* [Blog](https://origin-researchcenter.paloaltonetworks.com/blog)
* [Palo Alto Networks](https://origin-researchcenter.paloaltonetworks.com/blog/corporate/)
* [Cloud Infrastructure Entitlement Management](https://origin-researchcenter.paloaltonetworks.com/blog/cloud-security/category/cloud-infrastructure-entitlement-management/)
* Containers, Assemble: Wha...

# Containers, Assemble: What Cloud Threat Actors Don't Want You to Know

[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Forigin-researchcenter.paloaltonetworks.com%2Fblog%2F2022%2F06%2Fcloud-threat-actors%2F)  
[](https://twitter.com/share?text=Containers%2C+Assemble%3A+What+Cloud+Threat+Actors+Don%E2%80%99t+Want+You+to+Know&url=https%3A%2F%2Forigin-researchcenter.paloaltonetworks.com%2Fblog%2F2022%2F06%2Fcloud-threat-actors%2F)  
[](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Forigin-researchcenter.paloaltonetworks.com%2Fblog%2F2022%2F06%2Fcloud-threat-actors%2F&title=Containers%2C+Assemble%3A+What+Cloud+Threat+Actors+Don%E2%80%99t+Want+You+to+Know&summary=&source=)  
[](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://origin-researchcenter.paloaltonetworks.com/blog/2022/06/cloud-threat-actors/&ts=markdown)  
\[\](mailto:?subject=Containers, Assemble: What Cloud Threat Actors Don’t Want You to Know)  
Link copied  
By [Aimee Savran](https://www.paloaltonetworks.com/blog/author/asavran/?ts=markdown "Posts by Aimee Savran")  
Jun 06, 2022  
7 minutes  
[Cloud Infrastructure Entitlement Management](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-infrastructure-entitlement-management/?ts=markdown)  
[Cloud Native Application Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-native-application-platform/?ts=markdown)  
[Cloud Workload Protection Platform](https://www.paloaltonetworks.com/blog/cloud-security/category/cloud-workload-protection-platform/?ts=markdown)  
[Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown)  
[Cloud Threat Report](https://www.paloaltonetworks.com/blog/tag/cloud-threat-report/?ts=markdown)  
[CNAPP](https://www.paloaltonetworks.com/blog/tag/cnapp/?ts=markdown)  
[threat research](https://www.paloaltonetworks.com/blog/tag/threat-research/?ts=markdown)  
[Unit 42](https://www.paloaltonetworks.com/blog/tag/unit-42/?ts=markdown)

This post is also available in: [日本語 (Japanese)](https://origin-researchcenter.paloaltonetworks.com/blog/2022/06/cloud-threat-actors/?lang=ja "Switch to Japanese(日本語)")

It's like the snap of a familiar set of fingers wearing the gauntlet embedded with infinity stones. One moment, your cloud environment is untouched, containers, apps and data all right where they should be. The next, someone else is in control of what still exists and how it's going to be used.

While it might sound dramatic to compare threat actors infiltrating your cloud environment to Thanos from the Marvel Cinematic Universe snapping his fingers to wipe out half of the universe, what both scenarios have in common is someone else deciding your fate. In a business setting, just like in the Marvel movies, this can have [ripple-effect consequences that can be threatening to your organization](https://unit42.paloaltonetworks.com/apache-log4j-vulnerability-cve-2021-44228/) and the rest of the world. No matter how small or large an organization's cloud footprint may be, the more that attackers realize what's possible in a cloud environment, the bolder they become -- and the more dangerous to our interconnected world.

Now, all hope is not lost. It's not as if we just let Thanos live in the Garden peacefully (in other words, walking away without consequences). While we can't rewind time by taking the infinity stones for ourselves, we can change our approach to cloud security with a prevention-first security strategy.

## First Things First: Learn Who Targets Cloud Native Infrastructure

Malicious actors who threaten your organization's cybersecurity have historically done so by compromising systems and devices within an organization's physical location. With the rise of hosting infrastructure within cloud service platforms (CSPs) and cloud native container platforms, attackers are modifying their tactics, techniques and procedures (TTPs) in order to compromise cloud infrastructure.

As a result, a new classification of threat actors has emerged, labeled by Unit 42 as "cloud threat actors." Unit 42 defines a cloud threat actor as *an individual or group posing a threat to organizations through directed and sustained access to their cloud platform resources, services or embedded metadata*.

While cloud threat actors follow the same overall operational workflow as traditional threat actors, cloud threat actors have evolved their TTPs to a level of sophistication that enables them to potentially modify, create or delete cloud environment resources. Let's dive into some of the details of who these cloud threat actors are and what they have in common with each other.

## Unit 42's Industry-First Cloud Threat Actor Index

To assist in defending against the growing threat of cloud threat actors, Unit 42 researchers created an industry-first Cloud Threat Actor Index, which charts the specific operations performed by threat groups who target cloud infrastructure.

The data found in the Cloud Threat Actor Index follows the [MITRE ATT\&CK® cloud](https://attack.mitre.org/matrices/enterprise/cloud/) and [container](https://attack.mitre.org/matrices/enterprise/containers/) matrices, giving security professionals a common framework around which to communicate and discuss the TTPs employed by these threat actors. The Cloud Threat Actor Index also employs the [Unit 42 ATOM](https://unit42.paloaltonetworks.com/atoms/) service to provide security professionals with all of the known indicators of compromise (IoCs) used by the cloud threat actors packaged within the industry standard STIX/TAXII format. This format allows for easy integration with cloud security tools and platforms.

The groups highlighted in the Cloud Threat Actor Index all directly target cloud service platforms. Going a step further, once they bypass traditional security defenses, they are able to gain an initial foothold within the compromised organization's cloud infrastructure.

In the following section, we will explore one of the top five cloud threat actors targeting the cloud (this cloud threat actor can also be found in the index). We will then follow that example by explaining how these groups could be prevented from being able to execute at least two of their TTPs.

## WatchDog: The Stealer

A description of [WatchDog](https://unit42.paloaltonetworks.com/atoms/watchdog/) and their TTPs from the Cloud Threat Actor Index can be found below:

"WatchDog is a cloud-focused threat group that has a history of [cryptojacking](https://www.paloaltonetworks.com/cyberpedia/threat-brief-browser-cryptocurrency-mining) operations as well as cloud service platform credential scraping. They were first known to operate on Jan. 27, 2019. They use a variety of custom-built Go Scripts as well as repurposed cryptojacking scripts from other groups, including TeamTNT. They are currently considered to be an opportunistic threat group that targets exposed cloud instances and applications."
![WatchDog Cloud Threat Actor TTPs charted in Unit 42’s Cloud Threat Report, Volume 6. Chart includes TTPs related to execution, privilege escalation, defense evasion, credential access and discovery. Red backgrounds denote TTPs specific to cloud platforms, whereas the green background denotes TTPs that are container-platform specific. TTPs in red font denote operations that can lead to the wider compromise of cloud infrastructure.](https://www.paloaltonetworks.com/blog/wp-content/uploads/2022/06/word-image-12.png)
Figure 1. WatchDog Cloud Threat Actor TTPs charted in Unit 42's Cloud Threat Report, Volume 6.

In the chart above, the red background denotes TTPs specific to cloud platforms, whereas the green background denotes TTPs that are container-platform specific. TTPs in red font denote operations that can lead to the wider compromise of cloud infrastructure.

As shown in the chart, there are several TTPs WatchDog employs that are container-specific and even allow for the possibility of [container escape](https://unit42.paloaltonetworks.com/siloscape/). Interestingly, these techniques can occur across any stage of the operational workflow -- from execution all the way through to discovery.

## Container Security: The Iron Man to a Modern Thanos

Dr. Strange only saw one possible outcome to defeating Thanos once and for all, which involved Iron Man sacrificing his own life; similarly we see one way (and only one) to ensure that cloud threat actors are unable to perform container-specific and container escape/resource-specific TTPs. And that one way would be through container security. Luckily, proper container security can be achieved through best practices -- no heroes need sacrifice their lives.

By ensuring that your organization has purpose-built security that addresses vulnerability management, compliance, runtime protection and network security requirements for containerized applications, you are putting into place a prevention strategy that keeps you protected all the way from build to runtime and everything in between.

If you're curious what to look for, this informational article provides insight into what a [full lifecycle container security solution](https://www.paloaltonetworks.com/blog/prisma-cloud/what-is-container-scanning-a-top-requirement-for-container-security/) should have.

## Why You Need a Cloud Native Application Protection Platform (Cue the Avengers Theme Song)

So Dr. Strange and Iron Man have helped make sure your containers can't be targeted by Thanos, but what about all those other TTPs just waiting to be put to malicious use to infiltrate your cloud infrastructure some other way? That's where the rest of the Avengers come in, and we all know that the team together is more powerful than any hero working alone.

When all the Marvel heroes work together: from Dr. Strange and Iron Man, to Captain America and Spider Man, to Black Widow and Hawkeye and the rest of the Avengers, Thanos doesn't stand a chance. In the same way, when your organization deploys full lifecycle cloud security, neither does WatchDog or [any other cloud threat actor](https://unit42.paloaltonetworks.com/category/cloud/).

For that reason, it is essential to assemble your own arsenal of defenses against these cloud threat actor groups, who are looking for any way to infiltrate your organization and take control of it. The best way to do that would be to employ a [cloud native application protection platform (CNAPP)](https://www.paloaltonetworks.com/blog/prisma-cloud/get-to-know-cloud-native-application-protection-platforms/).

With a CNAPP, you have the equivalent of every infinity stone and Avenger on your side: cloud code security, cloud security posture management (CSPM), cloud workload protection (CWPP), cloud network security (CNS) and cloud identity security. Sure, all of these capabilities are powerful on their own, but when your organization brings them together, cloud threat actors will be rendered powerless.

## Get Your Copy of Unit 42's Cloud Threat Actor Index

In Unit 42's latest Cloud Threat Report, "[IAM The First Line of Defense](https://www.paloaltonetworks.com/prisma/unit42-cloud-threat-research-volume-six)," cloud threat researchers provide five cloud threat actor TTPs charts. They also dive into how proper identity and access management can be your first line of defense in protecting against being targeted by cloud threat actors. Finally, Unit 42 researchers provide in-depth recommendations for getting started on protecting your organization today, including how to deploy CNAPP suite integration, how to harden IAM permissions and how to increase security automation.

[Download the Unit 42 Cloud Threat Report, Volume 6, now](https://start.paloaltonetworks.com/unit-42-cloud-threat-report-volume-6.html) and learn how you can get started with implementing a Cloud Native Application Protection Platform that combines key defenses like a team of heroes and keeps your organization secure from code to cloud.

P.S. Want to learn about the research and recommendations directly from the experts? Watch our [LinkedIn Live event](https://www.linkedin.com/video/live/urn:li:activity:6942853103457112064/) on-demand now!

*** ** * ** ***

## Related Blogs

### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [News and Events](https://www.paloaltonetworks.com/blog/security-operations/category/news-and-events/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown)

[#### Cortex Cloud --- Unified Efficiency, Now with Dual FedRAMP Authority](https://origin-researchcenter.paloaltonetworks.com/blog/2025/05/cortex-cloud-dual-fedramp-authority/)

### [Cloud Security](https://www.paloaltonetworks.com/blog/category/cloud-security/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Predictions](https://www.paloaltonetworks.com/blog/category/predictions/?ts=markdown)

[#### Forecasting the 2025 Cloudscape](https://origin-researchcenter.paloaltonetworks.com/blog/2024/12/forecasting-the-2025-cloudscape/)

### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Company \& Culture](https://www.paloaltonetworks.com/blog/category/company-culture/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown)

[#### More on the PAN-OS CVE-2024-3400](https://origin-researchcenter.paloaltonetworks.com/blog/2024/04/more-on-the-pan-os-cve/)

### [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [Unit 42](https://www.paloaltonetworks.com/blog/category/unit42/?ts=markdown)

[#### 2023 Unit 42 Attack Surface Threat Report Highlights the Need for ASM](https://origin-researchcenter.paloaltonetworks.com/blog/2023/09/attack-surface-threat-report-highlights-need-for-asm/)

### [Announcement](https://www.paloaltonetworks.com/blog/category/announcement/?ts=markdown), [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown)

[#### We Can't Do It Alone: Sharing Threat Intelligence Makes Everyone Safer](https://origin-researchcenter.paloaltonetworks.com/blog/2023/06/sharing-threat-intelligence/)

### [Must-Read Articles](https://www.paloaltonetworks.com/blog/security-operations/category/must-read-articles/?ts=markdown), [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown)

[#### Learning From the Past --- Ten 2022 Cybersecurity Events to Know](https://origin-researchcenter.paloaltonetworks.com/blog/2022/12/unit42-cybersecurity-events-2022/)

### Subscribe to the Blog!

Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
![spinner](https://origin-researchcenter.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up  
Please enter a valid email.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.  
This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.  
{#footer} {#footer}

## Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)

* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)

* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)

## Company

* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)

## Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language