{"id":13333,"date":"2026-06-03T10:04:10","date_gmt":"2026-06-03T10:04:10","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/03\/attackers-abuse-aws-google-cloud-cloudflare-and-microsoft-services-to-hide-malicious-traffic\/"},"modified":"2026-06-03T10:04:10","modified_gmt":"2026-06-03T10:04:10","slug":"attackers-abuse-aws-google-cloud-cloudflare-and-microsoft-services-to-hide-malicious-traffic","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/03\/attackers-abuse-aws-google-cloud-cloudflare-and-microsoft-services-to-hide-malicious-traffic\/","title":{"rendered":"Attackers Abuse AWS, Google Cloud, Cloudflare, and Microsoft Services to Hide Malicious Traffic"},"content":{"rendered":"

Attackers Abuse AWS, Google Cloud, Cloudflare, and Microsoft Services to Hide Malicious Traffic
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

Cybercriminals are increasingly weaponizing trusted cloud infrastructure, including Amazon Web Services, Google Cloud, Microsoft Azure, Cloudflare, and GitHub, to camouflage malicious traffic, evade detection, and sustain long-lived Command and Control (C2) operations.<\/p>\n

A recent threat intelligence investigation using ANY.RUN\u2019s Threat Intelligence (TI) Lookup<\/a> reveals just how deeply this abuse has become embedded in modern attack chains.<\/p>\n

The investigation by Threat Researcher Clandestine, spanning five targeted OSINT queries across ANY.RUN\u2019s dynamic threat intelligence database, which indexes over 50 million IOCs, IOBs, and IOAs derived from real-time sandbox analyses conducted by over 500,000 analysts globally, exposes a recurring pattern: legitimate services are being turned into shields for adversarial activity.<\/p>\n

Accelerate\u00a0security\u00a0workflows for faster triage & response.\u00a0Integrate Threat Intelligence in your SOC or MSSP<\/u><\/a>.<\/strong><\/p>\n

\n
\"\"
Remote Access Trojan\u2019s attack chain and TTPs mapped in a Sandbox analysis<\/em>\u00a0<\/figcaption><\/figure>\n<\/div>\n

Cobalt Strike Hides Behind Trusted Cloud Providers<\/strong><\/h2>\n

One of the most alarming findings emerged from a JA3S TLS fingerprint query targeting the hash 1af33e1657631357c73119488045302c<\/code>, a signature commonly associated with Cobalt Strike beacons.<\/p>\n

\"\"
Search by a single connection parameter reveals a malicious pattern<\/em>\u00a0<\/figcaption><\/figure>\n

Analysts querying this hash in TI Lookup uncovered more than 1,000 system events, predominantly involving native Windows processes such as slui.exe<\/code>, svchost.exe<\/code>, and PowerShell classic Living-off-the-Land Binary (LOLBin) abuse. Nearly all communication was routed over port 443 (HTTPS), exploiting the protocol\u2019s ubiquity to blend into normal enterprise traffic.<\/p>\n

More critically, the C2 infrastructure tied to this JA3S fingerprint was found hosted across Microsoft, GitHub, Google, Amazon, and Cloudflare. This deliberate use of reputable platforms makes traditional reputation-based blocking ineffective.<\/p>\n

JA3S fingerprinting provides a behavioral anchor that persists even as adversaries rotate domains and IP addresses, a powerful technique for tracking C2 infrastructure continuity.<\/p>\n

Detection of this JA3S hash in network telemetry should be treated as a strong indicator of Cobalt Strike infection, immediately triggering endpoint correlation and incident response workflows.<\/p>\n

The investigation also uncovered active phishing campaigns targeting Brazilian organizations, where attackers are leveraging subdomains of globally recognized services alongside malicious domains.<\/p>\n

The use of globally hosted infrastructure serves a dual purpose: it lends the attacks a veneer of legitimacy and actively hinders domain takedowns. Security teams in Brazil and similar regions should be especially alert to emails containing links hosted on subdomains of popular cloud services.<\/p>\n

\"\"
Network infrastructure related to phishing attacks on Brazilian users<\/em>\u00a0<\/figcaption><\/figure>\n

Compound this with the discovery of Business Email Compromise (BEC) campaigns deploying fake invoice PDFs files named invoice.pdf<\/code> and pagamento.pdf<\/code> (Portuguese for \u201cpayment\u201d) hosted on Amazon S3 buckets.<\/p>\n

\"\"
Files spotted in phishing campaigns with fake financial documents<\/em>\u00a0<\/figcaption><\/figure>\n

These files serve as infection vectors for financial fraud operations. The finding reinforces that legitimate cloud storage is now a preferred staging ground for initial payload delivery, with file hashes from these samples providing actionable IOCs for blocking and detection.<\/p>\n

Trojan Traffic Tunneled Through HTTPS on Port 443<\/strong><\/h2>\n

A behavior-based hunting query combining Russian IP geolocation, Suricata trojan classifications, and port 443 communication surfaced a diverse ecosystem of malicious traffic deliberately disguised as routine encrypted web activity.<\/p>\n

\"\"
Gather IOCs and observe 443 port exploited in a single lookup<\/em>\u00a0<\/figcaption><\/figure>\n

This multi-layered attack strategy, employing multiple legitimate services across various ports for communication and fallback, demonstrates how attackers architect resilience directly into their infrastructure.<\/p>\n

The .top TLD emerged as a particularly hostile domain space, with algorithm-generated Domain Generation Algorithm (DGA)<\/a> domains classified as malicious at scale.<\/p>\n

These domains routinely leverage WinRAR archives for payload delivery and use Cloudflare services to conceal true server locations. Given the extremely high volume of malicious activity tied to .top, many organizations are now blocking the entire TLD proactively at the perimeter.<\/p>\n

Turn uncertain alerts into faster, defensible decisions.\u00a0Gain clearer evidence for response and reporting<\/u><\/a>.<\/strong><\/p>\n

\"\"
Malicious domains and linked IOCs must be gathered for detection\/response<\/em>\u00a0<\/figcaption><\/figure>\n

For SOC teams and threat hunters, this research underscores several critical imperatives. Multi-parameter hunting queries combining JA3S fingerprints, destination geolocation, Suricata classifications, and file path patterns will outperform single-IOC lookups significantly.<\/p>\n

Detection rules targeting the identified JA3S hash, HTTPS-based C2 behavior, and high-risk TLDs like .top<\/code>, .shop<\/code>, and .cc<\/code> should be deployed immediately. Integration of ANY.RUN\u2019s TI Feeds and Lookup results into SIEM\/SOAR platforms can automate threat correlation and reduce analyst burden.<\/p>\n

At an organizational level, the extensive abuse of trusted infrastructure from Microsoft, Google, and Amazon proves that brand reputation no longer guarantees network safety.<\/p>\n

Adopting a Zero Trust posture, investing in advanced sandbox-based detection, and educating financial teams about BEC and phishing risks are no longer optional; they are baseline requirements for resilience in a threat landscape where the attacker\u2019s most reliable weapon is the cloud platform your enterprise already trusts.<\/p>\n

Close blind spots and reduce exposure<\/strong><\/a>\u00a0to critical incidents with ANY.RUN\u2019s Threat Intelligence.<\/p>\n

The post Attackers Abuse AWS, Google Cloud, Cloudflare, and Microsoft Services to Hide Malicious Traffic<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Guru Baran
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

Attackers Abuse AWS, Google Cloud, Cloudflare, and Microsoft Services to Hide Malicious Traffic Cybercriminals are increasingly weaponizing trusted cloud infrastructure, including Amazon Web Services, Google Cloud, Microsoft Azure, Cloudflare, and GitHub, to camouflage malicious traffic, evade detection, and sustain long-lived Command and Control (C2) operations. A recent threat intelligence investigation using ANY.RUN\u2019s Threat Intelligence (TI) […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63],"tags":[130],"class_list":["post-13333","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13333"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13333"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13333\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}