Cloud Breach Kill Chains

Real attacks. Real post-mortems. Step-by-step attack progression mapped to MITRE ATT&CK Cloud — so you can understand exactly what happened, and break the kill chain next time.

MITRE ATT&CK Cloud Mapped Full Attack Chain Per Incident Official Post-Mortems Sourced

Want to practice these techniques? Try the cloud security CTF challenges — many cover the same attack patterns (SSRF, IAM exploitation, token abuse). Unfamiliar with terms like IMDSv2, OIDC, or Golden SAML? See the cloud security glossary. For broader context on threat actors and trends, browse the cloud threat research directory or the cloud security overview.

Close-up of a laptop displaying cybersecurity text, emphasizing digital security themes
Photo by cottonbro studio on Pexels
Wide shot of a control room with operators working in front of large display screens
Photo by SpaceX on Pexels
Cloud breach kill chain Six stages of a typical cloud breach from initial access through impact, mapped to MITRE ATT&CK Cloud. Cloud breach kill chain — mapped to MITRE ATT&CK Cloud Initial Access Phishing, leaked key, SSRF, infostealer Execution & Persistence Run code, plant role, backdoor IAM Privilege Escalation AssumeRole abuse, policy mischief Defense Evasion Disable CloudTrail, delete logs Lateral Movement Pivot accounts, cross-tenant Exfiltration & Impact S3 dump, ransom, data destruction
Every breach below is annotated against this chain — read the cards in any order, but expect to see these stages chained together.
Cloud breach root-cause distribution Approximate share of major cloud breaches by primary root cause. Identity and configuration failures dominate; zero-days are a sliver. Where major cloud breaches actually start (approximate share) 0% 10% 20% 30% 40% Misconfiguration35% Stolen credentials30% Over-privileged IAM15% SSRF / insecure API8% Supply chain7% Insider risk5% Provider zero-day<1% Composite estimate — most real breaches chain 2–3 of these together. The kill-chains below show how.
Two takeaways: provider zero-days are vanishingly rare, and identity-adjacent failures (credentials + IAM + misconfig) account for ~80% of major incidents.
Real cloud breaches chain three to six tactics together. Detection content should target the chains, not isolated techniques. — the lesson under every kill chain on this page