New Bucket Hijacking Attack Silently Redirects Cloud Data to Attacker-Controlled Storage

A newly disclosed Bucket Hijacking technique could allow attackers to secretly redirect cloud data streams into storage buckets they control, creating a serious risk for organizations operating in multi-cloud environments. Although researchers have not yet observed active exploitation, they warn that the attack is difficult to detect and could expose sensitive operational data for extended periods.

The technique affects major cloud platforms, including Google Cloud, Amazon Web Services (AWS), and Microsoft Azure. Security researchers have already notified all affected vendors through responsible disclosure.

How the Bucket Hijacking Attack Works

The attack takes advantage of how cloud providers manage storage bucket names. Since bucket names must be globally unique within each provider, many cloud services identify storage destinations solely by name rather than by verifying the bucket owner’s identity.

If an attacker gains sufficient permissions inside a compromised cloud environment, they can:

Delete an organization’s active storage bucket.
Recreate a new bucket with the identical name under their own account.
Allow existing logging, replication, or telemetry services to continue sending data automatically to the malicious bucket.

As a result, audit logs, monitoring data, backups, and other sensitive information may be redirected without requiring any additional changes to cloud configurations.

Why the Threat Is Difficult to Detect

One of the most concerning aspects of Bucket Hijacking is its stealth.

Because existing cloud services continue functioning normally after the bucket is recreated, administrators may see no configuration errors or security alerts. Data pipelines appear healthy while confidential information is silently transferred to infrastructure controlled by an attacker.

Researchers demonstrated the technique across multiple cloud services, including:

Google Cloud: Cloud Logging sinks, Pub/Sub storage destinations, and Storage Transfer Service jobs.
AWS: S3 replication workflows and Amazon Data Firehose pipelines.
Microsoft Azure: Azure Monitor diagnostic exports across subscriptions within the same tenant.

Enterprise Permissions Increase Risk

Researchers noted that many organizations assign broad storage administration roles to administrators or automation accounts. Unfortunately, these permissions often include bucket deletion privileges, making exploitation significantly easier if an attacker compromises an account.

In some environments, deleting a storage bucket requires fewer privileges than modifying the associated logging or replication configuration. Consequently, attackers can reroute data without directly altering security settings.

How Organizations Can Reduce Exposure

Security teams should immediately review storage administration policies and strengthen monitoring capabilities. Recommended defenses include:

Restrict bucket deletion permissions using the principle of least privilege.
Enable organizational controls that prevent data from being written outside trusted cloud environments.
Generate high-priority alerts whenever storage buckets are deleted.
Where supported, use provider features that bind bucket ownership more tightly to specific accounts or regions.

Industry Impact

The discovery highlights a broader challenge affecting modern cloud infrastructure. Similar architectural design choices across cloud providers can create security weaknesses that extend beyond a single platform.

Although no confirmed attacks have been linked to this method, Bucket Hijacking demonstrates how a seemingly routine administrative action can become a powerful persistence technique. Organizations relying on cloud-based logging, telemetry, and automated data pipelines should review their storage permissions and monitoring controls before attackers begin weaponizing the technique.