Recent reports from Google Cloud Security and Mandiant indicate a significant acceleration in the exploitation of cloud-based vulnerabilities, driven by the integration of artificial intelligence and automated operational models.

Google Cloud Security 與 Mandiant 的最新報告指出，在人工智慧與自動化操作模式的推動下，雲端漏洞被利用的速度顯著加快。

The temporal window between the disclosure of vulnerabilities and their subsequent mass exploitation has undergone a substantial contraction, shifting from a duration of weeks to mere days. This acceleration is exemplified by the React2Shell vulnerability, where exploitation commenced within 48 hours of public notification. While core cloud infrastructures remain resilient, threat actors—including state-sponsored entities such as UNC4899—increasingly target unpatched third-party code and supply chain dependencies to establish network footholds. The utilization of AI-assisted Integrated Development Environments (IDEs) and automated reconnaissance tools has further optimized the efficiency of these incursions.

漏洞披露與隨後的大規模利用之間的時間窗大幅縮短，從數週縮減至僅僅數日。React2Shell 漏洞便是典型例子，在公開通知後 48 小時內便開始被利用。雖然核心雲端基礎設施仍保持韌性，但威脅參與者（包括如 UNC4899 等國家級支持實體）日益將目標對準未修補的第三方代碼與供應鏈依賴，以建立網路據點。AI 輔助整合開發環境 (IDE) 與自動化偵查工具的利用，進一步優化了這些入侵的效率。

Operational methodologies have shifted toward a specialized division of labor. Initial access is frequently secured via low-impact vectors, with the subsequent hand-off to specialized operators now occurring in an average of 22 seconds. Furthermore, there is a discernible transition from brute-force credential attacks toward the exploitation of identity frameworks. This includes voice-based social engineering (vishing), the compromise of trusted third-party relationships, and the misuse of non-human identities. The high-tech and financial sectors remain the primary targets, with espionage groups prioritizing prolonged dwell times—averaging 122 days—to ensure stealthy persistence.

操作方法已轉向專業化分工。最初的存取通常透過低影響向量獲取，隨後交付給專業操作員的時間平均僅需 22 秒。此外，攻擊方式明顯從暴力破解憑證轉向利用身份框架。這包括語音社交工程 (vishing)、利用受信任的第三方關係以及濫用非人類身份。高科技與金融部門仍是主要目標，間諜組織優先考慮延長潛伏時間（平均 122 天），以確保隱蔽的持久性。

Concurrent with these threats is the emergence of destructive ransomware tactics designed to preclude recovery. By targeting virtualization storage layers and deleting backup objects from cloud storage, adversaries are effectively neutralizing traditional disaster recovery protocols. Despite these advancements, Mandiant posits that the majority of successful breaches are still predicated on fundamental systemic and human failures rather than AI-driven autonomy alone. However, the increasing use of platform-agnostic cloud storage for data exfiltration by malicious insiders underscores a critical vulnerability in internal data governance.

與這些威脅同步出現的是旨在防止恢復的破壞性勒索軟體策略。透過針對虛擬化儲存層並刪除雲端儲存中的備份物件，對手有效地使傳統的災難復原協定失效。儘管有這些進展，Mandiant 認為大多數成功的入侵仍基於基礎系統與人為失誤，而非單純由 AI 驅動的自動化。然而，內部惡意人員日益增加地使用平台無關的雲端儲存來外洩數據，凸顯了內部數據治理的關鍵漏洞。

The current security landscape is characterized by a machine-versus-machine conflict where identity has replaced traditional network perimeters as the primary point of failure.

目前的安全性概況以「機器對機器」的衝突為特徵，身份已取代傳統的網路周邊，成為主要的失效點。