aol.pm

Data from Cloud Storage

Technique · ATTACK:enterprise:T1530

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:T1530",
  "title": "Data from Cloud Storage",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1530",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--3298ce88-1628-43b1-87d9-0b5336b193d7",
  "external_id": "T1530",
  "domain": "enterprise",
  "created": "2019-08-30T18:07:27.741Z",
  "modified": "2026-05-12T15:12:00.624Z",
  "version": "2.2",
  "aliases": [

  ],
  "tactics": [
    "collection"
  ],
  "source_references": [
    {
      "source_name": "Amazon S3 Security, 2019",
      "url": "https://aws.amazon.com/premiumsupport/knowledge-center/secure-s3-resources/"
    },
    {
      "source_name": "Microsoft Azure Storage Security, 2019",
      "url": "https://docs.microsoft.com/en-us/azure/storage/common/storage-security-guide"
    },
    {
      "source_name": "Wired Magecart S3 Buckets, 2019",
      "url": "https://www.wired.com/story/magecart-amazon-cloud-hacks/"
    },
    {
      "source_name": "Google Cloud Storage Best Practices, 2019",
      "url": "https://cloud.google.com/storage/docs/best-practices"
    },
    {
      "source_name": "HIPAA Journal S3 Breach, 2017",
      "url": "https://www.hipaajournal.com/47gb-medical-records-unsecured-amazon-s3-bucket/"
    },
    {
      "source_name": "Rclone-mega-extortion_05_2021",
      "url": "https://redcanary.com/blog/rclone-mega-extortion/"
    },
    {
      "source_name": "Trend Micro S3 Exposed PII, 2017",
      "url": "https://www.trendmicro.com/vinfo/us/security/news/virtualization-and-cloud/a-misconfigured-amazon-s3-exposed-almost-50-thousand-pii-in-australia"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--118c566e-2042-4566-99c2-308351d50a40

CISA AA20-259A Iran-Based Actor September 2020

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--22dfe85e-3eeb-4b0a-ac61-b80f70a1f092

Microsoft Azure Storage Security, 2019 · Amazon S3 Security, 2019 · Amazon AWS Temporary Security Credentials

ATTACK:enterprise:S0683 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2cf91706-674a-4ae0-8a4c-0d8d43eb6e1a

Peirates GitHub

ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35589283-3028-444b-94d1-9b64ae6d8487

Microsoft Storm-0501 Embargo Ransomware August 2025

ATTACK:enterprise:G1044 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42e7fe7a-6fa3-420f-8d07-435832813791

Mandiant APT42-charms · Mandiant APT42-untangling

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--441bf771-bc3a-43ba-bd84-7d77f82d5ab3

SOCRadar_ShinyHunters_Mar2024

ATTACK:enterprise:M1041 → mitigates → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--55fa32b7-b9d2-4c57-9614-b7793b2770f2

Amazon S3 Security, 2019 · Microsoft Azure Storage Security, 2019 · Google Cloud Encryption Key Rotation

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--594d644e-2c7e-48c1-90a8-aedf5918333d

CERT Polska

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5afc74e6-789b-4402-89d2-cc7be1994cf5

Microsoft Silk Typhoon MAR 2025

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--be61f77a-93a3-4699-b134-52b199c7b196

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c021a96d-e4f2-4bd7-b1eb-315c518f16ca

CISA Scattered Spider Advisory November 2023

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf63b75f-564f-4713-a5b3-1f102d098e8e

ATTACK:enterprise:S1091 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d4fa4797-aec0-419b-83d8-8b06ea3ac06d

GitHub Pacu

ATTACK:enterprise:C0027 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db315985-f1c1-4d7f-a154-c65351602680

Crowdstrike TELCO BPO Campaign December 2022

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3e50d39-fa69-4fca-9353-259247dbd439

Amazon S3 Security, 2019

ATTACK:enterprise:S0677 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8747d32-65e4-4a55-a5c8-e87136cc44da

AADInternals

ATTACK:enterprise:S9009 → uses → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee1effa5-b256-4a6a-b7da-2d9066d7dccd

Black Hills Information Security TruffleHog January 2024 · Github TruffleSecurity Trufflehog April 2025

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1530

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee3162ad-e88e-401c-9fdf-e7f0784141a4

Amazon S3 Security, 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.