HOW ADVERSARIES EXPLOIT UNMONITORED CLOUD REGIONS TO EVADE DETECTION

Summary from the TLDR InfoSec newsletter

Attackers commonly exploit unused regions in cloud providers to launch crypto miners, exfiltrate data, or deploy other payloads. This post explores the various methods and permissions that attackers can utilize in AWS, GCP, and Azure to enumerate or enable unused regions. This post also provides recommended mitigations such as restricting region usage, setting budget alerts, and conducting regular audits.