Extreme TLDR: Attackers use Google Cloud Functions and service accounts to maintain access in cloud environments. They automate recovery of deleted accounts through logging and Pub/Sub events, leveraging these features for persistent access despite clean-up efforts.
Understanding Cloud Persistence: How Attackers Maintain Access Using Google Cloud Functions
