Defence Against Living-off-the-Cloud (LotC) & Trusted Infrastructure Abuse

Threat actors are abandoning easily blocked, newly registered domains in favour of hosting their Command and Control (C2) servers and data exfiltration channels on highly trusted, legitimate platforms like Microsoft OneDrive, Google Workspace, GitHub, and Slack. Standard firewalls and Secure Web Gateways (SWGs) inherently trust traffic to these domains, allowing attacks to bypass Indicator of Compromise (IoC) and domain reputation filters.

This technique was highlighted in mid-2024 when researchers discovered the “CloudSorcerer” cyberespionage campaign. The advanced persistent threat (APT) used custom backdoors to conduct C2 operations and data exfiltration strictly via legitimate Microsoft Graph, GitHub, and Yandex Cloud APIs, blending into normal enterprise traffic to evade detection.

Best Practices & Mitigation Strategies

We must shift our defensive posture from static IoC blocking to dynamic behavioural network analysis. We must assume that a connection to a “trusted” domain does not guarantee a safe payload.

1. Enforce Tenant Restrictions: Allow connections to trusted platforms, but only to your corporate instances. Configure your SWG or Cloud Access Security Broker (CASB) to enforce Tenant Restrictions (e.g., Azure AD Tenant Restrictions). This ensures employees can log into your corporate Microsoft 365 or Google Workspace environment, but connections to personal or attacker-controlled tenants on the same platforms are blocked.

2. Shift to Behavioural Network Analysis: Monitor how a service is used, not just where the traffic is going. If a background process like svchost.exe or powershell.exe suddenly initiates a 5GB upload to OneDrive at 3:00 AM, Extended Detection and Response (XDR) tools must flag this as anomalous behaviour, regardless of the destination domain’s trusted reputation.

3. Decouple and Inspect TLS Traffic: You cannot analyse what you cannot see. Ensure SSL/TLS inspection is active for traffic bound to major cloud storage providers. This allows DLP engines to scan for sensitive data leaving the perimeter, even if it is heading to a known SaaS provider.

4. Establish Remediation Timelines: Immediately audit your top outbound traffic destinations and verify that SSL inspection is enabled for major file-sharing platforms. Within 30 days, implement Cloud Tenant Restrictions on corporate firewalls. Continuously tune SIEM/XDR behavioural alerts to detect anomalous API usage spikes or unusual automation patterns.

The definition of a “safe” destination has fundamentally changed. When the adversary uses the exact same productivity tools as our workforce, security relies not on blocking the tool, but on understanding the intent of the behaviour.