An attack scenario affecting cloud providers could allow an attacker to implant persistent backdoors for data theft into bare-metal cloud servers. This opens the door to a wide array of attacks on businesses that use infrastructure-as-a-service (IaaS) offerings. An attack vector consists of the use of a known vulnerability in hardware and a weakness in the reclamation process Reclamation is part of the way bare metal cloud infrastructure is managed; it s a shared pool of resources that get re-assigned to different users.
Source: https://threatpost.com/cloudborne-iaas-attack-cloud/142223/