Over the past year, the percentage of malware downloads from cloud apps has decreased gradually from its peak a year ago, hovering around 50%, with approximately half of all malware downloads over HTTP and HTTPS coming from popular cloud apps and the other half coming from regular websites. Throughout this time, the healthcare sector lagged behind other industries but with a narrowing gap. Today, approximately 40% of all malware downloads in the healthcare industry originate from cloud apps, compared to just about 30% a year ago.The abuse of cloud apps allows the malware to fly under the radar and evade regular security controls that rely on tools such as domain block lists or that do not inspect cloud traffic.

Compared to six other industries averaged over the past year, the healthcare sector has the smallest percentage of malware downloads from the cloud.

A recurring theme throughout this report is that Microsoft OneDrive is the most popular app in the healthcare sector, but its popularity lags behind other industries. In the case of malware delivery, this is no different. The healthcare sector saw more malware downloads originating from OneDrive than from any other cloud app, but at a rate 11 points lower than other industries. Similarly, Microsoft SharePoint is less popular in the healthcare sector and also saw fewer malware downloads than in other sectors. All other apps in the top ten were slightly higher in healthcare compared to other industries.

The fact that both the overall popularity of OneDrive and the incidence of malware downloads from OneDrive were lower in the healthcare sector underscores a critical relationship between these two phenomena. Adversaries abuse Microsoft OneDrive because it is the most popular cloud storage app. Meanwhile, people who regularly use Microsoft OneDrive are more likely to click on links to download files shared with them on that platform. Therefore, the number of malware downloads that Netskope detects and blocks from Microsoft OneDrive is both a reflection of adversary tactics (abusing OneDrive to distribute malware) and victim behavior (their likelihood to click on the links and download the malware).