REPORT1 SOURCE
2023 Wrap-up
An end of year summary for Hacking the Cloud in 2023.
First reported Dec 20, 2023 01:25 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordÆ / PUBLIC MALWARE INTELLIGENCE
Follow the evidence.
Published file metadata, source observations, indicators, and research history in one bounded catalog.
94Reachable catalog records
3 / 4Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Review source update dates and status
- src_0fd74b59b2db565a4cCollection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
94 MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
REPORT1 SOURCE
Bypass GuardDuty Tor Client Findings
Connect to the Tor network from an EC2 instance without alerting GuardDuty.
First reported Feb 20, 2021 04:07 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Unauthenticated Enumeration of IAM Users and Roles
Discover how to exploit cross-account behaviors to enumerate IAM users and roles in another AWS account without authentication.
First reported Aug 05, 2020 14:32 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Hacking The Cloud v2: New Look
All about the new look for Hacking The Cloud v2.
First reported Sep 18, 2022 21:18 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Call for research: AI and LLM security
Hacking the Cloud is opening the door to AI and LLM security research.
First reported Jan 25, 2026 20:11 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
User Data Script Persistence
Maintain access to an EC2 instance and it's IAM role via user data scripts.
First reported Feb 03, 2021 03:20 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
[Deprecated] Break LLM Workflows with Claude's Refusal Magic String
How Anthropic's refusal test string can be abused to stop streaming responses and create sticky failures.
First reported May 05, 2026 21:10 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
CVE-2024-28056: Exploit an AWS Amplify Vulnerability in Same-Account Scenarios
An in-depth explanation of how to still abuse CVE-2024-28056, a vulnerability in AWS Amplify that exposed IAM roles to takeover.
First reported Jul 31, 2024 20:37 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Bypass GuardDuty Pentest Findings for the AWS CLI
Prevent Kali Linux, ParrotOS, and Pentoo Linux from throwing GuardDuty alerts by modifying the User Agent string when using the AWS CLI.
First reported Jul 22, 2020 02:58 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
GCP Goat
GCP Goat is the Vulnerable application for learning the GCP Security
First reported Aug 29, 2022 00:18 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Privilege Escalation in Google Cloud Platform
Privilege escalation techniques for Google Cloud Platform (GCP)
First reported Aug 24, 2022 12:25 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Lambda Persistence
How to establish persistence on a Lambda function after getting remote code execution.
First reported Sep 16, 2021 15:02 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Exploiting Misconfigured GitLab OIDC AWS IAM Roles
Discover how to identify and exploit misconfigured AWS IAM roles using GitLab OIDC, with a detailed, step-by-step guide.
First reported Sep 01, 2024 22:46 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Get IAM Credentials from a Console Session
Convert access to the AWS Console into IAM credentials.
First reported Jul 14, 2021 20:46 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Unauthenticated Enumeration of Google Workspace Email Addresses
Discover how to exploit information disclosure configurations in Google Workspace to enumerate valid email addresses.
First reported Apr 11, 2023 13:31 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
AWS CodeBuild GitHub Runner Persistence
Abusing the CodeBuild managed GitHub Actions runner integration to obtain long‑term access to an AWS environment.
First reported Sep 21, 2025 15:22 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Bypass Cognito Account Enumeration Controls
Leverage a flaw in Cognito's API to enumerate accounts in User Pools.
First reported Jan 07, 2024 21:28 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Tag Your Way In - GCP Privilege Escalation Using Tags
A new privilege escalation technique in Google Cloud that leverages tag bindings to bypass IAM conditions and gain unauthorized access to sensitive resources.
First reported May 02, 2025 10:10 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Data Exfiltration through S3 Server Access Logs
Exfiltrate data via S3:GetObject and S3 server access logs.
First reported Dec 07, 2023 10:12 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Abusing Elastic Container Registry for Lateral Movement
With ECR permissions you can easily distribute a backdoor to production servers, developer's laptops, or CI/CD pipelines and own the environment by gaining privileged permissions.
First reported Oct 13, 2022 01:37 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Apps Script project impersonation / Google Apps Script persistence
Google Workspace Apps Script projects create hidden GCP projects (sys-) that can be impersonated by attackers. This technique enables stealthy persistence (service accounts, hidden compute, cryptomining) and can bypass common console inspections.
First reported Oct 08, 2025 18:22 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
S3 Streaming Copy
Utilizng standard out to standard in with aws-cli utilizing multiple profiles to avoid logging and detection in a victim environment
First reported Feb 10, 2023 15:12 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
Connection Tracking
Abuse security group connection tracking to maintain persistence even when security group rules are changed.
First reported Jul 30, 2020 23:28 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordREPORT1 SOURCE
CI/CDon't
An AWS/GitLab CICD themed CTF.
First reported Mar 05, 2022 04:00 UTCCatalog metadata updated Oct 08, 2026 03:45 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.