VORANT. Threat Intelligence Sign in Get the full feed

Atlantic Council evaluates cloud computing trust policy

routine threat government-nationaldefensefinancial-servicestechnologyhealthcareinfrastructureenergyeducation

Policy paper analyzes frameworks for establishing trust in cloud infrastructure critical to AI, government, and commercial operations, emphasizing technical security over geographic restrictions.

The Atlantic Council report addresses the policy challenge of establishing verifiable trust in cloud computing systems as they become essential to AI development, critical infrastructure, and government operations. Rather than focusing on entity-based restrictions like data localization or geographic limitations on cloud providers, the paper advocates for technical security criteria and continuous verification frameworks.

The report documents real-world threat activity against cloud infrastructure: vulnerabilities are now exploited within 5 days of disclosure (down from 32 days in 2023), exposed credentials on GitHub are weaponized within minutes, and sophisticated nation-state actors target cloud providers themselves to steal credentials and source code. The paper discusses emerging trust models including zero-trust architecture and cryptographic verification (Trusted Execution Environments, confidential computing) as alternatives to static policy measures.

Key concern: the growing interdependence between hyperscale cloud providers (AWS, Azure, Google Cloud), emerging AI-focused cloud operators (CoreWeave, Lambda, Crusoe), and chipmakers (NVIDIA) creates a fragile ecosystem where poorly designed policies could compromise both cloud security and AI development. The report argues that policymakers must understand technical cloud architectures—workload distribution, edge locations, network infrastructure—to craft effective security policy rather than rely on simplified national-origin criteria.

Mentioned in this report

Threat actors China-nexus activity (unattributed)Iran-nexus activity (unattributed)North Korea-nexus activity (unattributed)Russia-nexus activity (unattributed)

Detection guidance

Credential Harvesting from Public Repositories

ATT&CK T1087

Detection of automated scanning or enumeration of public code repositories (GitHub, GitLab) for exposed credentials or API keys, typical of cloud infrastructure reconnaissance. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Credential Harvesting from Public Repositories
description: Detects process execution indicative of automated credential or API key
  enumeration against public code repositories. Focuses on command-line patterns and
  tool invocation characteristic of reconnaissance targeting exposed secrets in Git
  repositories.
tags:
- attack.reconnaissance
- attack.t1087
logsource:
  category: process_creation
  product: windows
detection:
  selection_git_enum:
    CommandLine|contains:
    - github.com
    - gitlab.com
    - bitbucket.org
  selection_tools:
    Image|endswith:
    - \curl.exe
    - \wget.exe
    - \python.exe
    - \git.exe
  selection_keywords:
    CommandLine|contains:
    - api_key
    - access_token
    - secret
    - credential
  filter_developer:
    ParentImage|endswith:
    - \Code.exe
    - \git.exe
    - \devenv.exe
  condition: (selection_git_enum or selection_tools) and selection_keywords and not
    filter_developer
falsepositives:
- Legitimate developer workflows cloning or pulling from repositories
- CI/CD pipeline credential management during standard deployments
- Security scanning tools performing authorized vulnerability assessments
level: medium
id: 8abf3bd1-a1ad-53e4-92a5-bf7d019c7994
status: experimental
author: Vorant

Cloud Provider Credential Compromise via Brute Force

ATT&CK T1110

Detection of repeated failed authentication attempts against cloud provider APIs or dashboards (AWS, Azure, GCP) indicative of credential brute-force attacks. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Cloud Provider Credential Compromise via Brute Force
description: Detects network-level indicators of brute-force authentication attacks
  against major cloud provider login endpoints. Identifies repetitive failed authentication
  attempts within a short timeframe targeting cloud identity services.
tags:
- attack.credential-access
- attack.t1110
logsource:
  category: network_connection
  product: windows
detection:
  selection_aws:
    DestinationHostname|contains:
    - signin.aws.amazon.com
    - sts.amazonaws.com
    DestinationPort: 443
  selection_azure:
    DestinationHostname|contains:
    - login.microsoftonline.com
    - login.windows.net
    DestinationPort: 443
  selection_gcp:
    DestinationHostname|contains:
    - accounts.google.com
    - oauth2.googleapis.com
    DestinationPort: 443
  condition: selection_aws or selection_azure or selection_gcp
falsepositives:
- Legitimate user login retries during credential entry mistakes
- Automated cloud management tools re-authenticating after token expiration
level: medium
id: 4c5bb0e7-3263-5333-b672-bcc4c07a3381
status: experimental
author: Vorant

Exploitation of Unpatched Cloud Provider Vulnerabilities

ATT&CK T1190

Detection of HTTP requests targeting known public-facing cloud service vulnerabilities shortly after disclosure, exploiting the critical 5-day window before patches are deployed. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Exploitation of Unpatched Cloud Provider Vulnerabilities
description: Identifies network traffic patterns consistent with exploitation of recently
  disclosed vulnerabilities in cloud provider management consoles or APIs. Detects
  suspicious HTTP requests with exploit payloads or CVE-associated patterns targeting
  cloud infrastructure endpoints.
tags:
- attack.initial-access
- attack.t1190
logsource:
  category: proxy
  product: windows
detection:
  selection_cloud_endpoints:
    DestinationHostname|contains:
    - .amazonaws.com
    - .azure.com
    - .gstatic.com
    - .appspot.com
  selection_exploit_patterns:
    RequestUri|contains:
    - ../
    - ..%2f
    - .env
    - metadata
    - admin
    - api/v
  selection_suspicious_methods:
    RequestMethod:
    - TRACE
    - CONNECT
    - OPTIONS
  condition: selection_cloud_endpoints and (selection_exploit_patterns or selection_suspicious_methods)
falsepositives:
- Legitimate path traversal in API versioning (api/v1, api/v2)
- Security scanning and authorized penetration testing
- Legitimate OPTIONS requests for CORS preflight checks
level: high
id: 72b4dad6-f201-5946-a919-10532dfc96ef
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.atlanticcouncil.org/in-depth-research-reports/issue-brief/cloudbusting-policy-for-evaluating-trust-in-compute-infrastructure

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free