Stage Capabilities: Upload Malware

APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.^[1]

APT42 has used its infrastructure for C2 and for staging the VINETHORN payload, which masqueraded as a VPN application.^[6]

BITTER has registered domains to stage payloads.^[7]

BlackByte has staged tools such as Cobalt Strike at public file sharing and hosting sites.^[8]

For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.^[9]

For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.^[10]

For C0021, the threat actors uploaded malware to websites under their control.^[11][12]

Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.^{[13][14][15][16][17][18][19][20][21][22][23][24]}

Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.^[25]

EXOTIC LILY has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.^[26]

FIN7 has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3.^[27] FIN7 has also used an open directory web server as a staging server for payloads and other tools, such as OpenSSH and 7zip.^[28]

Gamaredon Group has registered domains to stage payloads.^[29][30]

HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.^[31]

Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants.^[32][33][34] Kimsuky has also hosted malicious payloads on Dropbox.^[35]

LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.^[36]

LuminousMoth has hosted malicious payloads on Dropbox.^[37]

Moonstone Sleet staged malicious capabilities online for follow-on download by victims or malware.^[38]

Mustang Panda has hosted malicious payloads on DropBox including PlugX.^[39]

Mustard Tempest has hosted payloads on acquired second-stage servers for periods of either days, weeks, or months.^[40]

During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.^[41]

OilRig has hosted malware on fake websites designed to target specific audiences.^[42]

For Operation Dream Job, Lazarus Group used compromised servers to host malware.^{[43][44][45][46]}

For Operation Sharpshooter, the threat actors staged malicious files on Dropbox and other websites.^[47]

For Operation Spalax, the threat actors staged malware and malicious files in legitimate hosting services such as OneDrive or MediaFire.^[48]

Mustang Panda staged malware on adversary-controlled domains and cloud storage instances during RedDelta Modified PlugX Infection Chain Operations.^[49]

Saint Bear has used the Discord content delivery network for hosting malicious content referenced in links and emails.^[50]

Sandworm Team staged compromised versions of legitimate software installers in forums to enable initial access to executing user.^[51]

SideCopy has used compromised domains to host its malicious payloads.^[52]

Star Blizzard has uploaded malicious payloads to cloud storage sites.^[53]

TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.^[54][55]

TA505 has staged malware on actor-controlled domains.^[56]

TeamTNT has uploaded backdoored Docker images to Docker Hub.^[57]

Threat Group-3390 has hosted malicious payloads on Dropbox.^[58]

This technique cannot be easily mitigated with preventive controls since it is based on behaviors performed outside of the scope of enterprise defenses and controls.