AWS, Azure, and GCP allow Snapshots to be made of the Volumes backing running Instances. These Snapshots can be converted into new Volumes and attached to new Instances then mounted without authentication to plunder for databases, password hashes, or intelectual property, all without ever accessing the orginal instance. This is the ShadowCopy attack for the world of Cloud. Old attacks made new. This is CloudCopy, your one stop shop for stealing cloud compute volumes using only credentials and low level permissions. In this talk I show how using only access tokens and minimal permissions you can extract the volume, mount it to a new isntance and extract its juicy contents. I will also be releasing a tool to automate the whole process and discussing what mitigations you can put in place to stop this from happening.