Abusing Cloud Apps 101: Command and Control
summary
Presents 23 reported cloud C2 incidents from Apr 2020–Apr 2022 with Dropbox 8 instances, OneDrive 5 and Google Drive 4, and real-world abuses by Molerats and Lazarus; builds working channels using Empire, C3 and Covenant by creating app tokens, listeners and payload relays that poll via encrypted uploaded files and commit results to repos, showing the technique works. Recommends blocking malware early, logging endpoints, flagging regular beaconing, and restricting or monitoring unused cloud apps and tokens.
AI-written summary · about
chapters (13)
- 0:00Start
- 4:27Cloud Command and Control (Cloud C2)
- 6:13MITRE ATT&CK
- 8:39Which cloud apps are abused?
- 14:02Features abused
- 16:43Tools used
- 18:34Real world example
- 19:45Attack Simulation using DropBox
- 28:51DropBox for C2: summary
- 32:12Attack Simulation using GitHub
- 38:27GitHub for C2: summary
- 42:26Defences
- 46:17Conclusion
related talks
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
46mLiving off the Cloud: A Server-Free Approach to Malware Ops
50mThe Anatomy of Cloud Attacks
18mSecuring cloud innovation: Lessons learned
33mCloud Hacking Scenarios
31mCloud Threat Landscape - 2021
54mCredential Sharing As A Service: The Dark Side Of No Code
37mShift left, shield right: Code-to-cloud strategy for securing apps