Cyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
summary
Multiple APTs reuse legitimate cloud services as infrastructure: Patchwork drops encrypted configs on Feed43, GitHub, WordPress (one xml.xml pattern appears in 64 repositories), Confucius’ Swissknife uploads harvested files to Dropbox/pCloud using hardcoded API keys or credentials found in decompiled Python, TweetyChat receives AWS keys via Firebase to PUT to S3, MuddyWater’s CloudSTATS uses Dropbox .reg/.cmd/.res files with embedded API tokens, and SLUB runs commands via Gist and Slack, rotating Slack tokens split into strings and using file.io one‑time downloads. Monitoring recovered tokens yields actionable victim lists.
AI-written summary · about
chapters (9)
- 0:00Intro
- 1:08Outline
- 4:45APT Groups
- 5:35BadNews
- 8:10Swiss Knife
- 11:50Twitter Chat
- 13:38CloudStash
- 16:55Telegram
- 20:07File Denial
related talks
50mThe Anatomy of Cloud Attacks
39mReal-World Detection Evasion Techniques in the Cloud
33mCloud Hacking Scenarios
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry
53mAbusing Cloud Apps 101: Command and Control
18mSecuring cloud innovation: Lessons learned
50mInsights into New Supply Chain and Cloud-Identity Attacks
48mNine Cloud Security Reasons for Resting Breach Face