Cloud Threats Memo: BazarLoader Exploiting Popular Cloud Services

BazarLoader (sometimes referred to as BazaLoader) is a popular downloader among criminals, used to distribute multiple malicious payloads including Ryuk and Conti ransomware. According to a recent report by Phishlabs, during Q3 2021 this malware accounted for 24.7% of all attacks, earning the unwelcome accolade of being the most common payload. One notable characteristic of the BazarLoader is its delivery mechanism; the malware is normally distributed via malicious spam campaigns that contain a link to download the malicious payload from popular cloud services such as Google Drive, Google Firebase, Slack, or BaseCamp.

An additional cloud service has now joined the pack; since mid-October a new BazarLoader campaign has been discovered hosting hundreds of malicious payloads on Microsoft OneDrive, adding more fuel to the fire and reiterating how difficult it is for cloud service providers to keep their infrastructure clean and prevent its exploitation for malware campaigns. As an example, the average reaction time for Google over the course of the last 30 days has been nearly 15 days.

Cybercriminals continue to exploit legitimate cloud services to make their campaign more evasive, taking advantage of the implicit trust users have for them, and the lack of visibility provided by legacy security technologies which were devised for a model of the web that is no longer valid. The modern web is API-driven (so an effective security model must be able to understand this new language) and characterized by the widespread adoption of cloud services.

How Netskope mitigates this threat

Microsoft OneDrive (whether it’s a personal or corporate instance) is one of the thousands of cloud services for which the Netskope Next Gen SWG can enforce both granular access control policies and its multi-engine threat protection. Netskope can prevent access to the entire service, or just block potentially dangerous activities (such as download or upload). Not only can Netskope differentiate Microsoft OneDrive from Microsoft OneDrive for Business and apply different policies (rather than two different instances of the same cloud app, they are considered two completely different services), but it is also possible to apply instance-based policies (for example “Corporate” vs. “Non-Corporate”) for dozens of services such as Google Workspace, Box, Dropbox, et.. Additionally, the multi-layer threat protection engine is able to scan every download from thousands of cloud services (and the web) to prevent any abuse aimed to deliver malware into the victim’s endpoint.

Stay safe!