Cloud Threats Memo: A Parasite Exploiting Legitimate Cloud Services

Malicious browser extensions are a common attack vector used by threat actors to steal sensitive information, such as authentication cookies or login credentials, or to manipulate financial transactions.

In the latest example of a similar threat, researchers from Trend Micro have discovered a malicious Google Chrome extension (also working on Chromium-based browsers such as Microsoft Edge, Brave, and Opera,) named “ParaSiteSnatcher” and specifically designed to target users in Latin America. It particularly focuses on Brazilian targets, given that the malicious extension is able to exfiltrate data from several local banks, such as Banco do Brasil and Caixa Econômica Federal, or also to initiate and manipulate transactions in local payment methods such as PIX or Boleto Bancario. In addition, it can also exfiltrate Brazilian Tax ID numbers, for both individuals and businesses, and cookies, unsurprisingly even those used for Microsoft accounts. 

But another interesting characteristic of ParaSiteSnatcher is in the way the payload is delivered to the victim, leveraging a VBScript downloader hosted on Dropbox, and also in the way it establishes communication with the attacker’s command and control infrastructure, obtaining a list of obfuscated URLs from Google Cloud Storage, a technique known as Dead Drop Resolver.

Yet another example of two legitimate cloud services exploited for malicious purposes by threat actors. Not only do legitimate cloud services have the implicit trust from individuals and enterprises (which should rather adopt a zero trust approach,) but they are also able to evade legacy secure web gateways, which don’t have the needed contextual awareness to enable adaptive, least-privileged access to applications and data. Finally they provide the attackers with a platform to launch their malicious campaigns, which is simple to manage, immediately available, and resilient: in practice, the same characteristics that drive organizations to move their data and applications to the cloud.

Mitigating the risks of legitimate cloud services exploited for malicious purposes

Dropbox and Google Cloud Storage are among the thousands of cloud services where the Netskope Next Gen SWG can provide adaptive access control, threat protection, and data loss prevention. They are also among the hundreds of cloud services for which instance detection is available. So, in cases where these apps are exploited to deliver a malicious payload, or to host the command and control infrastructure, it is possible to configure a policy for preventing potentially dangerous activities (such as “Upload” and “Download”) if those apps are not needed by the organization, singularly or as a category. Instead, in case the same apps are in use by the organization, it is possible to configure a policy for preventing any risky activities from non-corporate instances only, mitigating the risk of malware delivery and data exfiltration.

Netskope customers are also protected against malware distributed from a legitimate cloud service and the web in general by Netskope Threat Protection, which scans web and cloud traffic to detect known and unknown threats with a comprehensive set of engines, including signature-based AV, machine learning detectors for executables and Office documents, and sandboxing with patient zero protection. Netskope threat intelligence can also detect command and control connections even if they are directed to a legitimate cloud service.

Netskope Cloud Exchange provides powerful integration tools to leverage investments across users’ security posture through integration with third-party tools, such as threat intelligence feeds and endpoint detection technologies.

Finally, Netskope Advanced Analytics provides specific dashboards to assess the risk of rogue cloud instances being exploited to deliver malware or the risk of becoming the target of anomalous communications, with rich details and insights, supporting security teams in the analysis and mitigation/remediation process.

Stay safe!