Casting Light on Shadow Cloud Deployments

The talk starts from a familiar pattern: cloud resources launched as proofs of concept, test copies or quick experiments that never receive logging, documentation or security review, then end up publicly reachable. Both speakers work in incident response, and they argue that such shadow deployments are a common starting point for attacks, from cryptojacking to exposed databases. The gap they describe is triage. Perimeter and pentesting tools do not answer the questions responders face when they need to scope an exposure quickly.

The speakers introduce Luminaut, an open-source scanner built for that first stage of an investigation. It enumerates public IP addresses in AWS and Google Cloud, gathers attached resources such as security groups and load balancers, and checks what is actually reachable using Nmap, WhatWeb and Shodan. It then pulls CloudTrail or GCP audit log events to build a timeline of when resources were created, changed or attached, which helps bound the exposure window. A live demo showed output in terminal, HTML, JSON and CSV formats, and the tool requires only read-only cloud roles.

The speakers were candid about limits. Shodan results can be stale, so findings need validating against live data. Azure is not yet supported, GCP allow listing is still in progress, and IAM privilege escalation is not covered. In audience questions, they said they had not seen attackers pivot from cloud into on-premises networks, though one case involved a Jenkins pivot across clouds. The takeaway: inventory public cloud resources early, anchor findings to a timeline, and check tool output before it goes into a report.