[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1530":3},{"item":4,"lessons":18,"controls":56,"related":86},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1530","T1530","Data from Cloud Storage",9,"MITRE","**What attackers do.** Attackers access data held in cloud storage services such as object storage buckets, blob containers and shared drives, often through misconfigured public access or stolen credentials. This serves the Collection tactic.\n\n**How to defend.** Block public access by default, use cloud security posture tools to find misconfigured storage, and apply least privilege to storage roles and keys. Enable data access logging, which is often off by default, and encrypt sensitive data with managed keys. Rotate and restrict long-lived access keys.\n\n**Signs to look for.** Look for bulk listing or download operations, access from unfamiliar identities or networks, and storage that becomes public. A common gap is that object-level access logging was never enabled, leaving no record of what was read.","Adversaries may access data from cloud storage.\n\nMany IaaS providers offer solutions for online data object storage such as Amazon S3, Azure Storage, and Google Cloud Storage. Similarly, SaaS enterprise platforms such as Office 365 and Google Workspace provide cloud-based document storage to users through services such as OneDrive and Google Drive, while SaaS application providers such as Slack, Confluence, Salesforce, and Dropbox may provide cloud storage solutions as a peripheral or primary use case of their platform. \n\nIn some cases, as with IaaS-based cloud storage, there exists no overarching application (such as SQL or Elasticsearch) with which to interact with the stored objects: instead, data from these solutions is retrieved directly though the Cloud API. In SaaS applications, adversaries may be able to collect this data directly from APIs or backend cloud storage objects, rather than through their front-end application or interface (i.e., Data from Information Repositories).","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1530\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52],{"slug":21,"title":22,"published_at":23},"shinyhunters-defy-fbi-after-fbijobsgov-breach-reframe-attack-as-marketing","ShinyHunters Defy FBI After FBIJobs.gov Breach, Reframe Attack as 'Marketing'","2026-09-30T12:22:21.479+00:00",{"slug":25,"title":26,"published_at":27},"ai-powered-ransomware-automates-azure-tenant-destruction","AI-Powered Ransomware Automates Azure Tenant Destruction","2026-09-28T18:20:53.034+00:00",{"slug":29,"title":30,"published_at":31},"passkey-phishing-and-ceo-impersonation-target-microsoft-cloud-accounts","Passkey Phishing and CEO Impersonation Target Microsoft Cloud Accounts","2026-09-13T12:20:25.042+00:00",{"slug":33,"title":34,"published_at":35},"passkey-themed-phishing-hijacks-cloud-identities-and-mfa-sessions","Passkey-Themed Phishing Hijacks Cloud Identities and MFA Sessions","2026-09-09T20:20:58.799+00:00",{"slug":37,"title":38,"published_at":39},"vishing-campaign-hijacks-entra-passkey-enrollment-to-compromise-m365-accounts","Vishing Campaign Hijacks Entra Passkey Enrollment to Compromise M365 Accounts","2026-07-08T18:21:07.366+00:00",{"slug":41,"title":42,"published_at":43},"russian-hackers-phish-signal-whatsapp-accounts-of-us-officials","Russian Hackers Phish Signal & WhatsApp Accounts of U.S. Officials","2026-06-29T16:20:18.848+00:00",{"slug":45,"title":46,"published_at":47},"russian-hackers-target-signal-backup-keys-via-social-engineering","Russian Hackers Target Signal Backup Keys via Social Engineering","2026-06-26T20:20:43.516+00:00",{"slug":49,"title":50,"published_at":51},"oauth-token-abuse-in-third-party-app-enables-salesforce-data-exfiltration","OAuth Token Abuse in Third-Party App Enables Salesforce Data Exfiltration","2026-06-23T22:21:03.358+00:00",{"slug":53,"title":54,"published_at":55},"shinyhunters-claims-22m-kodak-records-stolen-in-ransomware-style-breach","ShinyHunters Claims 2.2M Kodak Records Stolen in Ransomware-Style Breach","2026-06-18T08:20:17.673+00:00",[57,62,66,71,76,81],{"slug":58,"name":59,"problem":60,"stories":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",5,{"slug":63,"name":64,"problem":65,"stories":61},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":67,"name":68,"problem":69,"stories":70},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,{"slug":72,"name":73,"problem":74,"stories":75},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",3,{"slug":77,"name":78,"problem":79,"stories":80},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",2,{"slug":82,"name":83,"problem":84,"stories":85},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",1,[87,93,99,105,109,113,118,122],{"family":88,"item":89,"code":90,"title":91,"together":92},"nist-800-53","ac-2","AC-2","Account Management",8,{"family":94,"item":95,"code":96,"title":97,"together":98},"cis","6","Control 6","Access Control Management",7,{"family":100,"item":101,"code":102,"title":103,"together":104},"gdpr","32","Article 32","Security of processing",6,{"family":88,"item":106,"code":107,"title":108,"together":104},"si-4","SI-4","System Monitoring",{"family":94,"item":110,"code":111,"title":112,"together":61},"14","Control 14","Security Awareness and Skills Training",{"family":114,"item":115,"code":116,"title":117,"together":61},"nist-sp","800-63","SP 800-63","SP 800-63: Digital Identity Guidelines",{"family":100,"item":119,"code":120,"title":121,"together":61},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":94,"item":123,"code":124,"title":125,"together":70},"3","Control 3","Data Protection"]