Cloud Threats Memo: Multiple Legitimate Cloud Storage Services Exploited to Target Israeli Organizations

According to our latest Threat Labs statistics for February 2024, the number of cloud apps abused for malicious purposes continued to grow, reaching a new high of 215  in February 2024. And despite this, OneDrive is still the usual suspect, continuing to be the top cloud app exploited to deliver malware. Opportunistic and targeted threat actors are constantly looking for new legitimate services to deliver their payloads, hiding the attack vector inside legitimate traffic and hence evading security controls.

The latest example of this trend is a recent campaign, unearthed by researchers at Proofpoint, and carried out by the Iran-aligned threat actor TA450 (a.k.a. MuddyWater, APT34, OilRig, Mango Sandstorm, Static Kitten, Seedworm, and TEMP.Zagros), a threat actor which is not new to exploiting legitimate cloud services throughout multiple stages of the attack chain. In this particular operation, active in the first half of March, the attackers sent multiple emails from a compromised account in Israel, containing PDF bait documents written in Hebrew and dealing with pay-related social engineering lures, which embedded malicious links to multiple legitimate cloud services, such as Egnyte, Onehub, Sync, and TeraBox. The attack chain ultimately led the user to download a ZIP archive from the legitimate cloud service containing a compressed MSI that would install AteraAgent, a remote administration tool known to be abused by TA450.

The ability to evade traditional security controls is not the only reason to leverage a legitimate service for malicious goals: a cloud service offers a much simplified hosting infrastructure that does not require complex operational tasks and provides an unmatched level of resiliency. This explains the growing number of legitimate services abused by attackers. Even if they are not as well known as OneDrive.

Mitigating the Risks of Malware Delivered from Legitimate Cloud Services

Egnyte, Onehub, Sync, and TeraBox are among the thousands of cloud services where the Netskope Next Gen SWG can provide adaptive access control, threat protection, and data loss prevention, for the single service or for the entire cloud storage category, with a granularity that is impossible for any other web security technology. So, in cases where these services or similar cloud storage apps are not needed by the organization, but are exploited by external attackers to deliver a malicious payload or to host the command and control infrastructure, it is possible to configure a policy for preventing potentially dangerous activities (such as “Upload” and “Download”) from the specific service or the entire category where it belongs.

Netskope customers are also protected against malware distributed from the cloud (and the web in general) by Netskope Threat Protection. Netskope Threat Protection, whose efficacy and low false positive rate has been recently validated by the independent anti-malware testing lab AV–TEST, scans web and cloud traffic to detect known and unknown threats with a comprehensive set of engines, including signature-based AV, machine learning detectors for executables and Office documents, and sandboxing with patient zero protection. The threat protection capabilities can be augmented through Netskope Cloud Exchange, which provides powerful integration tools to leverage investments across users’ security posture through integration with third-party tools, such as threat intelligence feeds, endpoint protection, and email protection technologies.

Netskope Cloud Exchange provides powerful integration tools to leverage investments across users’ security posture through integration with third-party tools, such as threat intelligence feeds, endpoint protection and email protection technologies.

Finally, Netskope Advanced Analytics provides specific dashboards to assess the risk of rogue cloud instances being exploited to deliver malware or the risk of becoming the target of anomalous communications, with rich details and insights, supporting security teams in the analysis and mitigation/remediation process.

Stay safe!