You expect the guardians at the gate of any system to keep attacks out; you don’t expect them to turn against internal systems and networks and ravage those on behalf of threat actors. Yet that’s what happened with cloud servers: they turned against internal systems.
In March 2025, Server-Side Request Forgery (SSRF) attacks targeting cloud servers allowed attackers to send unauthorized, forged requests from vulnerable servers to internal systems, according to a blog post by threat intelligence firm GreyNoise. The attackers accessed internal systems and sensitive data, potentially compromising the entire network and the broader cloud ecosystem.
According to the GreyNoise blog, the coordinated SSRF attacks used 400 unique Internet Protocol (IP) addresses to exploit a dozen different SSRF vulnerabilities simultaneously. IP addresses offer logical destination points for Internet and network traffic.
According to Jason Miller, founder and chief executive officer of BitLyft, a managed security service provider, the attack patterns suggest sophisticated cybercriminal organizations or state-sponsored actors due to the scale (the hundreds of IPs involved), coordination, and targeting of critical infrastructure in cloud environments across multiple countries. Said Miller, “Their motivations could include financial gain (e.g., data theft or ransomware), espionage (accessing internal systems), or disruption of critical services.”
The threat actors remain unidentified.
The vulnerabilities
The vulnerabilities existed in applications and platforms running on the cloud servers. The exploitation targeted critical flaws in platforms such as Zimbra Collaboration Suite, VMware Workspace ONE UEM, VMware vCenter, GitLab, DotNetNuke, and Ivanti Connect Secure, according to Chandrasekhar Bilugu, chief technology officer at SureShield Inc., a cybersecurity company focused on automated continuous security, compliance, and integrity.
The Zimbra Collaboration Suite is a business email and collaboration platform. VMware Workspace ONE UEM manages and secures devices like phones and laptops and apps for businesses. VMware vCenter controls and monitors virtual machines and servers. GitLab is a software development and collaboration platform. DotNetNuke is a web content management system. Ivanti Connect Secure provides VPNs with secure remote access.
Based on the common vulnerabilities and exposures (CVEs) in the GreyNoise blog, which detail the nature of the vulnerabilities in the given platforms, there were flaws such as poor URL checking, weak server settings, and misuse of web protocols.
Poor URL checking means the apps didn’t properly verify Web addresses given by users; in this case, the attackers. The weak server settings did not block requests to internal networks. Misuse of Web protocols happened as attackers exploited how servers interpret different types of web addresses.
Orchestration, automation, and intelligence gathering
According to Siri Varma Vegiraju, security tech lead, Microsoft Azure security, Microsoft, the attack scope (the 400 IPs) indicates the use of automation. Typical SSRF attacks require only a small number of people to carry out, Vegiraju said.
Orchestration means they coordinated multiple automated attacks across various vulnerabilities and systems, maximizing the effects while masking the attackers’ identity using structured, simultaneous exploitation. The attackers’ search for credentials like usernames and passwords confirms intelligence gathering.
“At this point, because the attackers have gathered information on all the high-value targets, they could move laterally within the network, targeting VMs, databases, and other resources for further exploitation,” said Vegiraju. VMs are virtual machines, software versions of computers that run inside another computer.
The attacks targeted internal metadata APIs. Vegiraju said that metadata APIs and servers are essential in managing cloud resources. Metadata APIs let systems access information about settings and resources in the cloud, including network addresses or URLs.
According to Vegiraju, these endpoints are accessible only from the machine itself and expose sensitive credentials, which posed a significant security risk, making it a goldmine for attackers. Endpoints are specific URLs or network locations provided by the metadata API that allow access to sensitive information.
How SSRF attacks affect the cloud
According to BitLyft’s Miller, cloud credentials in the compromised metadata APIs can enable attackers to exfiltrate data, steal more credentials, and disrupt cloud services.
Databases are one example of data at risk, and demonstrate why the risk is so significant. Said Vegiraju, “In cloud environments, databases exposed through HTTP endpoints may not be properly secured. The reasoning behind this is that these endpoints are not exposed to the outside world, so it is assumed that no one can access them. However, using an SSRF attack, an attacker can call the database endpoint from within a VM inside the virtual private cloud (VPC) and extract all the data.”
An HTTP endpoint is a URL or link that serves as an access point for interacting with a Web application or API. A virtual private cloud (VPC) is a logically-isolated network segment within a public cloud.
Countries targeted by SSRF
The SSRF attacks targeted the U.S., Germany, Singapore, India, Lithuania, Japan, and Israel. According to Miller, threat actors likely attacked these countries for economic, technical, and geopolitical reasons.
“The U.S., Germany, and Singapore are global economic hubs with extensive cloud adoption, ripe for financial exploitation (e.g., ransomware or data theft). India’s booming IT sector and Singapore’s role as a digital gateway offer abundant targets—tech firms, startups, and cloud-hosted services. Lithuania, near Russia, might indicate state-sponsored actors probing NATO-aligned regions for espionage or disruption,” said Miller.
Organizations struggle to patch SSRF vulnerabilities
There are reasons that organizations struggle to patch SSRF vulnerabilities, according to Solomon Gifford, vice president, North America, managed services and global head of practice, managed services at Valiantys, an Atlassian platinum solution provider and consultancy.
According to Gifford, many businesses use outdated APIs that are inherently vulnerable. Meanwhile, many developers don’t fully understand SSRF risks, leading to poor input validation and URL handling in applications. Also threat actors are constantly refining their techniques, making it difficult for security teams to keep up, said Gifford.
Software developers use input validation to ensure their software checks user-provided data. URL handling processes and validates URLs, such as links.
Businesses need to mount a defense
The Forum of Incident Response and Security Teams (FIRST) 2025 Vulnerability Forecast expects another record-breaking year of CVE (vulnerability) production, including 41-50k new vulnerabilities in the 2025 calendar year. The attack surface, the vulnerable areas, are growing all the time.
Businesses of all sizes can build defenses for these vulnerabilities. According to Vegiraju, numerous tools are available that gather telemetry information from cloud instances, reporting vulnerabilities at critical, high, medium, and low levels. Vegiraju said it is crucial to address critical and high-level vulnerabilities as quickly as possible.
Telemetry data equips remote systems to analyze and monitor resources such as cloud instances. FIRST manages the common vulnerability scoring system (CVSS), which scores vulnerabilities as being of critical, high, medium, or low severity.
Additionally, according to Vegiraju, it is essential for firms to adopt a zero-trust approach, segment network access, and ensure that communication to every endpoint has both authentication (AuthN) and authorization (AuthZ) enabled.
Zero Trust means the network trusts nothing by default, and everything must be verified before access is allowed. Segmenting network access divides a network into smaller sections to limit unauthorized access and prevent threats from spreading across the whole network. Authentication confirms who or what wants access. Authorization determines what they can do if they do connect.
“Finally, ensure that none of the internal endpoints, or those exposing sensitive information, are directly exposed to the Internet. Services like API Gateways can be used to protect them,” Vegiraju said.
API gateways manage API requests, acting as a single entry point, routing the requests, enforcing security policies, and optimizing communication between the APIs and the device or application requesting service.
David Geer is a journalist who focuses on issues related to cybersecurity. He writes from Cleveland, OH, USA.
Join the Discussion (0)
Become a Member or Sign In to Post a Comment