2026年上半年云威胁展望报告

Cloud ThreatHorizons Report H1 2026 Contents Mission Statement3 Executive Summary4 Threat Actors Increasingly TargetingSoftware Vulnerabilities6 Compromised Identities and Data TheftDominate Industry Cloud Intrusion Trends9 Malicious Insiders Increasingly UsingPlatform Agnostic Environments to Exfiltrate Data14 North Korean Actors Weaponize Kubernetes Workloadsfor Multimillion-Dollar Cryptocurrency Theft20 From CI/CD to Cloud Compromise:Real-World Breach via OpenID Connect Abuse24 Protecting the Cloud Forensic Timelinefrom Sophisticated Threat Actors29 Accelerating Cloud Incident ResponseThrough Automated Pipeline Orchestration32 Contributors38 Executive Resource Addendum39 Mission Statement The Google Cloud Threat Horizons Report providesdecision-makers with strategic intelligence on threats tonot just Google Cloud, but all cloud service providers. Thereport focuses on recommendations for mitigating risksand improving cloud security for leaders and practitioners.The report is informed by Google Cloud’s Office of theCISO, Google Threat Intelligence Group (GTIG), MandiantConsulting, and various Google Cloud intelligence, security,and product teams. Executive Summary From Rapid Exploitationto Forensic Readiness The cloud threat landscape is rapidly shifting. Google Cloud Security observed the windowbetween vulnerability disclosure to active exploitation collapse from weeks to days in thesecond half of 2025. This activity, along with AI-assisted attempts to probe targets forinformation and continued threat actor emphasis on data-focused theft, indicates thatorganizations should be turning to more automatic defenses. Recognizing our commitment toshared fate in cloud security, this edition of our Cloud ThreatHorizons report highlights current threat trends and provides actionable recommendationsspecific to Google Cloud and for all platforms. A more concise companion report providingtailored recommendations for directors will be available on the Board of Directors Insights Hub. •Identity perimeters spanning multiple cloudenvironments and software-as-a-service (SaaS)platforms targeted with vishing and tokentheft:Identity compromise underpinned 83% ofcompromises. Threat actors continued to transitionfrom traditional phishing to voice-based socialengineering(vishing), and credential harvestingfrom third-party SaaS tokens to facilitate large-scale, silent data exfiltration. Key Findings for H2 2025 •Increasing exploitation of third-party, user-managed software as a primary initial accessvector:While Google Cloud’s underlyinginfrastructure remains secure, threat actors aresuccessfully targeting unpatched applicationsand permissive user-defined firewall rules. In theReact2Shell incident, for example, Google ThreatIntelligence Group (GTIG) saw threat actors exploitvulnerabilities in a popular third-party frameworkjustdays after disclosure. •Malicious insiders increasingly relying oncloud storage for data theft:Malicious insidersincreasingly used cloud environments controlledby their organizations and personally controlledcloud storage toexfiltrate sensitive data. Strategic Drivers Shaping the 2026Cloud Landscape Upcoming events in 2026, including increasinglyintensifying geopolitical conflicts, the FIFA WorldCup, and U.S. midterm elections, may provide abackdrop for high-volume social engineering anddistributed denial of service (DDoS) attacks targetingcloud-hosted media. Simultaneously, the EuropeanUnion’s Artificial Intelligence Actregulation andupdated U.S. Securities and Exchange Commissionreporting mandates may increase pressure onorganizations to ensure cloud-centered forensicreadiness. •Living-off-the-cloud (LOTC) techniques usedto compromise cloud infrastructure from acompromised endpoint:North Korean actorsbypassed traditional network perimeters usingsocial engineering to exploit a personal-to-corporate connection, allowing them to pivot to thecloud and compromise Kubernetes to steal millionsin cryptocurrency. •Supply chain attack combined with attempted AI-assisted living-off-the-land (LOTL) techniques:Threat actors used large language models (LLM)to automate credential harvesting and transitionfrom a developer’s local environment to full cloudadministration access. In less than 72 hours, theyabused OpenID Connect protocol trust between aCI/CD provider and cloud platform. More than just a snapshot of the cloud threatlandscape, this report equips decision-makersto move beyond reactive security by adoptingautomated identity-based controls and the forensicreadiness essential for maintaining operationalcontinuity and compliance in a rapidly collapsingthreat window. Threat Actors Increasingly TargetingSoftware Vulnerabilities As 2025 unfolded, our Google Cloud security expertsnoted an important pivot in threat-actor behavior.In the first half of 2025, threat actors continuedto rely heavily on weak or missing credentials andmisconfigurations to gain access to Google Cloudenvironments.