Security News > 2022 > July > Russian SVR hackers use Google Drive, Dropbox to evade detection
State-backed hackers part of Russia's Federation Foreign Intelligence Service have started using Google Drive legitimate cloud storage service to evade detection.
"We have discovered that their two most recent campaigns leveraged Google Drive cloud storage services for the first time," Unit 42 analysts who spotted the new trend said.
"The ubiquitous nature of Google Drive cloud storage services - combined with the trust that millions of customers worldwide have in them - make their inclusion in this APT's malware delivery process exceptionally concerning."
As Mandiant revealed in an April report tracking one of the group's phishing campaigns, this is not the first time APT29 hackers have abused legitimate web services for command-and-control and storage purposes.
APT29 is the Russian Foreign Intelligence Service hacking division that carried out the SolarWinds supply-chain attack, which led to the compromise of multiple U.S. federal agencies in 2020.
Unit 42 has also recently observed the Brute Ratel adversarial attack simulation tool deployed in attacks suspected to be linked to the Russian SVR cyberspies.
News URL
Related news
- Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks (source)
- Russian Hackers Exploit CVE-2025-26633 via MSC EvilTwin to Deploy SilentPrism and DarkWisp (source)
- North Korean Hackers Disguised as IT Workers Targeting UK, European Companies, Google Finds (source)
- Google’s Sec-Gemini v1 Takes on Hackers & Outperforms Rivals by 11% (source)
- Russian hackers attack Western military mission using malicious drive (source)
- Chinese hackers target Russian govt with upgraded RAT malware (source)
- Hackers Abuse Russian Bulletproof Host Proton66 for Global Attacks and Malware Delivery (source)