Cyber Criminals Exploiting Google Drive, OneDrive to Hide Malicious Traffic

Threat actors are actively modifying their TTPs to counter the advanced security mechanisms and tools to accomplish their illicit goals for several malicious purposes.

Hiding malicious traffic on cloud storage platforms is not an entirely new concept, and threat actors are shifting toward this concept.

Security researchers at Insikt recently identified that hackers actively exploit popular and trusted cloud platforms to hide malicious traffic.

Hiding Malicious Traffic

This strategy boosts data theft efficiency and weakens the security mechanisms and defense implemented. In the case of exploitation of this approach, the APT groups take the lead, and the less advanced groups take the second lead.

This type of exploitation by hackers shows how robust, adaptable defense strategies and security mechanisms are needed to mitigate such evolving attacks.

In the report shared with Cyber Security News, researchers noted that limited reporting delays the exact trend analysis. However, the following key things suggest a rising trend in LIS abuse:-

• Well-known malware’s LIS (Legitimate Internet Services) abuse
• New strain adoption
• APT innovation

Besides this, shifting threat tactics reduce the IOC blocking and efficacy of the basic detections. But, the solution for an effective defense system, the following things have to be performed:-

• Multi-method approach (network, file, log detection)
• Proactive Internet service assessment
• Attack simulations

Security analysts analyzed more than 400 malware families, and they identified the following data:- 

• Use of LIS (25%)
• Use of multiple LIS (68.5%)
• Use of Infostealers (37%)

Most abused cloud platforms:-

• Google Drive
• OneDrive

Most abused messaging apps:-

• Telegram
• Discord

For robust defense, properly learning about all the legitimate and malicious service usage is one of the key factors for comprehensive detection and security.

Recommendations

Here below, we have mentioned all the provided recommendations:-

• Properly understand service contexts for lasting security.
• Make sure to enhance nuanced detection.
• Implement TLS interception for visibility.
• Make sure to flag the malicious LIS usage.
• Deploy proactive threat-hunting techniques.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.