VORANT. Threat Intelligence Sign in Get the full feed

Cloud infrastructure faces systemic security risks

medium threat technologygovernment-nationalfinancial-servicesenergyhealthcaredefense

Atlantic Council experts warn that cloud computing's centrality to critical infrastructure creates systemic risks, highlighted by Microsoft's 2023 authentication vulnerability exploited by Chinese actors.

In June 2023, Chinese cyber espionage actors exploited a fundamental vulnerability in Microsoft's cloud technology that enabled forging of identity authentication tokens, compromising sensitive email accounts including that of Secretary of Commerce Gina Raimondo. This incident illustrates broader security challenges facing cloud infrastructure, which has become as critical as traditional sectors like energy, water, and financial services. An Atlantic Council report examines how disruptions to major cloud services could have material effects on economic and national security.

Experts convened by the Atlantic Council identified several unresolved security questions, particularly around interdependence and systemic risk. While hyperscale Infrastructure-as-a-Service providers like AWS, Microsoft Azure, and Google Cloud understand many security challenges, experts noted that identity and access management remains problematic even for well-resourced providers. The biggest concerns center on widely-used technologies within and across providers that could create cascading failures, and the lack of transparency that impedes customers' ability to understand and manage risks under the shared responsibility model.

The experts emphasized that policy interventions are needed to address these gaps, including mandatory transparency requirements for security incidents, stricter reporting frameworks similar to FedRamp, and treating major cloud service providers as critical infrastructure requiring government oversight. They stressed that while cloud adoption offers significant benefits, policymakers must balance encouraging adoption with ensuring adequate security governance, potentially treating some providers as systemically important institutions similar to major financial organizations.

Mentioned in this report

Threat actors Chinese cyber espionage actors

Detection guidance

M365 Mail Access via Anomalous or Missing OAuth Application Context

ATT&CK T1550.001

Detects MailItemsAccessed/Send operations in the Unified Audit Log lacking a valid ClientAppId/AppDisplayName, consistent with mail access using a forged or replayed authentication token that bypassed normal OAuth application registration (as seen in the Storm-0558 token forging incident). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: M365 Mail Access via Anomalous or Missing OAuth Application Context
id: 1d0fa1a3-7d7a-5a05-b262-ac1e84fb5cf9
status: experimental
description: Detects Exchange Online mail access events where the client application
  context is missing or anomalous, which can indicate use of a forged or stolen access
  token rather than a legitimate OAuth sign-in flow.
references:
- https://www.atlanticcouncil.org/
logsource:
  category: application
  product: m365
  service: exchange
detection:
  selection:
    Operation:
    - MailItemsAccessed
    - Send
    - SoftDelete
  filter_known_app:
    ClientAppId|exists: true
    AppDisplayName|exists: true
  condition: selection and not filter_known_app
falsepositives:
- Legacy protocol access (POP/IMAP/EWS) by line-of-business applications that do not
  populate AppDisplayName
- Service accounts using older client libraries that omit application identifiers
level: medium
tags:
- attack.t1550.001
- attack.credential-access
- attack.defense-evasion
author: Vorant

Azure AD Sign-In to Exchange Online Without Matching Interactive Token Issuance Event

ATT&CK T1550.001

Detects Exchange Online resource access recorded in mail audit logs that has no corresponding interactive or non-interactive Azure AD sign-in event, suggesting the session was authenticated using a forged access token that never passed through the normal Azure AD sign-in/token-issuance pipeline. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Azure AD Sign-In to Exchange Online Without Matching Interactive Token Issuance
  Event
id: 809e9eb1-ed6b-5d89-b667-05064736585f
status: experimental
description: Flags Exchange Online resource access where the resource sign-in log
  entry indicates a non-interactive token issuance event but no prior interactive
  authentication or MFA challenge is present for that user/session, consistent with
  forged token abuse (e.g. Storm-0558 signing key compromise).
references:
- https://www.atlanticcouncil.org/
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResourceDisplayName|contains: Office 365 Exchange Online
    SignInEventTypes: nonInteractive
  filter:
    AuthenticationRequirement: multiFactorAuthentication
    ConditionalAccessStatus: success
  condition: selection and not filter
falsepositives:
- Legitimate refresh-token based silent sign-ins following a recent valid MFA session
- Background sync clients (mobile mail apps) using cached refresh tokens
level: medium
tags:
- attack.t1550.001
- attack.defense-evasion
author: Vorant

Cloud Account Sign-In with High-Privilege Mailbox Access from Unfamiliar Location or Device

ATT&CK T1078.004

Detects successful cloud identity sign-ins flagged with unfamiliar sign-in properties (new location, new device, atypical travel) immediately followed by access to sensitive/executive mailboxes, indicating possible use of a compromised or improperly authenticated cloud account. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Cloud Account Sign-In with High-Privilege Mailbox Access from Unfamiliar Location
  or Device
id: e917a37b-ce5b-585c-b4e0-0c57a2a3c6d0
status: experimental
description: Detects Azure AD/M365 sign-ins marked with risk indicators such as unfamiliar
  sign-in properties or atypical travel, where the account subsequently accesses executive
  or highly privileged mailboxes, suggesting abuse of valid cloud credentials or tokens.
references:
- https://www.atlanticcouncil.org/
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: 0
    RiskState: atRisk
    RiskDetail:
    - unfamiliarFeatures
    - anomalousToken
  filter:
    ConditionalAccessStatus: success
    AuthenticationRequirement: multiFactorAuthentication
  condition: selection and not filter
falsepositives:
- Executives or admins traveling internationally and signing in from new devices without
  completing MFA re-registration
- VPN or proxy usage causing atypical geolocation flags
level: medium
tags:
- attack.t1078.004
- attack.initial-access
- attack.persistence
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/content-series/the-5x5/the-5x5-cloud-risks-and-critical-infrastructure

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free