Wednesday, November 13, 2024
HomeCyber AttackCyber Criminals Exploiting Google Drive, OneDrive to Hide Malicious Traffic

Cyber Criminals Exploiting Google Drive, OneDrive to Hide Malicious Traffic

Published on

Malware protection

Threat actors are actively modifying their TTPs to counter the advanced security mechanisms and tools to accomplish their illicit goals for several malicious purposes.

Hiding malicious traffic on cloud storage platforms is not an entirely new concept, and threat actors are shifting toward this concept.

Security researchers at Insikt recently identified that hackers actively exploit popular and trusted cloud platforms to hide malicious traffic.

- Advertisement - SIEM as a Service

Hiding Malicious Traffic

This strategy boosts data theft efficiency and weakens the security mechanisms and defense implemented. In the case of exploitation of this approach, the APT groups take the lead, and the less advanced groups take the second lead.

This type of exploitation by hackers shows how robust, adaptable defense strategies and security mechanisms are needed to mitigate such evolving attacks.

C2 infrastructure setup (Source – Insikt)

In the report shared with Cyber Security News, researchers noted that limited reporting delays the exact trend analysis. However, the following key things suggest a rising trend in LIS abuse:-

  • Well-known malware’s LIS (Legitimate Internet Services) abuse
  • New strain adoption
  • APT innovation

Besides this, shifting threat tactics reduce the IOC blocking and efficacy of the basic detections. But, the solution for an effective defense system, the following things have to be performed:-

  • Multi-method approach (network, file, log detection)
  • Proactive Internet service assessment
  • Attack simulations

Security analysts analyzed more than 400 malware families, and they identified the following data:- 

  • Use of LIS (25%)
  • Use of multiple LIS (68.5%)
  • Use of Infostealers (37%)

Most abused cloud platforms:-

  • Google Drive
  • OneDrive

Most abused messaging apps:-

  • Telegram
  • Discord

For robust defense, properly learning about all the legitimate and malicious service usage is one of the key factors for comprehensive detection and security.

Recommendations

Here below, we have mentioned all the provided recommendations:-

  • Properly understand service contexts for lasting security.
  • Make sure to enhance nuanced detection. 
  • Implement TLS interception for visibility.
  • Make sure to flag the malicious LIS usage.
  • Deploy proactive threat-hunting techniques.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

Thousands of EOL D-Link Routers Vulnerable to Password Change Attacks

In a critical security disclosure, it has been revealed that thousands of end-of-life (EOL)...

Crafting A Successful Crypto Investment Thesis: Strategies For Long-Term Growth 

Diving into the world of crypto investments has been one of the most exhilarating...

Understanding Crypto Macroeconomic Factors: Navigating Inflation, Rates, And Regulations 

Diving into the world of cryptocurrencies, I've found it's a fascinating intersection of technology...

Crypto Network Security: Essential Tips To Protect Your Digital Assets In 2023 

Exploring the world of cryptocurrencies has been a thrilling journey for me. The allure...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

Thousands of EOL D-Link Routers Vulnerable to Password Change Attacks

In a critical security disclosure, it has been revealed that thousands of end-of-life (EOL)...

VMware Workstation & Fusion Now Available for Free to All Users

VMware has announced that its popular desktop hypervisor products, VMware Workstation and VMware Fusion,...

Dell Enterprise SONiC Flaw Let Attackers Hijack the System

Dell Technologies has disclosed multiple critical security vulnerabilities in its Enterprise SONiC OS, which...