Published on: 2026-03-10

AI-powered OSINT brief from verified open sources. Automated NLP signal extraction with human verification. See our Methodology and Why WorldWideWatchers.

Intelligence Report: Cloud Attackers Now Prefer Vulnerability Exploits Over Credentials Google Cloud Finds

1. BLUF (Bottom Line Up Front)

Threat actors targeting cloud environments have shifted their focus from credential-based attacks to exploiting software vulnerabilities, significantly increasing the risk to cloud services. This change, observed in the second half of 2025, affects organizations using cloud services, particularly those with unpatched software. The overall confidence level in this assessment is moderate due to potential information gaps and the evolving nature of cyber threats.

2. Competing Hypotheses

• Hypothesis A: The shift towards exploiting vulnerabilities is primarily driven by the increasing difficulty in obtaining credentials due to improved security measures. Supporting evidence includes the decrease in credential-based attacks and the rapid exploitation of vulnerabilities like React2Shell. However, uncertainties include the potential for simultaneous use of both methods by threat actors.
• Hypothesis B: The preference for vulnerability exploits is a strategic move by nation-state actors to leverage more impactful and scalable attack vectors. This is supported by the involvement of actors linked to North Korea and China. Contradicting evidence includes the possibility that non-state actors are also adopting this method due to its effectiveness.
• Assessment: Hypothesis B is currently better supported due to the involvement of sophisticated nation-state actors and the strategic advantages of exploiting vulnerabilities. Indicators that could shift this judgment include evidence of increased credential theft or new defensive measures reducing vulnerability exploitation.

3. Key Assumptions and Red Flags

• Assumptions: Organizations are not patching vulnerabilities promptly; nation-state actors have the capability to exploit vulnerabilities quickly; cloud service providers are maintaining secure underlying infrastructures.
• Information Gaps: Detailed data on the specific vulnerabilities exploited and the full scope of affected organizations; the role of non-state actors in these attacks.
• Bias & Deception Risks: Potential bias in attributing attacks solely to nation-state actors; risk of deception in threat actor tactics to obscure true methods or origins.

4. Implications and Strategic Risks

The shift towards exploiting vulnerabilities could lead to increased cyber risks and necessitate changes in defensive strategies. This development may influence broader geopolitical dynamics and cyber defense postures.

• Political / Geopolitical: Potential escalation in cyber conflict between nation-states, particularly involving China and North Korea.
• Security / Counter-Terrorism: Increased complexity in threat detection and response, requiring enhanced cybersecurity measures.
• Cyber / Information Space: Accelerated arms race in cyber capabilities, with a focus on rapid vulnerability exploitation.
• Economic / Social: Potential economic impacts due to disrupted cloud services and increased costs for cybersecurity measures.

5. Recommendations and Outlook

• Immediate Actions (0–30 days): Implement rapid patch management processes, enhance monitoring for vulnerability exploitation, and review firewall rules.
• Medium-Term Posture (1–12 months): Develop partnerships for threat intelligence sharing, invest in automated security tools, and conduct regular security audits.
• Scenario Outlook:
  • Best: Improved defenses reduce vulnerability exploitation; threat actors revert to less effective methods.
  • Worst: Widespread exploitation leads to significant data breaches and economic disruption.
  • Most-Likely: Continued evolution of attack methods with periodic spikes in vulnerability exploitation.

6. Key Individuals and Entities

• Crystal Lister, security advisor and head of cloud threat horizons report program, Google Cloud
• Google Cloud Office of the CISO
• Nation-state actors linked to North Korea and China

7. Thematic Tags

cybersecurity, cloud computing, vulnerability exploitation, nation-state actors, cyber defense, threat intelligence, software vulnerabilities

Structured Analytic Techniques Applied

• Adversarial Threat Simulation: Model and simulate actions of cyber adversaries to anticipate vulnerabilities and improve resilience.
• Indicators Development: Detect and monitor behavioral or technical anomalies across systems for early threat detection.
• Bayesian Scenario Modeling: Quantify uncertainty and predict cyberattack pathways using probabilistic inference.
• Network Influence Mapping: Map influence relationships to assess actor impact.

Explore more:
Cybersecurity Briefs ·
Daily Summary ·
Support us