Thomas, a cloud security professional, is performing security assessment on cloud services to identify any loopholes. He detects a vulnerability in a bare-metal cloud server that can enable hackers to

Man-in-the-cloud (MITC) attacks abuse legitimate cloud synchronization token mechanisms such as those used by OneDrive or Dropbox to intercept data and maintain persistence, and are unrelated to bare-metal firmware backdoors.

Cloud cryptojacking involves unauthorized hijacking of a victim's cloud compute resources to mine cryptocurrency, not implanting firmware-level backdoors that persist through hardware reallocation.

The Cloudborne attack targets the baseboard management controller (BMC) or firmware layer of bare-metal cloud servers, where attackers can embed malicious backdoors that are not erased during standard server re-provisioning processes. Because firmware persists across operating system reinstalls and disk wipes, a new IaaS customer receiving the same physical hardware unknowingly inherits the compromised firmware. This hardware-level persistence across tenant boundaries is the defining characteristic of the Cloudborne attack vector.

Metadata spoofing attacks exploit cloud instance metadata endpoints such as AWS IMDSv1 to steal IAM credentials or tokens, not to implant persistent backdoors in bare-metal server firmware.