Google Cloud Threat Horizons: H2 2025 Report
The Evolving Cloud Security Threat Landscape• Escalating Incidents: Cloud security incidents are significantly on the rise, with 61% of organizations reporting breaches within the last year, a notable increase from 24% the previous year. Data security breaches have emerged as the most common incident type, reported by 21% of organizations, shifting from previous years where misconfigurations were the leading enabler.• Sophisticated Attack Vectors: Threat actors are refining their tactics for evasion, persistence, and supply chain compromise. This includes: ◦ Targeting Backup Infrastructure: Financially motivated groups are increasingly targeting backup systems, making traditional disaster recovery insufficient. ◦ Abuse of Legitimate Internet Services (LIS): Threat actors are widely abusing trusted platforms like Google Drive, OneDrive, Notion, and GitHub for their malicious infrastructure (referred to as "living off trusted sites" or LOTS). This helps them blend malicious activities with normal traffic, making detection harder. LIS are used for full Command-and-Control (C2), Dead Drop Resolving (DDR), payload delivery, and data exfiltration. Cloud storage platforms and messaging applications (e.g., Telegram, Discord) are the most frequently abused LIS categories. ◦ Decoy File Delivery: Threat actors use trusted cloud storage services (like Google Drive, Microsoft SharePoint, Dropbox, GitHub) to host seemingly benign decoy files (often PDFs) that, when interacted with, facilitate malware execution or system compromise in the background. ◦ Browser Extension Supply Chain Risk: Compromised Chrome Web Store (CWS) developer accounts can allow threat actors to distribute malicious updates via automated CI/CD pipelines by leveraging compromised OAuth tokens.• Persistent Foundational Vulnerabilities: Despite the rise of advanced attacks, credential compromise (weak or absent credentials, leaked credentials) remains the predominant initial access vector (47.1%), followed closely by misconfigurations (29.4%). ◦ Cloud Misconfigurations: These are critical risks, identified as bugs, gaps, or errors during cloud adoption or migration that expose environments to threats. They often stem from complexity in multi-cloud settings and human error, with a Gartner survey suggesting 80% of data security breaches are due to misconfiguration-related issues, and up to 99% of cloud failures by 2025 attributed to human errors. ◦ Zero-Day Threats: Navigating zero-day threats remains a top concern, with 91% of cybersecurity professionals worried about their systems' ability to handle such unknown risks.II. Challenges in Current Cloud Security Practices• Prevention Gap: Despite rising incidents, only 21% of organizations prioritize preventive measures aimed at halting attacks before they occur, indicating a significant prevention gap.• Overwhelming Volume of Alerts & Slow Response: Cybersecurity teams face an overwhelming volume of daily security alerts, with 40% of organizations receiving over 40 alerts each day. This strains resources and leads to lengthy resolution times, with 43% reporting resolution times exceeding five days.• Talent Shortage & Skill Gaps: A significant 76% of organizations report a shortage of skilled cybersecurity professionals. Additionally, the most significant barrier to effective cyber defense is the lack of security awareness among employees (41%). Rapid technological changes also contribute to the difficulty in keeping pace with evolving threats.• Tool Fragmentation and Integration Issues: Organizations deploy a fragmented array of security platforms and tools, with 43% employing seven or more tools just to configure policies. The complexity of maintaining consistent regulatory standards in hybrid or multi-cloud architectures (54%) and integrating cloud services with legacy systems (49%) are major challenges. Many organizations use multiple cloud IaaS providers, further complicating integration.III.
