New 'GhostStack' Technique Exploits Legitimate Cloud Provider APIs to Hide C2 Infrastructure
Researchers have uncovered a sophisticated command-and-control evasion technique that leverages legitimate cloud storage APIs and serverless functions to create virtually undetectable communication channels, already adopted by multiple threat actors.
New 'GhostStack' Technique Exploits Legitimate Cloud Provider APIs to Hide C2 Infrastructure
A novel attack methodology dubbed "GhostStack" is forcing security teams to reconsider their approach to detecting command-and-control traffic by weaponizing the very cloud services most organizations trust implicitly.
The technique exploits legitimate APIs from major cloud providers—specifically object storage services and serverless computing platforms—to establish bidirectional communication between compromised endpoints and attacker infrastructure. Rather than connecting to suspicious domains or IP addresses, infected systems interact solely with trusted cloud provider endpoints that appear in virtually every enterprise network.
Here's how it works: Attackers create seemingly legitimate cloud storage buckets with public read access and restricted write permissions. Compromised systems poll these buckets at randomized intervals, retrieving encrypted commands disguised as innocuous file metadata or embedded within image files using steganography. Responses travel back through serverless functions that accept HTTPS posts, process the data, and store results in separate storage buckets.
The genius of GhostStack lies in its abuse of trust. Network monitoring tools see HTTPS connections to Microsoft Azure, AWS, or Google Cloud Platform—exactly what they expect from modern enterprise applications. The traffic patterns blend seamlessly with legitimate cloud service usage, and blocking these destinations would cripple business operations.
Security researchers have identified at least three distinct threat groups implementing variations of GhostStack since June, suggesting the technique is spreading rapidly through underground forums. One campaign targeting financial services firms in Singapore and Hong Kong maintained persistent access for over four months before discovery, with defenders initially attributing the cloud API traffic to legitimate SaaS applications.
Detection requires moving beyond network-level monitoring to focus on endpoint behavior analysis. Organizations should monitor for unusual cloud API authentication patterns, unexpected serverless function invocations from employee workstations, and systematic polling of cloud storage resources. Data loss prevention tools need reconfiguration to inspect cloud-bound traffic more aggressively, even when destined for trusted providers.
The emergence of GhostStack represents a maturation of adversary tradecraft—exploiting not just technical vulnerabilities but the architectural assumptions underlying modern security defenses.