Threat actors may establish persistence by hijacking cloud-native event triggers. Attackers may manipulate Cloud Event Rules (e.g., EventBridge, Azure Event Grid) to trigger malicious serverless functions or containers in response to standard mission events—such as Satellite Contact Finished, Data Delivered. This ensures malicious code executes automatically during normal mission operations.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.