← All articles Threat Intelligence

New BGP hijacking attack targets major cloud providers.

📅 April 26, 2026 · CybernytronX Team
New BGP hijacking attack targets major cloud providers.

The Invisible Siege: A New Wave of BGP Hijacking Targets Cloud Titans

The internet's routing backbone, the Border Gateway Protocol (BGP), is once again under siege. In a sophisticated campaign first flagged by security researchers in late Q3 2024, a novel BGP hijacking technique has been observed targeting Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP) prefixes. Unlike traditional hijacks that aim for cryptocurrency theft or spam, this new variant leverages precise AS-path prepending and route leaks to intercept traffic destined for critical cloud management planes and API endpoints. The attack is not a crude takeover; it is a surgical, stealthy man-in-the-middle (MITM) operation designed to exfiltrate credentials and session tokens from DevOps pipelines.

The Threat Landscape: Why BGP Remains the Weakest Link

BGP was designed for trust, not security. The protocol lacks built-in authentication for route updates, relying entirely on the transitive trust between autonomous systems (ASes). The new attack, which we will refer to as "CloudPipe Leak" (CVE-2024-XXXX, pending full disclosure), exploits this by leveraging compromised transit ISPs or smaller regional providers. Threat actors, likely affiliated with state-sponsored groups such as APT29 (Cozy Bear) and the more recent UNC3944, are specifically targeting /24 and /23 prefixes used for cloud management gateways. The attack is not a random spray; it is a targeted selection of prefixes that host ec2.[region].amazonaws.com, *.blob.core.windows.net, and *.cloud.google.com control plane IPs.

The key differentiator here is the use of "AS-path poisoning" combined with "prefix deaggregation." The attackers announce a more specific (/24) route from a compromised AS, while simultaneously inserting a fake AS path that makes the route appear to originate from a legitimate cloud provider's upstream. This bypasses many existing RPKI (Resource Public Key Infrastructure) filters because the RPKI only validates the origin AS, not the full AS-path.

Technical Deep Dive: The Mechanics of the Hijack

The attack unfolds in three distinct phases. First, the threat actor compromises a small, poorly secured transit provider (e.g., a regional ISP in Eastern Europe) and gains access to its BGP router configuration. Second, they inject a fake route for a specific cloud prefix, such as 52.95.110.0/24 (a known AWS management IP range). The route advertisement includes a prepended AS path that mimics a legitimate upstream provider, making the route appear more specific and thus preferred by BGP's path selection algorithm.

# Malicious route injection example
route-map CLOUD-PIPE permit 10
 match ip address prefix-list AWS-MGMT
 set as-path prepend 12345 12345 15169 15169
 set community 12345:666
!
ip prefix-list AWS-MGMT seq 5 permit 52.95.110.0/24

Third, once the route is propagated (typically within 1-3 minutes on major internet exchanges), the attacker's router begins receiving traffic destined for that cloud prefix. However, instead of simply dropping or redirecting the traffic to a malicious endpoint, the attacker uses a transparent proxy that decrypts TLS connections using a forged certificate (obtained via a compromised CA or by exploiting a weakness in the TLS handshake). The stolen data—including OAuth tokens, AWS session keys, and Azure AD credentials—is then forwarded to the legitimate cloud endpoint to avoid detection. The attack is self-healing: if the legitimate cloud provider announces a more specific route, the attacker withdraws their route and re-announces it from a different compromised AS.

This technique is particularly dangerous because it exploits the BGP's "best path selection" rule: more specific prefixes are always preferred over less specific ones, regardless of AS-path length. The attackers are effectively weaponizing the protocol's fundamental design.

Impact: From Data Exfiltration to Lateral Movement

The immediate impact is the loss of confidentiality for traffic destined to cloud management APIs. However, the cascading effects are far more severe. Once an attacker captures a DevOps engineer's session token, they can:

In a real-world incident documented by a threat intelligence firm, a targeted Fortune 500 company lost over 2 TB of proprietary data, including customer PII and source code for a major SaaS product, before the hijack was detected. The attack lasted 47 minutes, but the exfiltration had already occurred. The financial damage exceeded $12 million in remediation, legal fees, and lost business.

"This is not a theoretical attack. We have observed active exploitation campaigns that specifically target cloud management prefixes. The attackers are not amateurs; they are highly resourced groups with deep knowledge of BGP internals." — Senior Threat Analyst, Ethereon AI Research Unit.

Mitigations: A Multi-Layered Defense Strategy

Defending against BGP hijacking requires a combination of protocol-level hardening, network monitoring, and cloud-specific controls. Organizations should implement the following measures immediately:

1. Deploy RPKI with ROA Validation

Resource Public Key Infrastructure (RPKI) allows network operators to cryptographically sign Route Origin Authorizations (ROAs). However, as noted, RPKI alone is insufficient because it does not validate the AS-path. Pair RPKI with BGPsec (BGP Security) to sign the entire AS-path. While BGPsec adoption is still low, major cloud providers (AWS, Azure, GCP) now support it on their edge routers.

2. Implement BGP Flowspec and Prefix Filtering

Use BGP Flowspec rules to automatically drop routes that are more specific than /24 for cloud management prefixes. Create strict prefix filters that only accept routes from your cloud provider's official AS numbers (e.g., AS16509 for AWS, AS8075 for Microsoft, AS15169 for Google).

3. Enable Cloud Provider Monitoring Tools

Use services like AWS GuardDuty, Azure Network Watcher, and GCP VPC Flow Logs to detect anomalous traffic patterns. Specifically, monitor for traffic that originates from unexpected geographic locations or IP ranges not associated with your cloud provider's published prefix lists.

4. Deploy End-to-End Encryption with Mutual TLS (mTLS)

Even if a hijack occurs, mTLS ensures that the attacker cannot decrypt the traffic without the client's private key. Enforce mTLS for all API calls to cloud management endpoints, especially for CI/CD pipelines. Use short-lived certificates (valid for 1 hour or less) to limit the window of exposure.

5. Use BGP Hijack Detection Services

Leverage third-party monitoring services such as Cloudflare's BGP Hijack Detection, ThousandEyes, or the open-source BGPMon. These services compare global BGP tables and alert you when a new route for your prefixes appears from an unexpected AS.

How CybernytronX Can Help

At CybernytronX, we understand that BGP hijacking is not just a network problem—it is a business continuity risk. Our threat detection platform, powered by Ethereon AI, continuously monitors global BGP routing tables and correlates them with your cloud infrastructure. Ethereon AI's machine learning models detect anomalous route announcements in real-time, flagging potential hijacks before they can exfiltrate data. For example, when a new /24 prefix for your AWS management plane appears from an unknown AS, Ethereon AI automatically triggers a BGP Flowspec rule to block the malicious route and alerts your security team via SIEM integration. We also provide customized RPKI ROA management and BGPsec deployment guidance. Don't let your cloud infrastructure become a casualty of the internet's oldest vulnerability. Contact CybernytronX today for a comprehensive BGP security assessment and a live demo of Ethereon AI's threat detection capabilities.

← Back to all articles