Friday, February 21, 2025
HomeCyber AttackCyber Criminals Exploiting Google Drive, OneDrive to Hide Malicious Traffic

Cyber Criminals Exploiting Google Drive, OneDrive to Hide Malicious Traffic

Published on

SIEM as a Service

Follow Us on Google News

Threat actors are actively modifying their TTPs to counter the advanced security mechanisms and tools to accomplish their illicit goals for several malicious purposes.

Hiding malicious traffic on cloud storage platforms is not an entirely new concept, and threat actors are shifting toward this concept.

Security researchers at Insikt recently identified that hackers actively exploit popular and trusted cloud platforms to hide malicious traffic.

Hiding Malicious Traffic

This strategy boosts data theft efficiency and weakens the security mechanisms and defense implemented. In the case of exploitation of this approach, the APT groups take the lead, and the less advanced groups take the second lead.

This type of exploitation by hackers shows how robust, adaptable defense strategies and security mechanisms are needed to mitigate such evolving attacks.

C2 infrastructure setup (Source – Insikt)

In the report shared with Cyber Security News, researchers noted that limited reporting delays the exact trend analysis. However, the following key things suggest a rising trend in LIS abuse:-

  • Well-known malware’s LIS (Legitimate Internet Services) abuse
  • New strain adoption
  • APT innovation

Besides this, shifting threat tactics reduce the IOC blocking and efficacy of the basic detections. But, the solution for an effective defense system, the following things have to be performed:-

  • Multi-method approach (network, file, log detection)
  • Proactive Internet service assessment
  • Attack simulations

Security analysts analyzed more than 400 malware families, and they identified the following data:- 

  • Use of LIS (25%)
  • Use of multiple LIS (68.5%)
  • Use of Infostealers (37%)

Most abused cloud platforms:-

  • Google Drive
  • OneDrive

Most abused messaging apps:-

  • Telegram
  • Discord

For robust defense, properly learning about all the legitimate and malicious service usage is one of the key factors for comprehensive detection and security.

Recommendations

Here below, we have mentioned all the provided recommendations:-

  • Properly understand service contexts for lasting security.
  • Make sure to enhance nuanced detection. 
  • Implement TLS interception for visibility.
  • Make sure to flag the malicious LIS usage.
  • Deploy proactive threat-hunting techniques.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.

Tushar Subhra
Tushar Subhra
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Latest articles

SPAWNCHIMERA Malware Exploits Ivanti Buffer Overflow Vulnerability by Applying a Critical Fix

In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer...

Sitevision Auto-Generated Password Vulnerability Lets Hackers Steal Signing Key

A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing...

NSA Allegedly Hacked Northwestern Polytechnical University, China Claims

Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a...

ACRStealer Malware Abuses Google Docs as C2 to Steal Login Credentials

The ACRStealer malware, an infostealer disguised as illegal software such as cracks and keygens,...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

SPAWNCHIMERA Malware Exploits Ivanti Buffer Overflow Vulnerability by Applying a Critical Fix

In a recent development, the SPAWNCHIMERA malware family has been identified exploiting the buffer...

Sitevision Auto-Generated Password Vulnerability Lets Hackers Steal Signing Key

A significant vulnerability in Sitevision CMS, versions 10.3.1 and earlier, has been identified, allowing...

NSA Allegedly Hacked Northwestern Polytechnical University, China Claims

Chinese cybersecurity entities have accused the U.S. National Security Agency (NSA) of orchestrating a...