Hidden Dangers in the Cloud Control Plane

This Mitiga research report shows how GCP Compute APIs (notably getSerialPortOutput and setMetadata) can be abused to establish stealthy command-and-control and data exfiltration channels to VMs even when those VMs are firewalled; it describes attacker scenarios requiring cloud credential or permission compromise, documents disclosure to Google, and provides hardening and hunting guidance to mitigate the risk.