiltrate data.T1611 · Escape to HostIn the UNC4899 incident, the attackers broke out of a container after compromising a pod enforcing network policies.
CVE
CVE-2025-24893xwiki · xwiki-platformRemote code execution flaws like React2Shell (CVE-2025-55182) and the XWiki bug (CVE-2025-24893) were widely exploited, including in RondoDox botnet activity.CVE-2025-55182Meta · react-server-dom-parcel; Meta · react-server-dom-turbopack; +1 moreRemote code execution flaws like React2Shell (CVE-2025-55182) and the XWiki bug (CVE-2025-24893) were widely exploited, including in RondoDox botnet activity.
Threat Actors
ARMORY CASTLEGoogle describes UNC5221 as China-sponsored and reports that it used BrickStorm to maintain access to a victim's VMware vCenter servers for at least 18 months and steal source code.Jade SleetGoogle reports that UNC4899 compromised cloud environments to steal digital assets; in one case it allegedly used social engineering and a malicious binary to gain access and steal several million dollars in cryptocurrency.UNC1549Google reports that Iran-linked UNC1549 used stolen VPN credentials to maintain access to a target environment for more than two years and steal nearly one terabyte of proprietary data.UNC5267Google attributes some intrusions to North Korean IT workers tracked as UNC5267, who allegedly used fraudulent identities to obtain jobs and generate revenue for the government.
Malware
BRICKSTORMIn another example, the China-sponsored actor UNC5221 used the BrickStorm malware to keep access to a victim’s VMware vCenter servers for at least 18 months and steal source code.MinibikeFor more than two years, Iran-linked threat actor UNC1549 had access to a target environment using stolen VPN credentials and the MiniBike malware.RondoDoxRemote code execution flaws like React2Shell (CVE-2025-55182) and the XWiki bug (CVE-2025-24893) were widely exploited, including in RondoDox botnet activity.
Vendors
Amazon Web Servicesprimarily used for data exfiltration, the researchers noticed that insiders are increasingly using Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Google Drive, Apple iCloud, Dropbox, and Microsoft OneDrive.Appleinsiders are increasingly using Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Google Drive, Apple iCloud, Dropbox, and Microsoft OneDrive.Dropboxincreasingly using Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Google Drive, Apple iCloud, Dropbox, and Microsoft OneDrive.GoogleAt the same time, the use of weak credentials or misconfigurations has dropped significantly in the second half of 2025, Google notes in a report highlighting the trends on threats to cloud users.Microsoftthe researchers noticed that insiders are increasingly using Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Google Drive, Apple iCloud, Dropbox, and Microsoft OneDrive.
Products
Apple iCloudare increasingly using Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Google Drive, Apple iCloud, Dropbox, and Microsoft OneDrive.AWSGitHub token and used it to create a new admin account in the cloud environment by abusing the GitHub-to-AWS OpenID Connect (OIDC) trust.GitHubIn an attack leveraging a compromised npm package name called QuietVault, the attacker stole a developer’s GitHub token and used it to create a new admin account in the cloud environment by abusing the GitHub-to-AWSGoogle Cloudexfiltration, the researchers noticed that insiders are increasingly using Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Google Drive, Apple iCloud, Dropbox, and Microsoft OneDrive.Google Drivenoticed that insiders are increasingly using Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Google Drive, Apple iCloud, Dropbox, and Microsoft OneDrive.KubernetesInside the archive was malicious Python code that deployed a binary posing as a Kubernetes command-line tool.Microsoft Azureresearchers noticed that insiders are increasingly using Amazon Web Services (AWS), Google Cloud, Microsoft Azure, Google Drive, Apple iCloud, Dropbox, and Microsoft OneDrive.Microsoft OneDriveAmazon Web Services (AWS), Google Cloud, Microsoft Azure, Google Drive, Apple iCloud, Dropbox, and Microsoft OneDrive.npmIn an attack leveraging a compromised npm package name called QuietVault, the attacker stole a developer’s GitHub token and used it to create a new admin account in the cloud environment by abusing the GitHub-to-AWSNxThe incident was part of the “s1ngularity” supply-chain attack in August 2025, when an attacker published compromised npm packages of the Nx open-source build system and monorepo management tool.S3interface tools, abused the CI/CD pipeline to get the organization’s AWS API keys, stole data from the S3 storage, and then destroyed it in production and cloud environments.VMware vCenterIn another example, the China-sponsored actor UNC5221 used the BrickStorm malware to keep access to a victim’s VMware vCenter servers for at least 18 months and steal source code.
Countries
ChinaGoogle highlights some espionage campaigns from actors linked to Iran and China, who maintained access to the victim environment well over a year and a half.IranGoogle highlights some espionage campaigns from actors linked to Iran and China, who maintained access to the victim environment well over a year and a half.