Security News > 2022 > July > Russian SVR hackers use Google Drive, Dropbox to evade detection

State-backed hackers part of Russia's Federation Foreign Intelligence Service have started using Google Drive legitimate cloud storage service to evade detection.

"We have discovered that their two most recent campaigns leveraged Google Drive cloud storage services for the first time," Unit 42 analysts who spotted the new trend said.

"The ubiquitous nature of Google Drive cloud storage services - combined with the trust that millions of customers worldwide have in them - make their inclusion in this APT's malware delivery process exceptionally concerning."

As Mandiant revealed in an April report tracking one of the group's phishing campaigns, this is not the first time APT29 hackers have abused legitimate web services for command-and-control and storage purposes.

APT29 is the Russian Foreign Intelligence Service hacking division that carried out the SolarWinds supply-chain attack, which led to the compromise of multiple U.S. federal agencies in 2020.

Unit 42 has also recently observed the Brute Ratel adversarial attack simulation tool deployed in attacks suspected to be linked to the Russian SVR cyberspies.

News URL

https://www.bleepingcomputer.com/news/security/russian-svr-hackers-use-google-drive-dropbox-to-evade-detection/