Mustang Panda has used DropBox URLs to deliver variants of PlugX. LazyScripter has used GitHub to host its payloads to operate spam campaigns. Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe. Hildegard has downloaded scripts from GitHub. GuLoader has the ability to download malware from Google Drive. NET executable on the compromised system. Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's. įox Kitten has used Amazon Web Services to host C2. įIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.

įIN6 has used Pastebin and Google Storage to host content for their operations. ĭropBook can communicate with its operators by exploiting the Simplenote, DropBox, and the social media platform, Facebook, where it can create fake accounts to control the backdoor and receive instructions. ĭoki has used the API to generate a C2 address. ĬharmPower can download additional modules from actor-controlled Amazon S3 buckets. Ĭarbon can use Pastebin to receive C2 commands. īoomBox can download files from Dropbox using a hardcoded access token. īazar downloads have been hosted on Google Docs.

APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.

Discord download google drive