English
Español
Français
Deutsch
日本語
한국어
العربيةCloud threat actors
Cloud Threat Actors
Curated by Pathbreak Research · Updated October 2026
The cloud threat actors defenders should know: the tradecraft they use and the MITRE ATT&CK techniques behind it, from public incident reporting. Some operate in AWS, others in Azure, Entra ID or Microsoft 365. Curated by Pathbreak Research.
Scattered Spider
UNC3944, Octo Tempest, Muddled Libra, 0ktapus
Scattered Spider is a financially motivated group known for aggressive social engineering, help desk impersonation, and SIM swapping to breach large enterprises. In the cloud it abuses stolen identities and federation to take over AWS and Azure tenants. It then steals data and often deploys ransomware for extortion.
APT29
Cozy Bear, Midnight Blizzard, Nobelium, The Dukes
APT29 is a Russian state sponsored espionage group linked to the SVR and responsible for the SolarWinds intrusions. It specializes in cloud and identity attacks against Microsoft 365 and Azure. It forges tokens and abuses OAuth applications and service principals to read targeted email.
LAPSUS$
DEV-0537, Strawberry Tempest
LAPSUS$ is an extortion focused group that relied on social engineering, SIM swapping, and insider recruitment to breach technology and telecom firms. Once inside it abused cloud admin access to steal source code and data. In some cases it destroyed cloud resources to pressure victims.
TeamTNT
Adept Libra
TeamTNT is a financially motivated group that has targeted cloud and container environments since 2019. It harvests AWS credentials from compromised Linux hosts and containers. It then deploys cryptocurrency miners at scale across the victim environment.
SCARLETEEL
SCARLETEEL is a financially motivated cloud operation tracked by Sysdig that breaches AWS accounts through vulnerable containers and compute services. It steals credentials and escalates to administrator in the account. It runs cryptominers and also steals proprietary data.
GUI-vil
p0-LUCR-1
GUI-vil, also tracked as p0-LUCR-1, is a financially motivated group from Indonesia tracked by Permiso. It uses exposed AWS keys to gain access through the S3 Browser tool and the AWS Management Console. Its goal is running EC2 instances for cryptomining.
AMBERSQUID
AMBERSQUID is a cloud native cryptojacking operation tracked by Sysdig that abuses less common AWS services to mine cryptocurrency. It runs miners through Amplify, CodeBuild, CloudFormation, SageMaker, ECS Fargate, and EC2 Auto Scaling. Spreading across services helps it avoid the quota approvals that EC2 spam would trigger.
EleKtra-Leak
EleKtra-Leak is an automated cloud cryptojacking campaign tracked by Unit 42 that scans public GitHub repositories for exposed AWS IAM keys. Within minutes of a key being committed it creates EC2 instances across regions. The instances then mine Monero at the victim expense.
Storm-0558
Antique Typhoon
Storm-0558, now tracked by Microsoft as Antique Typhoon, is a China based espionage group. In 2023 it forged authentication tokens using an acquired Microsoft signing key. It used the forged tokens to read email from about 25 organizations through Outlook Web Access.
Storm-0501
Storm-0501 is a financially motivated ransomware group tracked by Microsoft that expanded into hybrid cloud attacks. It pivots from on premises Active Directory into Microsoft Entra ID and builds a backdoor federated domain. It then exfiltrates data and deploys Embargo ransomware or keeps persistent cloud access.
See which of their techniques resolve in your account
Pathbreak validates which AWS attack paths actually exist for your identities and ranks the few changes that cut the most. One account, one read-only scan, first validated paths within the hour.
Questions
Where does this threat actor data come from?
Pathbreak Research compiles it from public incident reporting and threat intelligence, including MITRE ATT&CK, CISA advisories, and vendor research from Mandiant, Microsoft, Unit 42, Sysdig, Permiso and others. Each actor links to its sources.
Do all of these actors target AWS specifically?
No. Some operate primarily in AWS, such as TeamTNT, SCARLETEEL, GUI-vil, AMBERSQUID and EleKtra-Leak. Others operate mainly in Azure, Entra ID or Microsoft 365, such as APT29, Storm-0558 and Storm-0501. Each summary says where the actor is documented to operate. We do not attribute a specific AWS API call to an actor unless public reporting documents it.
Who is this for?
Defenders building threat models, detection engineers, and red teams who want to ground AWS hardening in how real actors operate rather than in theory.