Exfiltration to Cloud Storage is the unauthorised copying of data from an environment into a cloud storage service controlled by the attacker or a compromised account. Adversaries use it to hide theft inside normal cloud traffic. Defenders should watch for unusual uploads, new storage destinations, bulk transfers, and access from unfamiliar identities or locations.
How exfiltration to cloud storage works
Cloud storage is attractive to attackers because uploads often blend into normal business traffic, especially when the destination is a legitimate platform or a compromised tenant. That makes the technique less noisy than obvious outbound transfers and lets stolen data leave an environment while appearing routine.
The core pattern is simple: collect data, package it for transfer, and push it to object storage, file sharing, or sync services that are difficult to distinguish from ordinary collaboration traffic. ATT&CK-style exfiltration tradecraft often pairs this with compression, staging, scheduling, and tools that can resume transfers quietly after interruption.
Why cloud storage is a useful exfiltration channel
Attackers prefer cloud storage when they want durability, reach, and plausible legitimacy. A small set of uploads can carry large volumes of data, and defenders may initially see only sanctioned cloud use unless they correlate destination reputation, account behaviour, and transfer volume.
This channel is especially effective when the adversary controls the storage account, steals a token or key, or abuses an already trusted service. NHIMG’s Microsoft SAS token exposure 2023 and GoTo breach 2023 both show how cloud storage access can turn into large-scale data exposure when credentials or stored material are reachable by an attacker.
What defenders should look for
The most useful signals are behavioural, not just signature-based. Unusual upload spikes, first-time storage destinations, new cloud accounts, unfamiliar geographies, and data flows that do not match the user or workload’s normal profile are all strong indicators.
It also helps to watch for preparatory steps such as local staging, archive creation, and repeated access to sensitive repositories before the transfer begins. NHIMG’s Data Exfiltration Guide covers the detection logic that ties those stages together, including egress telemetry and cloud-targeted transfer patterns.
Controls that reduce exposure
Prevention is strongest when cloud storage destinations are governed rather than treated as generic internet endpoints. Restrict where data can be uploaded, limit which identities can create or reuse storage credentials, and make sure outbound traffic policies reflect the fact that cloud storage can be both a legitimate business service and an exfiltration path.
Configuration discipline matters as much as access control. NHIMG’s Cloud Misconfiguration Guide is relevant here because public storage, wildcard permissions, and weak guardrails often make exfiltration easier, while NHIMG’s Top 10 Cloud Security Risks ties those failures to over-privilege, leaked keys, and logging gaps.
Risk and Threat Considerations
Exfiltration to cloud storage is risky because it combines theft with concealment. The attacker does not need to move data through an obviously malicious channel if they can use a trusted cloud service, a compromised account, or a short-lived token to make the transfer look ordinary.
Failure mechanism: Weak cloud permissions, exposed secrets, or permissive storage access let an adversary create an authorised-looking upload path, then move data out in bulk while bypassing simple perimeter controls.
Impact: Sensitive data can be removed at scale, incident dwell time can increase, and post-breach review becomes harder because the outbound traffic may resemble normal cloud collaboration or backup activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1048 — Exfiltration Over Alternative Protocol | Cloud storage transfer is an alternative exfiltration path that blends with normal traffic. |
| Recommendation — Map suspicious uploads to T1048 and alert on unusual outbound transfer patterns. | ||
| CIS Controls v8 | CIS-13 — Network Monitoring and Defense | Detects unusual outbound transfers and cloud-destination abuse through monitoring. |
| CIS-6 — Access Control Management | Limits who can access cloud storage paths and reduce unauthorized upload capability. | |
| Recommendation — Centralize egress telemetry and alert on abnormal cloud upload destinations. Restrict cloud storage write access to approved identities and roles. | ||
| NIST SP 800-53 Rev 5 | AU-12 — Audit Record Generation | Audit logs are needed to reconstruct upload activity and destination changes. |
| SC-7 — Boundary Protection | Outbound controls can constrain exfiltration to external cloud storage services. | |
| Recommendation — Enable detailed audit logging for storage access and transfer events. Filter and inspect outbound traffic to approved cloud storage destinations. | ||
Practitioner Guidance
What to watch for: Treat the cloud destination itself as part of the control decision. If users, workloads, or automation can write to arbitrary storage accounts without strong justification, the organisation has created an exfiltration path as well as a convenience path.
Practitioner takeaway: The best defence is usually to combine destination governance, transfer monitoring, and rapid credential containment so that suspicious uploads are visible before they become a sustained theft channel.
Related resources from NHI Mgmt Group
- Why does sensitive data spread across web applications and cloud storage increase exfiltration risk?
- How should security teams reduce cloud data exposure from misconfigured storage?
- Who is accountable when a reset-based takeover leads to cloud exfiltration?
- Why do shared keys create more risk than scoped authentication in cloud storage?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org