ETS
Home
Created by Claudiu Tabac - © 2026
This material is open for educational and research use. Commercial use without explicit permission from the author is not allowed.
Category 6 Cloud & SaaS Lateral Movement
Identity-driven pivoting across cloud platforms, SaaS environments, automation systems, and integration layers—representing the most sophisticated and overlooked breach techniques in modern enterprises.
What This Category Represents
Cloud & SaaS Lateral Movement captures how attackers exploit identity-driven trust relationships to pivot horizontally across interconnected platforms. In modern enterprises, cloud and SaaS ecosystems form vast identity universes where breach in one system cascades into many others.
This category reveals how attackers weaponize the invisible connective tissue between platforms—the APIs, tokens, federation paths, and automation identities that enable seamless integration but also create high-risk attack surfaces.
cloud network
Cross-Platform Pivoting
Hop from one cloud to another through compromised identities and trust paths
api integration
Integration Exploitation
Weaponize SaaS connectors and API relationships for privilege escalation
Core Attack Techniques
SaaS Integration Abuse
Leverage OAuth apps, SCIM agents, and connectors holding admin-level permissions to pivot between platforms
Machine Identity Weaponization
Exploit service principals, CI/CD pipelines, and automation identities controlling thousands of resources
Cross-Cloud Role Assumption
Traverse SAML, OIDC, and federation trust links to escalate privileges across cloud environments
API Token Pivoting
Turn compromised API keys into multi-platform access vectors through chained trust relationships
Attacker Goals & Impact
Primary Objectives
Cross-Platform Privilege Escalation
Move from low-privilege access in one system to administrative control across multiple connected platforms
Workload & Service Impersonation
Assume the identity of trusted automation systems, CI/CD pipelines, and service accounts with extensive permissions
Multi-System Data Exfiltration
Exploit integration paths to access and extract sensitive data from numerous interconnected business systems simultaneously
10x
Attack Surface Expansion
Single identity compromise multiplies across connected platforms
72h
Average Dwell Time
Before cross-platform lateral movement is detected
Included Breach Patterns
Each pattern represents a distinct technique for identity-driven lateral movement across cloud and SaaS ecosystems. These patterns are used in combination by sophisticated threat actors to achieve multi-platform compromise.
1
Cloud Storage-Based Lateral Expansion
Exploiting object storage permissions to pivot across cloud boundaries
2
SaaS Role Expansion via OAuth App Misuse
Weaponizing OAuth applications to escalate privileges across integrated SaaS platforms
3
CI/CD Identity Integration Pivot
Compromising continuous integration pipelines to access production environments
4
Machine Identity Privilege Drift
Exploiting non-human identity expansion and over-privileged service accounts
5
Compromised API Keys → Multi-SaaS Pivot
Chaining API key access across interconnected SaaS applications
Additional Critical Patterns
connector security
SaaS-to-Cloud Connector Takeover
Compromising identity connectors linking SaaS applications to cloud infrastructure for privilege escalation
federation security
Cross-Cloud Federation Pivoting
Exploiting misconfigured SAML and OIDC trust relationships to move between cloud providers
provisioning security
SCIM Provisioning Exploitation
Abusing identity provisioning protocols to create unauthorized accounts across platforms
integration token
SaaS-to-SaaS Integration Token Abuse
Weaponizing inter-application tokens to traverse SaaS ecosystem boundaries
data exfiltration
Cross-Cloud Identity Pivot → Data Exfiltration
Chaining identity compromises for large-scale multi-platform data theft operations
Threat Landscape & Key Insights
Active Threat Actors
  • State-sponsored APT groups targeting cloud infrastructure
  • Supply-chain threat actors exploiting CI/CD pipelines
  • Ransomware-as-a-service operators seeking multi-platform access
  • Credential-stealer botnets automating cross-platform pivots
  • Insider threat groups abusing legitimate integration paths
  • Cloud-native adversaries specializing in SaaS exploitation
Critical Understanding Points

Modern lateral movement has fundamentally changed. It's no longer about machine-to-machine pivoting—it's about identity jumping across entire universes of interconnected platforms.
Cloud environments function as interconnected identity ecosystems where a single compromised machine identity can control thousands of resources. OAuth apps, connectors, and SCIM agents represent high-risk identity conduits that defenders must prioritize.
These breach patterns consistently result in cross-cloud misconfiguration exploitation, stealthy privilege escalation, sophisticated SaaS-to-cloud-to-SaaS identity pivoting, unauthorized access to critical business systems, and large-scale data exfiltration operations.
Understanding the New Attack Surface
1
2
3
4
5
1
One Identity Compromise
2
Integration Token Access
3
Cross-Platform Pivoting
4
Multi-System Administrative Control
5
Enterprise-Wide Compromise
This category helps security teams understand how "one compromised identity" cascades into "multi-platform compromise" through the invisible trust relationships connecting modern cloud and SaaS ecosystems. Defending against these patterns requires visibility into identity relationships that span organizational boundaries.
About
Created by Claudiu Tabac — © 2026
This framework is open for educational and research use. Commercial use without explicit permission from the author is not allowed.
Navigation