Cloud Attack Lifecycle

Learning Objectives

By the end of this lesson, you will be able to:

Understand the complete cloud attack lifecycle.
Identify the objectives of each attack phase.
Learn how attackers move through cloud environments.
Recognise common cloud attack techniques.
Apply the lifecycle during cloud penetration testing engagements.

Introduction

Unlike traditional attacks that often focus on compromising a single server, cloud attacks typically target identities, APIs and cloud-native services.

Modern attackers rarely stop after gaining initial access.

Instead, they continue to:

Discover cloud resources.
Escalate privileges.
Move laterally.
Access sensitive data.
Establish persistence.
Hide their activities.

Understanding this lifecycle helps Cloud Penetration Testers identify realistic attack paths and recommend effective security controls.

What is the Cloud Attack Lifecycle?

The Cloud Attack Lifecycle describes the sequence of activities an attacker performs after targeting a cloud environment.

Each stage builds upon the previous one.

Initial Access

↓

Reconnaissance

↓

Enumeration

↓

Credential Discovery

↓

Privilege Escalation

↓

Persistence

↓

Lateral Movement

↓

Resource Discovery

↓

Data Access

↓

Data Exfiltration

↓

Defense Evasion

↓

Impact

Why It Matters

Cloud Penetration Testers simulate portions of this lifecycle to:

Validate security controls.
Identify attack paths.
Assess business risk.
Recommend improvements.
Improve detection capabilities.

Understanding the entire lifecycle provides context for every finding.

Phase 1 — Initial Access

The attack begins with obtaining access to the cloud environment.

Common techniques include:

Phishing
Stolen credentials
Password spraying
Credential stuffing
API key leakage
Public Git repositories
OAuth token theft
Compromised service accounts

Without initial access, most cloud attacks cannot proceed.

Example

Developer

↓

Phishing Email

↓

Stolen Credentials

↓

AWS Console Login

Phase 2 — Reconnaissance

After gaining access, attackers attempt to understand the environment.

Typical activities:

Identify cloud provider
Discover accounts
Review IAM
Inspect services
Locate workloads
Review networking
Identify monitoring

Goal:

Understand the environment before taking further action.

Example Commands

Examples of cloud reconnaissance include:

aws sts get-caller-identity

aws iam list-users

aws ec2 describe-regions

kubectl get namespaces

Phase 3 — Enumeration

Enumeration gathers detailed information.

Examples:

IAM users
IAM roles
Security Groups
Kubernetes Pods
Secrets
Storage buckets
Databases
Virtual Machines
Network routes

Enumeration helps attackers identify weaknesses and opportunities for privilege escalation.

Phase 4 — Credential Discovery

Attackers search for credentials that provide additional access.

Common targets:

Environment variables
Configuration files
Kubernetes Secrets
EC2 metadata service
Git repositories
CI/CD pipelines
Secret Manager misconfigurations

Credentials often provide a faster path than exploiting software vulnerabilities.

Example

Compromised Container

↓

Environment Variables

↓

AWS Credentials

↓

IAM Authentication

Phase 5 — Privilege Escalation

After obtaining credentials, attackers attempt to gain additional permissions.

Examples:

Assume IAM roles
Abuse excessive permissions
Attach administrator policies
Create new access keys
Modify IAM policies
Escalate Kubernetes RBAC

Privilege escalation often turns a limited compromise into full cloud control.

Example

Developer Role

↓

Assume Administrator Role

↓

Full AWS Account Access

Phase 6 — Persistence

Attackers attempt to maintain long-term access.

Methods include:

Creating new IAM users
Creating access keys
Backdoor service accounts
Malicious Kubernetes workloads
Scheduled tasks
Hidden API tokens

Persistence allows attackers to regain access even after passwords are changed.

Phase 7 — Lateral Movement

Attackers move between cloud resources.

Examples:

Virtual Machine → Database
Container → Kubernetes Cluster
Kubernetes → Cloud APIs
IAM Role → Additional Accounts
CI/CD Pipeline → Production Environment

Lateral movement expands attacker access.

Example

EC2 Instance

↓

IAM Role

↓

Amazon S3

↓

Amazon RDS

↓

Secrets Manager

Phase 8 — Resource Discovery

Attackers identify valuable assets.

Examples:

Databases
S3 Buckets
Azure Storage
Cloud SQL
Secrets
Customer Records
Kubernetes Clusters
Backup Storage

The objective is to locate high-value resources.

Phase 9 — Data Access

Once valuable resources are identified, attackers attempt to access sensitive information.

Potential targets include:

Customer records
Source code
Financial information
Personally Identifiable Information (PII)
Intellectual property
Encryption keys
Database backups

Phase 10 — Data Exfiltration

Attackers transfer stolen data outside the organisation.

Examples:

Downloading cloud storage
API extraction
Database exports
Backup downloads
File synchronisation
Encrypted outbound transfers

Data exfiltration is often the primary objective of cloud attacks.

Phase 11 — Defense Evasion

To avoid detection, attackers may:

Disable logging
Delete audit logs
Modify CloudTrail settings
Stop monitoring agents
Delete Kubernetes audit events
Remove evidence

Maintaining comprehensive logging makes these activities easier to detect.

Phase 12 — Impact

The final phase depends on the attacker’s objectives.

Possible impacts include:

Data theft
Ransomware deployment
Business disruption
Cryptocurrency mining
Infrastructure destruction
Account takeover
Supply chain compromise

The business impact determines the overall severity of the incident.

Enterprise Attack Flow

Phishing

↓

Cloud Login

↓

IAM Enumeration

↓

Privilege Escalation

↓

Kubernetes Access

↓

Secrets Discovery

↓

Database Access

↓

Data Exfiltration

Cloud Attack Lifecycle vs Traditional Attack Lifecycle

Traditional Infrastructure	Cloud Infrastructure
Server compromise	Identity compromise
Local administrator	IAM privilege escalation
Internal network movement	Cloud resource movement
File shares	Object storage
Active Directory	Cloud IAM
Physical servers	Cloud services & APIs

Cloud attacks are generally more identity-driven and API-focused.

Cloud Services Commonly Targeted

Attackers frequently target:

Identity

IAM Users
Roles
Service Accounts
OAuth Tokens

Compute

EC2
Azure Virtual Machines
Compute Engine

Storage

Amazon S3
Azure Blob Storage
Google Cloud Storage

Kubernetes

Pods
Secrets
RBAC
API Server
Service Accounts

DevOps

Git Repositories
CI/CD Pipelines
Artifact Registries
Container Registries

MITRE ATT&CK Mapping

The cloud attack lifecycle aligns closely with the MITRE ATT&CK framework.

Examples include:

Lifecycle Stage	MITRE ATT&CK Technique
Initial Access	Valid Accounts
Reconnaissance	Cloud Service Discovery
Enumeration	Permission Groups Discovery
Credential Discovery	Credentials from Files
Privilege Escalation	Additional Cloud Roles
Persistence	Create Cloud Account
Lateral Movement	Cloud Service Access
Defense Evasion	Disable Logging
Exfiltration	Exfiltration to Cloud Storage

This mapping helps security teams detect and respond to attacker behaviour.

Enterprise Assessment Perspective

During a cloud penetration test, you evaluate whether each phase of the lifecycle could succeed.

Questions include:

Can an attacker gain initial access?
Can they enumerate cloud resources?
Are excessive IAM permissions present?
Can they escalate privileges?
Can they move laterally?
Can they access sensitive data?
Would monitoring detect these actions?

These questions guide the assessment.

Best Practices

To disrupt the attack lifecycle:

Enable Multi-Factor Authentication (MFA).
Apply least privilege.
Rotate credentials regularly.
Enable comprehensive logging.
Monitor unusual API activity.
Restrict public access.
Secure Kubernetes clusters.
Protect CI/CD pipelines.
Scan container images.
Conduct regular cloud penetration tests.

Common Mistakes

Avoid:

Ignoring IAM security.
Using long-lived credentials.
Leaving storage publicly accessible.
Disabling audit logging.
Granting excessive permissions.
Storing secrets in source code.
Assuming attackers stop after gaining initial access.

Knowledge Check

1. Why is identity compromise often the first objective in cloud attacks?

Answer: Cloud identities provide authorised access to cloud services. Compromising an identity often allows attackers to interact with cloud resources without exploiting software vulnerabilities.

2. What is the purpose of privilege escalation?

Answer: Privilege escalation allows attackers to obtain higher levels of access, increasing their ability to control cloud resources and reach sensitive data.

3. Why do attackers perform reconnaissance and enumeration before exploiting resources?

Answer: These phases help attackers understand the cloud environment, identify valuable assets and discover weaknesses that can be used in later stages of the attack.

4. Why is persistence dangerous in cloud environments?

Answer: Persistence allows attackers to maintain access even after passwords are changed or sessions expire, making detection and remediation more difficult.

5. How does understanding the Cloud Attack Lifecycle help Cloud Penetration Testers?

Answer: It enables testers to identify realistic attack paths, evaluate security controls at each stage of an attack and recommend mitigations that interrupt the attack before business impact occurs.

Key Takeaways

Cloud attacks are typically identity-driven rather than infrastructure-driven.
Attackers follow a structured lifecycle from initial access to business impact.
Privilege escalation and lateral movement are critical stages in cloud compromises.
Understanding the lifecycle helps penetration testers identify realistic attack paths.
Effective security controls should prevent, detect or contain attackers at every stage of the lifecycle.

What’s Next?

In the next lesson, we will explore Cloud Reconnaissance, learning how attackers gather intelligence about cloud environments using passive and active techniques and how penetration testers perform authorised reconnaissance safely and effectively.

➡️ Next Lesson: Lesson 05 — Cloud Reconnaissance