TTPwire Vol. 1 · MITRE ATT&CK·Tagged

← All stories

Bishop Fox

Introducing CloudFox GCP: Attack Path Identification for Google Cloud

2026-02-26 · Read original ↗

ATT&CK techniques detected

13 predictions
T1525Implant Internal Image
91%
“introducing cloudfox gcp : attack path identification for google cloud tl ; dr : cloudfox gcp extends cloudfox ’ s offensive security methodology to google cloud platform, enabling practitioners to enumerate cloud resources, map identity permissions, and identify service account …”
T1525Implant Internal Image
86%
“when foxmapper data is available, cloudfox gcp ' s privesc, lateral - movement, and data - exfiltration modules leverage its graph analysis to surface actionable attack paths with ready - to - use exploitation commands. cloudfox gcp capabilities cloudfox gcp launches with 64 modu…”
T1525Implant Internal Image
79%
“foundation of gcp security, and understanding who can do what and where is critical. the iam module suite provides deep visibility into gcp ’ s permission model across the entire organization. for advanced privilege escalation analysis, cloudfox integrates with foxmapper, a soon …”
T1525Implant Internal Image
75%
“##bilities. they chain multiple misconfigurations together. cloudfox gcp helps you see your environment the way an attacker would, identifying the combination of permissions and access that creates real risk. key security patterns cloudfox gcp detects to make these relationships …”
T1525Implant Internal Image
70%
“misconfigured access controls. - autom8 cryptomining campaign ( 2021 ) : attackers exploited misconfigured gcp instances and gke clusters to deploy cryptomining operations, leveraging default metadata service configurations to pivot across cloud resources. these incidents share c…”
T1525Implant Internal Image
70%
“gcp network topology is essential for identifying these paths before attackers do. attack path analysis individually, the findings above provide critical visibility. together, they reveal actionable attack paths. cloudfox gcp ' s attack path modules combine direct resource enumer…”
T1525Implant Internal Image
68%
“structure ( organization → folders → projects → resources ) creates inheritance patterns that can lead to unexpected permission propagation. a single overly permissive iam binding at the organization level can affect thousands of resources across hundreds of projects. a few speci…”
T1525Implant Internal Image
65%
“with network exposure and service account risks. why this matters : the 2023 microsoft ai researcher incident, where 38tb of sensitive data was exposed through misconfigured cloud storage linked to ai development environments, highlights the risks of compute and storage integrati…”
T1526Cloud Service Discovery
62%
“the cloudfox community cloudfox is open source and community driven. we welcome contributions, feedback, and collaboration : - github : github. com / bishopfox / cloudfox - report issues, submit pull requests, and star the project - documentation : cloudfox wiki - comprehensive g…”
T1525Implant Internal Image
42%
“to production without triggering project - boundary alerts cloudfox detection : the lateral - movement module combines direct resource enumeration ( compute instances, cloud functions, cloud run, gke ) with foxmapper ' s permission analysis to map these cross - project paths and …”
T1526Cloud Service Discovery
33%
“every module answers a specific question an attacker or security assessor would ask : - “ what can this compromised service account actually do? ” - “ which storage buckets are publicly accessible? ” - “ can i escalate privileges from this starting point? ” - “ what lateral movem…”
T1613Container and Resource Discovery
33%
“risk that can lead to full organizational compromise. - workload identity misconfigurations : detect kubernetes service accounts bound to overly permissive gcp service accounts. why this matters : in the 2021 solarwinds attack aftermath, security researchers found that compromise…”
T1525Implant Internal Image
30%
“risk that can lead to full organizational compromise. - workload identity misconfigurations : detect kubernetes service accounts bound to overly permissive gcp service accounts. why this matters : in the 2021 solarwinds attack aftermath, security researchers found that compromise…”

Summary

Meet CloudFox GCP, an offensive security tool built to map identities, enumerate resources, and uncover real attack paths in Google Cloud. Designed for practitioners, it exposes privilege escalation, lateral movement, and data exfiltration risks so you can secure GCP before attackers exploit it.