Google Cloud outlines targeted response to cyber threats

Google Cloud has outlined how it detects and contains emerging security threats across its cloud platform, with an approach focused on targeted intervention rather than broad service disruption.

The measures cover several attack patterns affecting cloud workloads, including abuse of AI services through stolen credentials, illicit cryptocurrency mining, exposed secrets harvested from public code repositories, and account takeover through phishing and session theft.

Attackers are increasingly seeking API keys and tokens linked to AI systems, where stolen credentials can be used for unauthorised activity and then traded through third-party marketplaces. Google Cloud says its teams look for anomalies in consumption rates, account standing, and access context to identify that activity.

Cryptomining remains another area of concern. Google Cloud does not inspect processes running inside customer virtual machines, but instead infers likely mining activity from infrastructure telemetry, such as unusual CPU and memory usage patterns and the rapid creation of virtual machines.

Exposed credentials continue to be a common route into cloud environments. Developers can accidentally publish secrets in public repositories, where automated tools can collect them quickly. Supply chain compromises affecting development environments or managed workloads can also lead to leaked access.

Account takeover presents a broader operational risk because intruders can gain administrative control and move across systems once inside. Google Cloud says adversary-in-the-middle techniques, including phishing and stolen session cookies, can allow attackers to establish persistence, move laterally, and misuse resources or extract data.

Containment measures

Its response model is designed to apply restrictions as narrowly as possible. In cases of suspected AI misuse or cryptomining, that means throttling traffic tied to malicious activity while allowing legitimate corporate usage to continue.

For more complex AI workloads, Google Cloud says its abuse and support teams work together to isolate and inspect specific traffic vectors. The aim is to separate suspicious calls from production activity without interrupting critical business operations.

Identity-based containment also forms part of the model. Google Cloud says it can apply localised controls across compromised user identities and Workspace domains to stop attackers moving between accounts and services.

Suspending a project is treated as a last resort and is used only when platform integrity or customer financial exposure is at serious risk. Such action is backed by an appeals process.

Google Cloud also pointed to work with public repository hosts to identify exposed credentials quickly. That includes secret-scanning arrangements intended to trigger warnings before credentials are exploited.

Logs and alerts

A large part of the strategy centres on notifying customers quickly when abuse is detected. Customers can use abuse event logging to review security and abuse notifications at the resource level over a 30-day period and feed that information into external security information and event management systems for automated response.

Critical incidents can also generate automated email notifications and support cases, creating a direct path for investigation and remediation. Audit logs and anomaly spending alerts are intended to help customers spot suspicious configuration changes or sudden increases in usage costs that may point to a compromised workload.

Maintaining accurate contact lists is another part of the process. Customers can set up designated contacts across security, billing, and operations so notifications reach the right people without delay.

Customer controls

Alongside its platform monitoring, Google Cloud set out several security measures it wants customers to adopt in their own environments. These include enforcing multi-factor authentication and two-step verification across user accounts and Workspace domains, and using device-bound session credentials to reduce the impact of stolen cookies.

Google Cloud also urged organisations to avoid embedding API keys in source code or public repositories, rotate keys regularly, and move towards keyless authentication where possible. It says service accounts and tokens should be treated as highly sensitive credentials.

Access controls remain another focus. Google Cloud recommended applying least-privilege policies through identity and access management tools, while using service perimeters and context-aware access rules to limit who can reach specific systems and data.

Billing alerts, contact reviews, and regular resource clean-up were also highlighted as practical steps to reduce exposure. Organisations should periodically remove dormant accounts, old billing arrangements, and unused resources, with particular attention to groups or service accounts holding elevated permissions.

Google Cloud said cloud security depends on a shared responsibility model in which platform providers and customers both play an active role in reducing risk. Maintaining resilience requires constant monitoring from the provider and consistent identity, credential, and access hygiene from customers.