Cloud Service Hijacking

{
  "id": "ATTACK:enterprise:T1496.004",
  "title": "Cloud Service Hijacking",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1496/004",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--924d273c-be0d-4d8d-af58-2dddb15ef1e2",
  "external_id": "T1496.004",
  "domain": "enterprise",
  "created": "2024-09-25T14:05:59.910Z",
  "modified": "2025-04-15T22:03:40.356Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [
    "impact"
  ],
  "source_references": [
    {
      "source_name": "SentinelLabs SNS Sender 2024",
      "url": "https://www.sentinelone.com/labs/sns-sender-active-campaigns-unleash-messaging-spam-through-the-cloud/"
    },
    {
      "source_name": "Invictus IR DangerDev 2024",
      "url": "https://www.invictus-ir.com/news/the-curious-case-of-dangerdev-protonmail-me"
    },
    {
      "source_name": "Lacework LLMJacking 2024",
      "url": "https://www.lacework.com/blog/detecting-ai-resource-hijacking-with-composite-alerts"
    },
    {
      "source_name": "Sysdig LLMJacking 2024",
      "url": "https://sysdig.com/blog/llmjacking-stolen-cloud-credentials-used-in-new-ai-attack/"
    },
    {
      "source_name": "Permiso SES Abuse 2023",
      "url": "https://permiso.io/blog/s/aws-ses-pionage-detecting-ses-abuse/"
    }
  ]
}