Key takeaways

• AI is accelerating the time attackers need to exploit vulnerabilities, from weeks to just days.
• Most cloud attacks now target weak third-party software rather than core infrastructure.
• Businesses must adopt automated, AI-powered defenses to keep pace with evolving threats.

The debate over whether artificial intelligence delivers measurable benefits to most organizations continues, but one sector is unequivocally reaping massive productivity gains from the technology: cybercriminals. As businesses increasingly move operations to the cloud, attackers are leveraging AI to exploit vulnerabilities faster than ever before, making cloud environments a prime battleground.

This stark warning comes from Google’s March 2026 Cloud Threat Horizons Report, compiled by the company’s security investigators and engineers. Based on observations from the second half of 2025, the report concludes that “the window between vulnerability disclosure and mass exploitation collapsed by an order of magnitude, from weeks to days.” In other words, organizations now have only a handful of days to patch critical flaws before attackers weaponize them at scale.

The report also emphasizes that the most effective countermeasure is to fight AI-powered attacks with AI-augmented defenses. “This activity, along with AI-assisted attempts to probe targets for information and continued threat actor emphasis on data-focused theft, indicates that organizations should be turning to more automatic defenses,” the authors note.

Sneaking in through third-party code

According to Google’s findings, modern security threats are not targeting the core infrastructure of major cloud providers like Google Cloud, Amazon Web Services, or Microsoft Azure. Those high-value targets remain well secured. Instead, threat actors—a term that includes both criminal gangs and state-sponsored agents, notably from North Korea—focus on unpatched vulnerabilities in third-party code. This shift means that even companies using secure cloud platforms are at risk if they rely on external software components.

The report details several recent exploits, though victims are not named. One case involved the exploitation of a critical remote code execution vulnerability in React Server Components, a popular JavaScript library used for building user interfaces on websites and mobile apps. Attackers began exploiting this flaw (CVE-2025-55182, commonly called React2Shell) within 48 hours of its public disclosure. Another incident targeted an RCE vulnerability in the XWiki Platform (CVE-2025-24893), which allowed attackers to run arbitrary code on remote servers by sending a specific search string. Although the bug was patched in June 2024, the update was not widely deployed, enabling attackers—including crypto mining gangs—to exploit it starting in November 2025.

A particularly sophisticated attack involved a North Korean state-sponsored group, UNC4899, which targeted Kubernetes workloads to steal millions of dollars in cryptocurrency. The attack unfolded in a multi-step process: attackers lured a developer into downloading a malicious archive file under the guise of an open-source collaboration. The developer transferred the file from a personal device to a corporate workstation via Airdrop. Using an AI-assisted integrated development environment, the victim opened the archive, eventually executing embedded malicious Python code. That code spawned a binary masquerading as the Kubernetes command-line tool, which then connected to UNC4899-controlled domains, providing a backdoor into the corporate network.

Another example illustrates how quickly attackers can move: a compromised Node Package Manager (npm) package stole a developer’s GitHub token, used it to access Amazon Web Services, stole files from an S3 bucket, and then destroyed the originals—all within 72 hours. Such rapid chains of exploitation underscore the need for immediate defensive action.

Compromising identity

Beyond third-party code, Google’s report highlights a major shift in attack techniques. Instead of relying on brute-force attacks against weak credentials, threat actors are increasingly exploiting identity-related vulnerabilities through methods such as:

• Voice-based social engineering (vishing): 17% of cases.
• Email phishing: 12%.
• Compromised trusted relationships with third parties: 21%.
• Leveraging stolen human and non-human identities: 21%.
• Improperly configured application and infrastructure assets: 7%.

Additionally, the report warns about the growing threat of “malicious insiders”—employees, contractors, consultants, and interns—who exfiltrate confidential data using consumer-focused cloud storage services like Google Drive, Dropbox, Microsoft OneDrive, and Apple iCloud. This method, the report says, is “the most rapidly growing means of exfiltrating data from an organization.”

Worryingly, attackers are increasingly patient once inside a network. The report notes that “45% of intrusions resulted in data theft without immediate extortion attempts at the time of the engagement, and these were often characterized by prolonged dwell times and stealthy persistence.” This means businesses may not even realize they have been breached until significant damage has been done.

What can businesses do to protect themselves?

Google’s report includes specific recommendations for IT professionals, divided into advice for Google Cloud customers and general guidance for users of other platforms. For large organizations with dedicated security teams, those recommendations are invaluable. However, for small and medium-sized businesses (SMBs) that lack dedicated security expertise, there are four critical action items that can make a significant difference.

Step up your patching game – Ensure that all software applications, especially third-party components, are automatically updated. Manual patching cycles that take weeks are no longer viable. Automated patch management tools can help close vulnerabilities before attackers have time to exploit them. This includes not only operating systems but also libraries, frameworks, and cloud services.

Strengthen identity and access management (IAM) – Implement multi-factor authentication (MFA) everywhere possible. Enforce least-privilege principles so that users and services have only the permissions necessary to perform their tasks. Regularly review and revoke unused credentials, and monitor for unusual access patterns that could indicate compromised identities.

Monitor the network for unusual activity – Use tools that can detect anomalous data movement, both from external attacks and insider threats. This includes monitoring for unusually large file transfers, access to sensitive storage locations at odd hours, or connections to unfamiliar external IPs. AI-based security information and event management (SIEM) platforms can automate much of this analysis.

Have an incident response plan ready – The first few hours after a suspected breach are critical. Organizations need a pre-defined playbook that outlines who to contact, what steps to take for containment, and how to preserve evidence. Without a plan, scrambling to assemble resources can take days, giving attackers more time to cause damage. For businesses without in-house security expertise, partnering with a managed security service provider (MSSP) is a wise investment.

The landscape of cloud security has fundamentally changed. AI is not just a tool for defenders; it is equally powerful in the hands of attackers. By adopting automated defenses, prioritizing patching, securing identities, and preparing for incidents, businesses can reduce their risk and respond effectively when attacks occur. The time to act is now, before the next vulnerability disclosure triggers another wave of fast-moving exploits.

Source: ZDNET News