Google: Cloud Attacks Now Exploit Software Flaws More Often Than Credentials

Google says hackers are increasingly breaking into cloud environments by exploiting newly disclosed software vulnerabilities, rather than relying on weak credentials or configuration mistakes.

According to Google’s latest threat report, vulnerability exploitation was the main initial access method in 44.5% of cloud intrusions investigated in the second half of 2025. Compromised credentials made up 27% of cases. Google says this shift likely reflects stronger account protections and secure-by-default measures that are making credential-based attacks less effective.

Vulnerability Exploitation Window Now Measured in Days

The gap between a vulnerability being disclosed and attackers actively exploiting it has shrunk significantly. Google observed cryptominers being deployed within 48 hours of a vulnerability becoming public, showing how quickly threat actors are able to weaponize newly revealed flaws.

The most common vulnerability type exploited was remote code execution (RCE). The report highlights React2Shell (CVE-2025-55182) and an XWiki vulnerability (CVE-2025-24893), the latter seen in attacks tied to the RondoDox botnet.

Data Theft Remains Hackers Primary Objective

Most of the attacks Google analyzed focused on quiet data exfiltration and maintaining long-term access, rather than going straight for extortion.

Google also points to campaigns linked to Iran, China, and North Korea, including incidents involving cloud persistence, cryptocurrency theft, and abuse of CI/CD pipelines to move deeper into corporate networks.

Cloud Attacks Response Times Are No Longer Enough

Google warns that cloud attacks are now moving faster than manual incident response teams can realistically handle. In some cases, attackers deployed malicious payloads within one hour of a new cloud instance being created. Because of this, the company recommends automated detection and response systems that can quickly contain threats before they spread across cloud environments.

Looking ahead, Google expects cloud threat activity to keep rising through 2026, pointing to global events such as geopolitical tensions, the FIFA World Cup, and U.S. midterm elections as likely drivers of increased cyber operations.