Transfer Data to Cloud Account
- ID
- T1537
- Tactics
- TA0010 Exfiltration
- Platforms
- IaaS, Office Suite, SaaS
- Data sources
- Snapshot Modification, Cloud Storage Modification, Snapshot Creation, Snapshot Metadata, Network Traffic Content, Cloud Storage Metadata, Application Log Content
- Source
- attack.mitre.org
- MITRE last modified
- 25 Oct 2025
Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
A defender who is monitoring for large transfers to outside the cloud environment through normal file transfers or over command and control channels may not be watching for data transfers to another account within the same cloud provider. Such transfers may utilize existing cloud provider APIs and the internal address space of the cloud provider to blend into normal traffic or avoid data transfers over external network interfaces.[5]
Adversaries may also use cloud-native mechanisms to share victim data with adversary-controlled cloud accounts, such as creating anonymous file sharing links or, in Azure, a shared access signature (SAS) URI.[6]
Incidents have been observed where adversaries have created backups of cloud instances and transferred them to separate accounts.[7]
Detection
- DET0573 Cross-Platform Detection of Data Transfer to Cloud Account
Data components: Snapshot Modification, Cloud Storage Modification, Snapshot Creation, Snapshot Metadata, Network Traffic Content, Cloud Storage Metadata, Application Log Content
Mitigations (4)
- M1018 User Account Management
Limit user account and IAM policies to the least privileges required.
- M1037 Filter Network Traffic
Implement network-based filtering restrictions to prohibit data transfers to untrusted VPCs.
- M1054 Software Configuration
Configure appropriate data sharing restrictions in cloud services. For example, external sharing in Microsoft SharePoint and Google Drive can be turned off altogether, blocked for certain domains, or restricted to certain users.[1] [2]
- M1057 Data Loss Prevention
Data loss prevention can prevent and block sensitive data from being shared with individuals outside an organization.[3] [4]
Groups (3)
References
- Google Workspace External Sharing
- Microsoft 365 External Sharing
- Microsoft Purview Data Loss Prevention
- Google Workspace Data Loss Prevention
- TLDRSec AWS Attacks
- Microsoft Azure Storage Shared Access Signature
- DOJ GRU Indictment Jul 2018