T1578 Modify Cloud Compute Infrastructure

Activity timeline

T1578 first appeared in tracked threats on 2026-02-02 and was most recently reported on 2026-09-05. The busiest month was 2026-06 with 6 reports, and 15 of the 15 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1578 Modify Cloud Compute Infrastructure is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix. Threadlinqs maps 15 of 2623 tracked threats (0.6%) to it; by severity that is 6 critical, 8 high, 1 medium.

Threats that use T1578 most often also use T1685 Disable or Modify Tools (10 threats), T1078 Valid Accounts (9 threats), T1580 Cloud Infrastructure Discovery (9 threats), T1552 Unsecured Credentials (8 threats), T1070 Indicator Removal (7 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

21 tracked threat actors appear in the threats that use T1578; the most frequent are ALPHV (1), APT29 (1), APT33 (1), APT38 (1), APT43 (1).

Mitigations

MITRE ATT&CK lists 2 mitigations for T1578.

• M1018 User Account Management
• M1047 Audit

Data sources

Telemetry that can reveal T1578, per MITRE ATT&CK.

• Cloud Service — Cloud Service Metadata
• Instance — Instance Creation, Instance Deletion, Instance Metadata, Instance Modification, Instance Start, Instance Stop
• Snapshot — Snapshot Creation, Snapshot Deletion, Snapshot Metadata, Snapshot Modification
• Volume — Volume Creation, Volume Deletion, Volume Metadata, Volume Modification

Threat actors using it

• ALPHV 1
• APT29 1
• APT33 1
• APT38 1
• APT43 1
• BlackCat 1
• Bling Libra 1
• Kimsuky 1
• Lazarus Group 1
• STORM-0501 1
• Scattered LAPSUS$ Hunters 1
• Scattered Spider 1

Tracked threats

15 tracked threats use T1578.

• Frontier AI Agents Compress Full Enterprise Intrusion Chain into Under 10 Hours (Unit 42 Investigation)high2026-09-05
• Spirals Ransomware Targets South Asian IT Services Firm via IIS Web Shell, Chisel Tunneling, and Sub-24-Hour…high2026-07-17
• Lone Attacker Uses AI-Assisted Workflows to Breach Large AWS Cloud Environment in 72 Hours (Sygnia…high2026-07-10
• Cisco Catalyst SD-WAN Manager Zero-Day Exploitation Chain (CVE-2026-20245, CVE-2026-20127, CVE-2026-20182)critical2026-07-02
• macOS.Gaslight - Rust Backdoor with AI-Analysis Evasion & Prompt Injectioncritical2026-06-28
• Kali365/Octopi365 Device Code Phishing-as-a-Service Campaigncritical2026-06-28
• Cloud Bucket Hijacking — Global Namespace Risk: Silent Data-Stream Redirection via Statically-Named Storage…critical2026-06-27
• Global Namespace Bucket Hijacking: Universal Cloud Data Exfiltration via Storage Bucket Name Reclamation…high2026-06-22
• Mastra NPM Packages Trojanized with Malicious Dependency Injection - 116 Packages Compromisedcritical2026-06-17
• Azure Blob Storage Ransomware: Four Storage-Encryption Abuse Methods (BlackCat/ALPHV, STORM-0501)high2026-06-15
• ROADtools Misuse in Cloud Intrusions — Nation-State Abuse of the Open-Source Entra ID Offensive Toolkit…high2026-05-22
• ShinyHunters Evolves TTPs: Vishing and Login Harvesting for SSO/MFA Bypasshigh2026-02-03
• White House Revokes Biden-Era Software Security Memorandumsmedium2026-02-03
• CVE-2026-25253: OpenClaw One-Click RCE via Malicious Linkcritical2026-02-03
• OpenClaw CVE-2026-25253: One-Click RCE via Token Exfiltrationhigh2026-02-02

Related CVEs

CVEs referenced by the tracked threats that use T1578, most frequent first.

• CVE-2026-25253
• CVE-2026-20127
• CVE-2026-20182
• CVE-2026-20245

Detection coverage

Threadlinqs maintains 10 detection rules mapped to T1578 (SPL 4, KQL 2, Sigma 4). Rule content is available to Blue tier accounts and above; this page shows counts only.

Sub-techniques

• T1578.001 Create Snapshot — 0 tracked threats
• T1578.002 Create Cloud Instance — 0 tracked threats
• T1578.003 Delete Cloud Instance — 0 tracked threats
• T1578.004 Revert Cloud Instance — 0 tracked threats
• T1578.005 Modify Cloud Compute Configurations — 1 tracked threat