Google Cloud Report Highlights UNC4899 Crypto Theft via AirDrop-to-Cloud Pivot and Rising Vulnerability-Driven Intrusions

Google’s H1 2026 Cloud Threat Horizons reporting described a sophisticated intrusion attributed with moderate confidence to North Korea-linked UNC4899 (aka Jade Sleet, PUKCHONG, Slow Pisces, TraderTraitor) that targeted a cryptocurrency organization in 2025 and resulted in the theft of millions in cryptocurrency. The attack began with social engineering against a developer, who downloaded a malicious archive under the guise of open-source collaboration and then transferred it from a personal device to a corporate workstation via AirDrop; interaction with the archive led to execution of malicious Python that launched a backdoor binary masquerading as the Kubernetes CLI (kubectl). From the compromised endpoint, the actor pivoted into the cloud environment and used living-off-the-cloud (LOTC) techniques, abusing legitimate DevOps workflows to harvest credentials, escape container boundaries, and tamper with Cloud SQL databases to alter financial logic and enable theft.

Separately, Google’s broader cloud incident trend analysis found attackers are increasingly using newly disclosed third-party vulnerabilities—not just weak credentials or misconfigurations—for initial access into cloud environments, with exploit “time-to-weaponization” shrinking from weeks to days (including cryptominer deployment within ~48 hours of disclosure). In Google’s reviewed intrusions, vulnerability exploitation was the leading initial access vector (44.5%) versus credentials (27%), with RCE flaws most frequently abused; examples cited include React2Shell (CVE-2025-55182) and an XWiki vulnerability (CVE-2025-24893) used in RondoDox botnet activity. The report also noted continued use of compromised identities via phishing/vishing (often help desk impersonation) and that many cloud intrusions prioritized quiet, high-volume data exfiltration and persistence over immediate extortion.