Expel Quarterly Threat Report, Q1 2025: Cloud infrastructure trends

This Q1 2025 Quarterly Threat Report (part four) analyzes cloud infrastructure as an attack surface, noting lower volume but meaningful incidents driven by secret/key exposure, misconfigurations, and server-side vulnerabilities; common outcomes include rapid cryptominer deployment and increasing cases of S3 bucket ransomware leveraging exposed AWS keys. The report highlights attacker use of publicly-available secret-finding tools like Trufflehog, emphasizes the monetization limits of cloud compromise, and recommends proactive secret scanning, short-lived credentials, least privilege, and improved monitoring and logging.