Who said that cloud services are only exploited by opportunistic cybercriminals? Researchers from Cybereason have recently discovered a new highly targeted campaign, dubbed Operation GhostShell targeting the Aerospace and Telecommunications industries mainly in the Middle East, with additional victims in the U.S., Russia, and Europe.
The campaign leverages a previously undocumented RAT (Remote Access Trojan) dubbed ShellClient, employed as the primary espionage tool. Even though this RAT has been under development since at least 2018, the threat actors have progressively introduced new functionalities to make it even stealthier. And guess what? The latest version deployed in this campaign has replaced the traditional command and control infrastructure with a well-known cloud service: Dropbox.
This familiar cloud service is exploited to both send commands to the ShellClient RAT and also to store the exfiltrated data, and the reasons are always the same: evasion and operational simplicity as the researchers themselves also point out. This architectural choice makes it harder to detect the communication since the network traffic would appear legitimate to security analysts