Cloud Malware | A Threat Hunter’s Guide to Analysis, Techniques and Delivery

This LABScon workshop report surveys cloud-native malware and threat hunting: it catalogs notable cloud-focused tools and campaigns (TeamTNT, Legion Stealer, AlienFox, Denonia), explains analysis techniques such as word-frequency analysis of large scripts and Docker layer inspection, and presents targeted and wide threat-hunting rules and IoCs (e.g., unique variable strings, CSP references, Telegram URLs) for detecting cloud attacks that exploit misconfigurations, exposed credentials, and containerized tooling.