Attribution in the Age of AI: Cloud Threats, Real Attacks,and Zero-Knowledge Adversaries
Attribution Is Harder Than Ever—But Still Essential
“Attribution is one of cybersecurity’s most contested topics. It’s messy, political, and when done wrong, dangerous.” – Kali Fencl
As threat actors increasingly reuse tools, spoof identities, and operate in the cloud, traditional attribution methods are under pressure. Tal Darsan and Etay Maor of Cato Networks emphasized the challenge of assigning blame in an era where attackers “live off the land” using legitimate tools and public infrastructure.
The rise of ransomware groups like Medusa and Hunters International shows how easily attackers can blur lines using shared TTPs, resulting in attribution that is murky at best.
Shadow AI and Zero-Knowledge Threat Actors Are Redefining the Game
“We dubbed them the Zero Knowledge Threat Actor.” – Etay Maor
Attackers no longer need deep technical expertise. Etay and Tal shared how AI tools can now be used to generate malware, create EDR killers, and evade AI-based detection systems themselves. These zero-knowledge actors leverage platforms like ChatGPT to generate sophisticated attacks with minimal background.
Etay outlined four lenses for evaluating AI’s impact in security:
- How defenders use AI
- How attackers use AI
- How attackers evade AI
- Shadow AI—unauthorized tools brought into the org by employees
This creates an opaque “black box” environment where visibility is critical but often lacking. AWS Identity Leaks and GCP Privilege Escalation: Real-World Cloud Incidents
“We investigated a case where data was being exfiltrated for nearly a year.” –Yonaten Khen
- Attackers using leaked access keys and the Get Caller Identity API to quickly identify and exploit cloud accounts.
- Abuse of the domain-wide delegation feature in Google Workspace, allowing full access to user emails and documents.
- A privilege escalation path from GCP into Google Workspace, which was still unpatched at time of recording.
From the Hunters research team, Yonaten Khen shared insights from a live incident investigation in AWS and GCP environments. His team found:
He emphasized that many organizations are still unaware of these threats and that some vulnerabilities stem not from bugs, but from design choices in cloud platforms.
Visibility Is the First Line of Defense
“Everything starts from visibility.” – Etay Maor
Whether it’s TLS decryption, misconfigured detection tools, or cloud logging gaps, both teams stressed the need for visibility across infrastructure. Without it, attacks that leverage legitimate pathways (like service accounts or unmanaged devices) can operate for months undetected.
Tal emphasized that some attacks could have been prevented if organizations had simply enabled core security features or reviewed default settings.
Prevention Starts with Understanding
Attribution may never be perfect, but improving detection and response capabilities—especially in cloud environments is possible and essential.
- Identity and access missteps are among the most exploited vectors in AWS and GCP
- AI is both an attack enabler and a detection disruptor
- Shadow AI and misconfigurations open the door to sustained breaches
- Attribution matters less than actionability. Focus on patterns, signals, and intent
Further Reading and References:
