Unit 42: Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration

Mar 27, 2025

—

Source URL: https://unit42.paloaltonetworks.com/2025-cloud-security-alert-trends/
Source: Unit 42
Title: Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration

Feedly Summary: Understanding trends amidst noise: tracking shifts in security alerts allows cloud defenders to parse threats from attackers targeting IAM, storage and more.
The post Cloud Threats on the Rise: Alert Trends Show Intensified Attacker Focus on IAM, Exfiltration appeared first on Unit 42.

AI Summary and Description: Yes

Summary: The text discusses significant increases in cloud-targeted security alerts, particularly highlighting alarming trends in high-severity incidents involving identity and access management (IAM) tokens and serverless functions. The data suggests a growing focus from attackers on cloud environments, necessitating improved defensive measures, including the deployment of advanced runtime cloud security tools.

Detailed Description:

The provided text outlines critical findings concerning escalating cyber threats faced by organizations that utilize cloud infrastructure. The analysis reveals that attacks against cloud environments are intensifying, as demonstrated by a dramatic increase in security alerts. Below are the core insights and implications:

– **Surge in Cloud Alerts**: Organizations reported a 388% increase in average daily cloud-based alerts during 2024, particularly high-severity alerts that increased by 235%. This reflects a growing offensive against cloud resources by threat actors.

– **Critical Cloud Resources at Risk**:
– **Identity and Access Management (IAM)**: Leaked IAM credentials are a prime target. Attackers exploit these to gain unauthorized access and execute further attacks.
– **Storage**: Cloud storage often contains sensitive data, making it an attractive target for malicious actors.
– **Virtual Machines and Containers**: These elements are frequently connected to other internal services, presenting opportunities for lateral movement post-compromise.

– **Specific Alert Trends**:
– 116% increase in “impossible travel event” alerts, indicating simultaneous logins from distant locations.
– 60% increase in IAM API requests from outside established regions, raising flags about account compromise.
– 305% increase in suspicious downloads of multiple cloud storage objects potentially signaling exfiltration attempts.

– **Importance of Runtime Monitoring**: The text emphasizes the necessity of deploying Cloud Detection and Response (CDR) tools in addition to traditional Cloud Security Posture Management (CSPM) tools. Only runtime monitoring can effectively detect and prevent ongoing malicious activities.

– **Strategic Recommendations for Organizations**:
– Implement effective CDR monitoring across all cloud environments.
– Restrict IAM service accounts’ operational scope according to the principle of least privilege.
– Ensure that all cloud storage security measures, such as versioning and encryption, are activated to protect sensitive data from being compromised.

– **The Need for Enhanced Cloud Security Frameworks**: The analysis advocates for integrating traditional posture management with runtime security measures to withstand evolving cyber threats effectively.

This comprehensive examination of cloud security alert trends and defense suggestions offers critical insights for professionals in security, privacy, and compliance sectors, underscoring the imperative of adaptive security measures in the face of growing threats.

1 2 2024 2025 24 3 4 5 a access access management account account compromise Act adaptive adaptive security ads AI alerts alt analysis and API app ARM art as attack attackers attacks average based being by C CERN Cloud Cloud Detection and Response cloud environment cloud environments cloud infrastructure cloud resources cloud security cloud security framework Cloud Security Posture Management cloud storage cloud threats cloud-based co compliance compromised container containers core credential credentials critical cross cyber cyber threat cyber threats D data de Defender defense defensive measures demo deployment detection e effective encryption end environment event exfiltration exp exploit face first for framework frameworks function g Go gs H high Highlight HR http HTTPS IAM identity Identity and Access Management identity and access management (IAM) implications in incident infrastructure insights inter intern Iron IRS J k l lateral movement least Least Priv least privilege led Li low mac machine making malicious activities malicious actors man management Monitor monitoring multi N nation network networks no o of off on one only operation organization organizations out post posture management potential pre Principle of Least Privilege privacy professionals Q R rack rag raising Rama rate RCE recommendations red Region Regions report resource resources response Risk Ro RoT runtime monitoring runtime security s sec sector security security framework security frameworks security measure security measures security posture security posture management security tool security tools sensitive data server serverless serverless functions service service account Service Accounts services severity shift side Sig Signal Sim source specific SSE storage strategic strategic recommendations T targeted text the threat threat actor threat actors threats Time time monitoring to token tokens tool tools Tor TP tracking trends two unauthorized access under Unit 42 US uth V version versioning virtual virtual machine virtual machines Wi x