Retour 
Netskope Threat Labs publishes a quarterly summary blog post of the top threats we track on the Netskope platform. This post aims to provide strategic, actionable intelligence on active threats against enterprise users worldwide.
Summary
- GitHub and OneDrive were on the top of the list of top cloud apps used for malware downloads. While GitHub is mostly used to download post-exploitation tools, OneDrive is used to deliver the malware itself.
- The top malware families active in the past quarter included the Infostealer AgentTesla and the Remcos RAT.
Cloud Malware Delivery
Attackers attempt to fly under the radar by delivering malicious content via popular cloud apps. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering or don’t inspect cloud traffic.
Attackers achieve the most success in reaching enterprise users when they abuse cloud apps that are already popular in the enterprise. Although Microsoft OneDrive and GitHub have the same percentage points, we observe slightly different behavior in each app. While GitHub is mostly used to download post-exploitation tools (such as Mimikatz and Impacket), OneDrive is primarily used to deliver the malware payload itself (such as Bumblebee Loader).
Webflow, in fourth place, is noteworthy because in addition to malware downloads, we have also recently observed an increase in phishing pages created using the app.
The top 10 list below reflects attacker tactics, user behavior, and company policy.
Top Malware Families
The following list contains the top malware families blocked by Netskope between July 1 and October 1:
- Infostealer.AgentTesla is a .NET-based remote access Trojan with many capabilities, such as stealing browsers’ passwords, capturing keystrokes, clipboard, etc.
- RAT.NjRAT (a.k.a. Bladabindi) is a remote access Trojan with many capabilities, including logging keystrokes, stealing credentials from browsers, accessing the victim’s camera, and managing files.
- RAT.Remcos is a remote access Trojan that provides an extensive list of features to remotely control devices, and it’s popularly abused by many attackers.
Recommendations
Attackers have always sought to evade detection and avoid suspicion in delivering malware. Netskope Threat Labs recommends that you review your