Implant in zombie instance

Cloud Security

Implant in zombie instance is a persistence tactic used in cloud security to maintain unauthorized access to a compromised instance.
This technique involves planting malicious code or a backdoor into a compromised instance and using it as a "zombie" or "bot" to perform further malicious actions.
Once an instance is compromised, the attacker can implant a backdoor to ensure future access even if the original vulnerability is fixed or the stolen credentials are changed.
The implanted code can be designed to run persistently in the background, making it difficult to detect.
Attackers can use the zombie instance to perform various malicious actions, such as stealing sensitive data, launching DDoS attacks, or using the instance for cryptocurrency mining.

Where this idea came from

ATT&CK / AppSec analog

Cloud persistence analog of ATT&CK T1525 Implant Internal Image (backdoor on an instance that looks idle). Original YAML had no URL.

https://attack.mitre.org/techniques/T1525/

Mitigations

M1532 Implement least privilege access controls
M1550 Implement strict access control for clouds

Detections

D1510 Implement Intrusion Detection System and anti-malware

Identified, not yet observed here. This technique set includes behaviors from pentest research, defender guidance, and analog attacker behavior — not only from named public breaches. No incident in this corpus maps here yet.

References

https://attack.mitre.org/techniques/T1525/