S3 / Blob / GCS Mass Exfil

§ Where this technique fits

§ Dossiers chaining this technique

• Public bucket → CI/CD secret leak → cloud takeover

  A public S3 bucket hosts a build artefact containing CI tokens / .env files. Use them to push to the prod CI/CD pipeline and gain a deploy role.

  step 2 / 7

• WAF SSRF → IMDS → S3 mass exfil (Capital One 2019)

  A misconfigured ModSecurity rule on a customer-facing app allowed SSRF; SSRF hit EC2 IMDSv1 for the instance role; the role had ListBucket + GetObject on a major customer-data bucket.

  step 4 / 5

• Dev workstation → cloud backup keys → encrypted vault store (LastPass 2022)

  Attacker compromised a single LastPass DevOps engineer's home machine via outdated Plex Media Server, harvested AWS keys for the encrypted-vault backup bucket, exfiltrated production vault data.

  step 5 / 7

• Secret echoed to public build log → cloud takeover

  A workflow accidentally runs `env` or `set -x` during debugging — the AWS access key is now in public CI logs and indexed by Google Cache / GitHub search.

  step 6 / 6

§ What commonly comes next

1. 01
   Cloud SSRF → IMDS → Bucket Exfil (Capital One 2019)

   APT-CAPITAL-ONE-SSRF · Initial Access
   seen 1×
2. 02
   Dev-Workstation Backup Exfil (LastPass 2022)

   APT-LASTPASS-DEV · Initial Access
   seen 1×
3. 03
   Hardcoded Secrets in JS Bundles

   W-RECON-JS-SECRETS · Reconnaissance
   seen 1×