3 Top Cloud Attacks and How to Protect Against Them

This ReliaQuest report highlights three prevalent cloud threats—API compromise, SaaS-based phishing that leverages cloud storage links, and cloud environment hijacking—drawing on analysis of customer true-positive alerts from December 2023 to September 2024. Key findings include a high prevalence of phishing (71.1% of TTPs), frequent API discovery commands such as GetVersion in Kubernetes, and reuse of malicious source IPs; the report outlines impacts (credential theft, persistent access, abuse for crypto-mining and outbound phishing) and recommends layered defenses, strict API key management, monitoring of public-facing assets, and integrating protections via the GreyMatter platform.