Atrás 
Netskope Threat Labs publishes a monthly summary blog post of the top threats we are tracking on the Netskope platform. The purpose of this post is to provide strategic, actionable intelligence on active threats against enterprise users worldwide.
Summary
- Malware downloads from SharePoint doubled, caused by a DarkGate malware campaign that lures victims into downloading and opening a malicious LNK file that starts an infection chain resulting in the final DarkGate payload.
- Attackers continue to attempt to fly under the radar by using cloud apps to deliver malware, with 55% of all malware downloads in September originating from 162 cloud apps.
- The Phobos ransomware and also the famous evasive malware RaspberryRobin were among the top malware families detected on the Netskope platform in September.
Cloud Malware Delivery
Attackers attempt to fly under the radar by delivering malicious content via popular cloud apps. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering, or that do not inspect cloud traffic. In September 2023, 55% of all HTTP/HTTPS malware downloads originated from popular cloud apps, 4% more when compared to August.
The total number of cloud apps from which malware downloads originated is the highest since March, with 162 distinct cloud apps used for malware download.
Attackers achieve the most success reaching enterprise users when they abuse cloud apps that are already popular in the enterprise. Microsoft OneDrive, the most popular enterprise cloud app, has held the top spot for the most cloud malware downloads for more than six months. Malware downloads from SharePoint increased significantly in September due to the recent DarkGate malware campaign, moving to the second place spot and dropping last month’s second place app (Microsoft Live Outlook) to fourth place. The top ten apps remained largely unchanged and included free software hosting sites (GitHub), free web hosting services (Weebly), cloud storage apps (Google Drive, Box, Azure Blob Storage), and document sharing apps (DocPlayer). In total, the top ten accounted for nearly three-quarters of all cloud malware downloads, with the remaining one-quarter spread over 157 other cloud apps. The top ten list is a reflection of attacker tactics, user behavior, and company policy.
DarkGate malware campaign and the rise of SharePoint
A campaign using SharePoint to distribute the DarkGate malware was observed in September, resulting in a relative increase of malware downloads from SharePoint from 7% in August to 15% in September. The infection chain starts with the victim being lured to download a ZIP file from SharePoint and clicking on a LNK file disguised as a PDF file. Both the ZIP and PDF files are named in a way to be attractive to the victim. Some examples of those names are “Company_Transformations.pdf.lnk”, “Employees_Affected_by_Transition.pdf.lnk” and “Fresh_Mission_and_Core_Values.pdf.lnk”. Once the user clicks on the LNK file, a VBS script is downloaded and executed, which downloads an AutoIt script responsible for executing the DarkGate payload. The following is an example of the commands executed by the LNK file via cmd.exe:
