Acquire Infrastructure: Web Services

APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.^[3]

APT28 has used newly-created Blogspot pages for credential harvesting operations.^[4]

APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.^[1][5]

APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.^[6]

ArcaneDoor included the use of OpenConnect VPN Server instances for conducting actions on victim devices.^[7]

Confucius has obtained cloud storage service accounts to host stolen data.^[8]

Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files.^[9][10] Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages.^[11][12][13] Contagious Interview has also used Slack to coordinate their activities.^[14]

Earth Lusca has established GitHub accounts to host their malware.^[15]

FIN7 has set up Amazon S3 buckets to host trojanized digital products.^[16]

Gamaredon Group has used Cloudflare’s TryClouldflare service to obtain C2 nodes.^[17]

HAFNIUM has acquired web services for use in C2 and exfiltration.^[18]

IndigoZebra created Dropbox accounts for their operations.^[19][20]

Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.^[21] Kimsuky has also leveraged Dropbox for hosting payloads and uploading victim system information. ^[22]

Lazarus Group has hosted malicious downloads on Github.^[23]

LazyScripter has established GitHub accounts to host its toolsets.^[24]

Magic Hound has acquired Amazon S3 buckets to use in C2.^[25]

Medusa Group has utilized a file hosting service named filemail[.]com to host a zip file that contained malicious payloads that facilitated follow-on actions.^[26]

MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.^[27][28][29]

Mustang Panda has set up Dropbox and Google Drive to host malicious downloads.^[30]

During Operation Dream Job, Lazarus Group used file hosting services like DropBox and OneDrive.^[31]

For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.^[32]

POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.^[33]

Saint Bear has leveraged the Discord content delivery network to host malicious content for retrieval during initial access operations.^[34]

TA2541 has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.^[35]

TA578 has used Google Firebase to host malicious scripts.^[36]

Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.^[37]

ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.^[38][39]

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.