Serverless
Serverless infrastructure is like renting a small, temporary workspace in a massive, busy office building owned by a tech giant. Because the workspace is inside a trusted building, it is hard for security guards to tell if the person inside is a legitimate employee or an intruder, making it an ideal place for attackers to hide their activities.
Serverless refers to the use of ephemeral, cloud-managed execution environments—such as AWS Lambda or Cloudflare Workers—to host malicious logic. By routing command-and-control traffic through these provider-owned subdomains, adversaries effectively mask their origin, bypass domain-based filtering, and evade Content Security Policy (CSP) restrictions that would otherwise block connections to unauthorized external servers.
Serverless infrastructure denotes the deployment of code within managed, multi-tenant runtime environments that abstract underlying server provisioning. Adversaries exploit this architecture to achieve infrastructure obfuscation, leveraging the high reputation and shared IP space of cloud providers to facilitate command-and-control (C2) communication. This technique enables the circumvention of egress filtering and Content Security Policy (CSP) directives by masquerading malicious traffic as legitimate requests to trusted cloud-native endpoints, thereby complicating attribution and forensic analysis.