Murky Panda: How Cloud Trust Exploitation Enables Hacking of Downstream Customers

Understanding the evolving threat landscape

In the modern security landscape, attackers increasingly target the trust bridges that connect cloud service providers with their customers. A prominent state-sponsored group—known by several names in different ecosystems—has demonstrated a pattern of abusing these trusted relationships to slip from a provider into the networks and data of downstream organizations. Rather than slamming a fortress door, this adversary quietly rides on legitimate access channels, making detection far more challenging and boosting the impact of each intrusion.

Who is Murky Panda (Silk Typhoon) and why it matters

Active under multiple monikers, Murky Panda has built a track record of targeting government, technology, academic, legal, and professional services entities—primarily in North America. The group’s operations span high-profile breaches, including notable campaigns that leveraged widely used remote management tools and cloud services. Its emphasis on cloud-based intrusion demonstrates a shift from traditional on-premises breaches to exploiting the complex trust models that govern modern software-as-a-service (SaaS) ecosystems.

Exploiting trusted cloud relationships: the core tactic

So how does Murky Panda gain a foothold in downstream networks? The attacker chain typically begins with compromising internet-facing devices or services, then moving through trusted cloud relationships to reach customer environments. Two primary avenues are particularly effective:

Compromising cloud providers and their access: If a cloud provider or its administrators are breached, attackers can leverage built-in administrative access to pivot into customer environments. This is especially dangerous when the cloud provider has delegated permissions or service principals that enable cross-tenant operations.
Exploiting delegated admin privileges (DAP) and app registrations: By breaching an account with elevated rights in a service provider’s ecosystem, attackers can gain Global Administrator access across multiple downstream tenants, enabling backdoor creation and broad data access.

In some cases, attackers exploited zero-day and known vulnerabilities to break into SaaS environments, then retrieved authorizations or secrets that allowed them to impersonate legitimate services and log into customer networks. Once inside, they could read emails, access application data, and move laterally within the target environment.

Where the attacks land: vectors and tools

Murky Panda’s toolkit includes a mix of well-known web shells, custom malware, and remote-access capabilities designed to endure and escalate persistence. Notable techniques and components often observed in these campaigns include:

Web shells such as Neo-reGeorg and China Chopper, used to establish footholds on compromised servers and maintain covert access.
Linux-based RATs capable of covertly controlling infected devices and spreading through the network.
SOHO devices as proxies: Compromised home or small office devices are repurposed to anonymize traffic and help attackers blend in with legitimate activity.

Beyond tooling, the attackers demonstrate strong operational security, from timestamp manipulation to log deletion, complicating forensic investigations and prolonging their presence in affected environments.

Notable cloud-centric abuse patterns

A recurring theme is the abuse of trust models between cloud providers and downstream customers. In one prominent scenario, attackers leveraged a cloud provider’s application registrations and service identities to authenticate as a trusted service, enabling access to customer data. In another, compromised administrative accounts within a cloud solution provider granted broad privileges, letting attackers create backdoors and surveil email and application data across multiple tenants.

Experts emphasize that breaches via trusted relationships are rarer than credential theft, but they are especially perilous because they blend in with legitimate activity. The attackers’ stealthy approach can result in long dwell times, during which sensitive information can be exfiltrated and business operations disrupted.

Why this threat is acute for organizations

The risk isnifies for any entity relying heavily on cloud infrastructure, SaaS, and outsourced IT services. When a provider or a privileged account is compromised, the boundaries between vendor networks and client networks blur, making it harder to determine where an intrusion originated. This approach also enables rapid, wide-reaching access, potentially touching sensitive data across multiple customers in a single campaign.

Defensive guidance: how to reduce the risk

Defending against Murky Panda and similar cloud-trust abuse requires a multi-layered strategy that strengthens identity, access, and cloud controls while improving visibility across the entire supply chain. Key recommendations include:

: Enforce strong multi-factor authentication for all cloud-provider accounts, limit the use of privileged accounts, and apply just-in-time access wherever possible. Monitor for unusual service principal sign-ins and anomalous app registrations.
Improve cloud visibility and monitoring: Continuously audit Entra ID and other identity platforms for suspicious activity, unusual login patterns, and unexpected privilege escalations. Maintain a comprehensive log pipeline across cloud services and security information and event management (SIEM) systems.
Patch and harden cloud-facing infrastructure: Prioritize patching of remote management tools and VPN gateways. Implement network segmentation and strict access controls to limit lateral movement.
Adopt zero-trust principles: Treat every access request as untrusted until proven legitimate. Enforce least privilege, continuous verification, and device posture checks for every connection, whether from partners, providers, or internal users.
Supply-chain risk management: Vet cloud providers and their access configurations rigorously. Require strong governance around delegated administration, app registrations, and cross-tenant permissions. Regularly review third-party access and remove dormant accounts.
Defensive tooling and detection: Deploy web application firewalls and EDR capabilities that can identify web shells, abnormal data exfiltration patterns, and unusual administrator activity. Use threat intelligence to stay ahead of known toolsets linked to these campaigns.
Incident response planning: Develop and rehearse playbooks for cloud-compromise scenarios, including how to revoke provider credentials, rotate secrets, and isolate affected tenants without causing widespread disruption.

What organizations can do right now

Start with a cloud-first security assessment that maps every trusted relationship between your organization and its cloud providers. Identify high-risk configurations, such as service principals with excessive permissions or dormant admin accounts. Implement continuous monitoring and alerting for anomalies in cloud identity activity. Finally, prioritize staff training and tabletop exercises to ensure your security teams can respond quickly and coherently when unusual cloud activity is detected.

Conclusion: staying ahead of trusted-relationship risks

Cloud ecosystems bring remarkable capabilities but also introduce unique attack surfaces. Murky Panda’s campaigns demonstrate how credible access—when paired with lax governance and delayed detection—can yield profound consequences across multiple organizations. By tightening identity controls, improving visibility, and embracing zero-trust principles, organizations can reduce the likelihood of such breaches and shorten the time to detect and respond when suspicious activity emerges.

TechLogHub Blog

50+

10+

1K+

Want to explore more?

Stay in the Loop