Cloud Threats Memo: Cloud Storage Services are Increasingly Exploited to Deliver Malware

A new long-running phishing campaign, allegedly originating from Vietnam and active since 2018, is targeting professionals on LinkedIn with the final objective to compromise their corporate Facebook accounts.

The campaign, dubbed “Ducktail,” has exclusively financial motivations, aiming to not only steal business-specific details from the compromised corporate Facebook accounts (which, by the way, are exfiltrated via Telegram bots), but also to leverage the privileges to hijack the payments, replacing the financial details, or even to run their own Facebook Ad campaigns with money from the victimized firms. 

Unsurprisingly, this campaign exploits the cloud in multiple familiar ways throughout its attack chain. This is not only because a consumer cloud application, Facebook, is the final target, and another very popular application, LinkedIn, is used to identify the potential targets and establish the conversation, but also, most importantly, because three legitimate cloud services, Dropbox, iCloud, and MediaFire, are used to host the malware payload that the victims are convinced to download via social engineering once they are approached by the threat actors on LinkedIn.

The attackers exploit the digital trust on a professional network, LinkedIn, to lure the victims and use  three legitimate well-known and trusted cloud services to deliver the malicious payload. A consolidated modus operandi to simplify the attack model, given that cloud services provide simplified hosting, and a more evasive delivery mechanism that increase the chances of success (and Dropbox seems to be the preferred choice of the attackers lately).

How Netskope mitigates the risk of legitimate cloud services exploited for malicious purposes

Dropbox, iCloud, and MediaFire are among the thousands of cloud services for which the Netskope Next Gen SWG can provide granular access control through the Cloud XD engine recognizing dozens of activities such as “Login,” “Create,” “Download,” etc. In the case of Dropbox, it is also possible to distinguish corporate and personal instances enforcing different policies, for example preventing potentially dangerous activities (such as upload and download) from unmanaged cloud storage services or personal accounts, coaching the users to a safer, corporate-approved alternative.

And in case the cloud service is exploited to deliver malware, this risk can be mitigated thanks to Netskope Threat Protection, part of the NG-SWG, which provides an effective defense against modern evasive threats regardless of the nature of the traffic (web or cloud) with a layered approach that offers multiple engines, ranging from antivirus to cloud sandboxing, plus additional detectors based on machine learning to detect Office documents containing malicious macros and portable executables. If needed, the capabilities of the threat protection engine can be further enhanced, integrating external technologies (such as threat intelligence feeds or endpoint technologies), via Cloud Exchange.

Stay safe!