INDUSTRY FACT FILE · CLOUD, DATA CENTRES & HOSTING

Threat Landscape: Top Cyber Threats Facing Cloud, Data Centre and Hosting Providers

The 18 most relevant cyber threats, attacks and industry challenges for cloud providers, colocation operators, managed hosting and VPS providers.

Infrastructure providers face attacks on the layers customers cannot see: hypervisors, management planes, out-of-band hardware management and facility systems. Their platforms are also abused by criminals renting servers to host phishing, malware and attack tools.

The ESXiArgs ransomware campaign of February 2023 encrypted thousands of internet-exposed hypervisors, and large outages—from a 2021 data centre fire in Strasbourg to the July 2024 faulty security-software update—showed how a single event can affect many customers at once.

The list below is a practical assessment framework, not a statistical ranking. Priority varies by business model, technology exposure and existing controls.

The matrix is a qualitative guide for prioritising the first round of security reviews.

Figure 5: Qualitative threat relevance by provider segment (Codec Networks assessment).

4.1 Hypervisor and management-plane attacks

Ransomware operators increasingly encrypt virtual machines at the hypervisor, bypassing guest-level security. Exposed or unpatched management interfaces are the usual entry point.

• Questions to test: Are management planes unreachable from the internet? Are hypervisors patched promptly? Are backups outside the hypervisor's administrative domain?
• Relevant services: virtualisation security review, management-plane VAPT, SOC monitoring, backup testing.

4.2 Out-of-band hardware management

BMC and IPMI interfaces give control below the operating system. Default credentials or shared networks allow firmware tampering and disk wiping.

• Questions to test: Is there a dedicated, isolated out-of-band network? Are BMC credentials unique and firmware current? Is BMC access logged?
• Relevant services: BMC and IPMI testing, firmware review, network segmentation review.

4.3 Platform abuse and subscriber records

Criminals rent servers with fake identities to host phishing and attack infrastructure. CERT-In requires providers to keep validated subscriber records for five years.

• Questions to test: Is customer identity verified at onboarding? Are records retained as required? Is abuse detected and acted on quickly?
• Relevant services: onboarding and records review, abuse-process assessment, SOC use cases.

4.4 Facility OT

Building management, cooling and power systems are often remotely supported by vendors. Manipulating them can cause physical outages across halls.

• Questions to test: Are BMS and facility OT segmented from corporate and customer networks? Is vendor remote access brokered and monitored?
• Relevant services: facility OT assessment, vendor access review, OT monitoring.

4.5 Detection and the 6-hour clock

CERT-In requires reporting within six hours of noticing an incident, and customers need rapid notice to protect their own workloads.

• Questions to test: Are management-plane, control-plane and facility logs monitored 24x7? Is there a multi-customer notification playbook?
• Relevant services: managed SOC, playbooks, tabletop exercises, IR retainer.

• CERT-In: incidents reported within six hours; providers must also keep logs, synchronise clocks and maintain subscriber records.
• Customers: SLAs and contracts trigger credits, notifications, audits and possible termination.
• Customer regulators: BFSI and insurance customers may need to report provider incidents to RBI, SEBI or IRDAI; empanelled services may face STQC or MeitY review.
• Privacy: customers as data fiduciaries must intimate personal data breaches once DPDP breach provisions commence in May 2027.
• Law enforcement: abuse cases bring requests for subscriber information.

• Are hypervisor and management interfaces unreachable from the internet?
• Is out-of-band management on an isolated network with unique credentials?
• Would backups survive an attacker with hypervisor admin rights?
• Are we meeting CERT-In's subscriber-record, logging and clock-synchronisation duties?
• Are facility BMS and power systems segmented and vendor access monitored?
• Could we report an incident to CERT-In within six hours and notify every affected customer?

Note: Threat descriptions and relevance ratings are general guidance, not findings about any specific organisation. Public incident references are summarised from widely reported events.