Latest / The Digital Warfare Podcast / Digital Warfare Podcast Daily Brief June 18, 2026
Transcript
- Digital Warfare: You're listening to the Digital Warfare Podcast. Today's brief is about the systems you built to detect attacks and how attackers are disabling them from the inside. Here is what happened. Palo Alto Networks Unit 42 has documented a growing pattern of threat actors weaponizing cloud logging services for two distinct purposes: defense evasion and persistent surveillance. The services themselves, AWS Cloud Trail, Google Cloud Logging, are designed as a critical security layer. Security teams rely on them to power SIEM, SOAR, and CSPM tools. When attackers gain sufficient permissions to those systems, they can manipulate the logs themselves. The attack patterns break into two categories. First, defense evasion. Attackers focus on disabling or tampering with logging mechanisms to avoid detection entirely. The most straightforward technique is stopping log collection entirely. In AWS, an adversary with Cloud Trail stop logging permissions can halt logging via API call. Instantly, monitoring systems go blind. In Google Cloud, the same effect happens through logging syncs, update permissions, complete visibility loss in seconds. A second evasion technique is deleting log storage destinations. An attacker with S3 delete bucket permissions can remove the Cloud Trail log bucket itself, erasing forensic evidence. Google Cloud log buckets enter a delayed deletion state, providing a limited recovery window, but that window is small. A more sophisticated approach involves encryption manipulation. By replacing legitimate AWS KMS keys with attacker-controlled keys and then revoking access, logs become unreadable or fail to be written entirely. Google Cloud supports the same attack through customer-managed encryption keys, effectively locking defenders out of their own logs. Log poisoning represents another technique. With object-level access, attackers can download, modify, and re-upload log files stored in S3, compromising data integrity and misleading incident response teams during post-breach investigation. But here is where this becomes truly dangerous: the second category. Beyond evasion, attackers are using cloud logging systems for persistent visibility. Instead of stopping logs or deleting them, They configure new log routing to send copies to attacker-controlled environments. In AWS, this means creating new cloud trail trails pointing to external S3 buckets. In Google Cloud, attackers abuse logging sinks to redirect logs. This runs silently in parallel to legitimate logging. Real-time activity data streams to threat actors, including IAM changes, VM deployments, data access events. They maintain ongoing insight into victim environments without raising immediate alarms. That is long-term surveillance infrastructure built on your own logging system. The impact is comprehensive. Stopping logging results in total monitoring failure. Log redirection enables covert persistence and strategic lateral movement. Encryption attacks destroy log integrity. Here is what you do now. First, restrict access to critical logging permissions, cloud trail update trail, logging.update. And all storage modifications should be assigned to highly privileged roles only. Not standard administrators, not service accounts with broad permissions. Second, enable integrity validation features. AWS Cloud Trail provides log file validation. Use it. AWS maintains a 90-day immutable event history for management actions. Google Cloud provides system-created log buckets that cannot be altered or deleted. Leverage those safeguards. Third, Treat log pipelines as critical infrastructure. Implement layered defenses. Monitor for API calls that disable logging or modify log destinations. Monitor for new cloud trail trails or logging sinks you did not create. Monitor for KMS key updates. Fourth, establish log delivery to a separate account or environment that attackers cannot touch if they compromise your primary infrastructure. The strategic lesson here is essential. Logging is not a passive record. It is an active defense layer. When you lose visibility, you lose control. Attackers understand this. They target logging systems not because logging is optional, but because it is foundational. If your cloud security posture treats logging as something you set once and forget, you have a visibility gap that threat actors are actively exploiting. This has been your Digital Warfare Daily Brief. Stay secure. We'll see you tomorrow.