Attackers Exploit Cloud Logging Platforms to Hide Malicious Activity

This report describes how attackers are actively abusing cloud logging infrastructure—including AWS CloudTrail and Google Cloud Logging—to blind defenders and maintain persistent access by stopping log collection, deleting storage, altering KMS/CMEK keys to render logs unreadable, poisoning log files, and redirecting logs to attacker-controlled locations; it highlights the impact on detection and forensics and recommends tightening access controls, limiting permissions, and leveraging immutable/log-integrity features.