Spotting an attacker in GCP