Attackers Abuse AWS Cross-Account Features to Exfiltrate Cloud Data

Attackers can exfiltrate data from cloud environments by abusing legitimate cross-account sharing, backup, and replication features instead of moving files over traditional outbound channels. MITRE ATT&CK tracks this behavior as T1537 — Transfer Data to Cloud Account, describing how adversaries use provider APIs and internal cloud networking to make exfiltration resemble normal intra-cloud activity and evade controls focused on internet egress or command-and-control traffic.

Research detailing AWS tradecraft shows attackers with snapshot-related permissions can create Amazon EC2 and Amazon RDS snapshots, share them with attacker-controlled AWS accounts, and recover the underlying data without logging back into the original instance or database. Similar abuse is possible in Amazon S3, where adversaries can alter replication rules or trigger batch replication jobs to copy bucket contents into external accounts, particularly when overly permissive IAM roles are available. The activity largely occurs through cloud control-plane operations, reducing host-level forensic evidence and increasing the importance of monitoring CloudTrail, restricting IAM and KMS permissions, and encrypting sensitive resources.