Tuesday, April 16, 2024

Cyber Criminals Exploiting Google Drive, OneDrive to Hide Malicious Traffic

Threat actors are actively modifying their TTPs to counter the advanced security mechanisms and tools to accomplish their illicit goals for several malicious purposes.

Hiding malicious traffic on cloud storage platforms is not an entirely new concept, and threat actors are shifting toward this concept.

Security researchers at Insikt recently identified that hackers actively exploit popular and trusted cloud platforms to hide malicious traffic.

Hiding Malicious Traffic

This strategy boosts data theft efficiency and weakens the security mechanisms and defense implemented. In the case of exploitation of this approach, the APT groups take the lead, and the less advanced groups take the second lead.

This type of exploitation by hackers shows how robust, adaptable defense strategies and security mechanisms are needed to mitigate such evolving attacks.

C2 infrastructure setup (Source – Insikt)

In the report shared with Cyber Security News, researchers noted that limited reporting delays the exact trend analysis. However, the following key things suggest a rising trend in LIS abuse:-

  • Well-known malware’s LIS (Legitimate Internet Services) abuse
  • New strain adoption
  • APT innovation

Besides this, shifting threat tactics reduce the IOC blocking and efficacy of the basic detections. But, the solution for an effective defense system, the following things have to be performed:-

  • Multi-method approach (network, file, log detection)
  • Proactive Internet service assessment
  • Attack simulations

Security analysts analyzed more than 400 malware families, and they identified the following data:- 

  • Use of LIS (25%)
  • Use of multiple LIS (68.5%)
  • Use of Infostealers (37%)

Most abused cloud platforms:-

  • Google Drive
  • OneDrive

Most abused messaging apps:-

  • Telegram
  • Discord

For robust defense, properly learning about all the legitimate and malicious service usage is one of the key factors for comprehensive detection and security.


Here below, we have mentioned all the provided recommendations:-

  • Properly understand service contexts for lasting security.
  • Make sure to enhance nuanced detection. 
  • Implement TLS interception for visibility.
  • Make sure to flag the malicious LIS usage.
  • Deploy proactive threat-hunting techniques.

Keep informed about the latest Cyber Security News by following us on Google NewsLinkedinTwitter, and Facebook.


Latest articles

Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide

Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent...

Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks

A new remote code execution vulnerability has been identified to be affecting multiple Microsoft...

LightSpy Hackers Indian Apple Device Users to Steal Sensitive Data

The revival of the LightSpy malware campaign has been observed, focusing on Indian Apple...

LightSpy Malware Attacking Android and iOS Users

A new malware known as LightSpy has been targeting Android and iOS users.This sophisticated...

This Startup Aims To Simplify End-to-End Cybersecurity, So Anyone Can Do It

The Web3 movement is going from strength to strength with every day that passes....

Alert! Palo Alto RCE Zero-day Vulnerability Actively Exploited in the Wild

In a recent security bulletin, Palo Alto Networks disclosed a critical vulnerability in its...

6-year-old Lighttpd Flaw Impacts Intel And Lenovo Servers

The software supply chain is filled with various challenges, such as untracked security vulnerabilities...
Tushar Subhra Dutta
Tushar Subhra Dutta
Tushar is a Cyber security content editor with a passion for creating captivating and informative content. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.

Top 3 SME Attack Vectors

Securing the Top 3 SME Attack Vectors

Cybercriminals are laying siege to small-to-medium enterprises (SMEs) across sectors. 73% of SMEs know they were breached in 2023. The real rate could be closer to 100%.

  • Stolen credentials
  • Phishing
  • Exploitation of vulnerabilities

Related Articles