New research by Palo Alto Networks Unit 42 found that Russian adversaries, including the Russian government-linked APT29 or Cozy Bear, are increasingly using trusted cloud storage services like DropBox and Google Drive to deliver malware to businesses and governments.
Researchers claimed in their writing that they use well-known online storage services because doing otherwise makes it more difficult to identify and stop attacks. Between May and June 2022, their recent phishing campaigns have targeted several Western diplomatic missions and foreign embassies. In the target network, the malicious HTML file that was a dropper for other malicious files, including a Cobalt Strike payload, was linked to the phishing documents.
Palo Alto Networks disclosed the activity to Google and DropBox, which have taken action to block it. However, the Unit 42 researchers have warned organizations and governments to be highly alert.
In light of APT 29’s new tactics, the researchers warned that organizations should be concerned about their abilities to identify, inspect and stop unwanted traffic to legitimate cloud storage providers.
In the past, Cozy Bear has sent malware using trustworthy cloud services. However, the two most recent campaigns first used Google Drive cloud storage services. According to the researchers, using Google Drive cloud storage services in this APT’s malware delivery process is extremely concerning due to their ubiquity and the trust millions of users worldwide place in them.
When encryption is used in conjunction with trusted cloud services, it becomes “extremely difficult” for organizations to identify malicious activity. A Dropbox representative responded to the research findings by stating that the company immediately collaborated with the researchers and industry partners and disabled user accounts. If the company notices any user breaking our terms of service, it will take the necessary action, including suspending or disabling user accounts.https://www.teiss.co.uk