The report said the actors usually gained access to Cloud accounts because of “poor customer security practices” or “vulnerable third-party software.”