Threat Actors Leverage Cloud Logs to Bypass Defender Visibility

Unit 42 research warns that sophisticated attackers are actively exploiting cloud logging services (AWS CloudTrail and Google Cloud Logging) to blind defenders or to gain persistent, covert visibility. The report details methods including stopping logging, deleting log storage or routers, creating/using external KMS keys to make logs unreadable, poisoning stored log files, and redirecting or duplicating logs to attacker-controlled buckets. These techniques can disable SIEM/SOAR ingestion, wipe forensic evidence, or provide real-time intelligence to adversaries; recommended mitigations include restricting logging modification permissions, enabling CloudTrail integrity validation, locking Google log buckets, and alerting on trail/sink creation or updates.