Attacks are getting cloudy - Threat actors are exploiting the trust and capabilities we provide to cloud applications. In the past we saw Living off the Land attacks, now it is Living off the Cloud! In this session, we will dive into the techniques and demo these attacks as well as mitigation strategies. The session will cover how malware operators are now moving their entire infrastructure to cloud-based services (legit ones). I will demonstrate attacks that utilize legit cloud services and show how attackers exfiltrate data using these services. To be clear – these are NOT theoretical. I will be demoing the APT29 and APT41 attacks. I will also discuss a three-layer approach (e.g., strategic, operational, and tactical) to defend against these threats. Finally, I will also tie these attacks with LOL attacks and see how one can feed the other.