Can attackers hide command-and-control inside trusted cloud services?

Yes, and they do, because traffic to a well-known cloud service rarely gets blocked or questioned. Malware can fetch instructions from a file in a public cloud storage account, a shared document, a code-hosting site, a messaging app's bot interface or a content-delivery network, and send stolen data back the same way. To a firewall that judges destinations by reputation, it looks like an ordinary employee using a popular service. What still gives it away is behaviour. A program checking a cloud file at regular intervals, day and night, from a device whose user is not working, has a rhythm that people do not; uploads may be unusually large for that device; and the client fingerprint in the TLSTLS: Transport Layer Security. The encryption that protects most internet traffic, such as HTTPS. handshake may not match a browser or the service's official app. Practical steps: allow only the cloud services the business uses, by tenant where your tools allow it, and investigate devices that talk to personal accounts of popular services. NetSenX detects beaconing and unusual outbound volume on every plan, whatever the destination, and TLS fingerprints from the Starter plan where the agent captures packets.

← All 25 questions on Cloud and SaaS securityAll topics