Detecting Cloud Threats with Dynamic Clouds - The HoneyCloud Project

Watch a 27-minute conference talk from fwd:cloudsec where cloud security experts Nathaniel Quist and William Gamazo introduce the "HoneyCloud" project - an innovative approach for detecting and analyzing cloud-based cyber threats. Learn about three real-world attack scenarios: the EleKtra-Leak cryptojacking operation initiated through exposed GitHub credentials, the P2PInfect peer-to-peer worm, and the RansomWorm ransomware targeting cloud storage and databases. Explore how threat actors are improving their secret scanning services and cloud resource control capabilities, while also discovering where their operational security mistakes reveal their locations. Gain insights into how the HoneyCloud platform can automatically collect Indicators of Compromise (IOCs) and track Cloud Threat Actor Groups (CTAGs) in live cloud environments, demonstrating how attackers can compromise hundreds of victims within minutes through weak cloud deployments. Understand this novel approach to enhancing threat discovery and defending against fully automated, dynamically scaled offensive cloud-targeted attacks that evade traditional security measures.