Back 
The exploitation of cloud services is a flexible weapon in the hands of attackers, so flexible that we uncover new campaigns abusing legitimate apps on a daily basis. Whether threat actors are driven by cybercrime or cyberespionage, they continue to target different audiences in different geographical regions of the world, exploiting different services in different phases of the attack chain (primarily delivery and distribution of malware, but also command and control, alongside the emerging spearphishing campaigns tailored specifically to target cloud accounts).
Two recent examples bring us to Brazil and Korea, where two distinct operations provided additional, unneeded, proofs of how legitimate internet services can be easily adapted for multiple roles and multiple purposes over the course of a malicious operation.
In May, researchers at HarfangLab in Brazil discovered a malicious campaign delivering a payload named “AllaSenha” (yet another variant of an old acquaintance for users in Latin america: AllaKore, an open source remote access tool). This variant, characterized by an intricate infection chain involving Python scripts and a Delphi-developed loader, is specifically aimed at stealing credentials of Brazilian bank accounts and also leveraging Azure as its command and control (C2) infrastructure. Azure is particularly flexible for the attackers, as it provides multiple tools that can be abused, and not only by opportunistic criminals. For example, in February 2024, researchers at Mandiant discovered a cyberespionage campaign carried out by an Iranian threat actor tracked as UNC1549, exploiting a network of over 125 Azure command-and-control (C2) subdomains.
Nearly at the same time, researchers at AhnLab found out that cybercriminals were quite busy in South Korea, distributing a malware cocktail (remote access Trojans, cryptocurrency miners, malware downloaders, proxy tools, and anti-AV programs) through cracked versions of Microsoft Office (once again a warning to not install unapproved applications on corporate devices). Unsurprisingly, the cracked installer sporting a well-crafted interface, launched in background an obfuscated .NET malware that contacts a Telegram or Mastodon channel to receive a valid download URL from Google Drive or GitHub from where it downloads an obfuscated payload containing the PowerShell command that ultimately, at the end of the complex attack chain, installs the malware strains onto the system.
While these attacks may be in different countries, involve different threat actors, and