FlagThis - Latest Cybersecurity News

Universal Bucket Hijacking exploits the globally unique namespace requirement of Cloud Service Providers (CSPs) such as AWS and GCP. When organizations delete storage buckets but retain "dangling references" in application code, IaC templates, or client-side binaries, attackers can register the identical bucket name. This redirects sensitive data streams—including server logs, user uploads, and backups—directly to attacker-controlled endpoints. Because the traffic is directed toward legitimate CSP domains via HTTPS, the exfiltration bypasses traditional WAF and IDS/IPS detection, leading to critical confidentiality loss and potential supply chain compromise via malicious asset injection.