Security News > 2022 > July > Russian SVR hackers use Google Drive, Dropbox to evade detection
State-backed hackers part of Russia's Federation Foreign Intelligence Service have started using Google Drive legitimate cloud storage service to evade detection.
"We have discovered that their two most recent campaigns leveraged Google Drive cloud storage services for the first time," Unit 42 analysts who spotted the new trend said.
"The ubiquitous nature of Google Drive cloud storage services - combined with the trust that millions of customers worldwide have in them - make their inclusion in this APT's malware delivery process exceptionally concerning."
As Mandiant revealed in an April report tracking one of the group's phishing campaigns, this is not the first time APT29 hackers have abused legitimate web services for command-and-control and storage purposes.
APT29 is the Russian Foreign Intelligence Service hacking division that carried out the SolarWinds supply-chain attack, which led to the compromise of multiple U.S. federal agencies in 2020.
Unit 42 has also recently observed the Brute Ratel adversarial attack simulation tool deployed in attacks suspected to be linked to the Russian SVR cyberspies.
News URL
Related news
- Microsoft and DOJ disrupt Russian FSB hackers' attack infrastructure (source)
- 100+ domains seized to stymie Russian Star Blizzard hackers (source)
- Pro-Ukrainian Hackers Strike Russian State TV on Putin's Birthday (source)
- US, UK warn of Russian APT29 hackers targeting Zimbra, TeamCity servers (source)
- Lazarus hackers used fake DeFi game to exploit Google Chrome zero-day (source)
- Russian hackers deliver malicious RDP configuration files to thousands (source)
- Russian Hackers Exploit New NTLM Flaw to Deploy RAT Malware via Phishing Emails (source)
- Russian Hackers Deploy HATVIBE and CHERRYSPY Malware Across Europe and Asia (source)