APT Hackers Using Google Drive & OneDrive to Host Malicious Scripts

Attackers are exploiting cloud storage services like Google Drive, OneDrive, and Dropbox to launch attacks by uploading malicious files, including scripts, RAT malware, and decoy documents, to these platforms. 

These uploaded files then function as a coordinated attack chain, ultimately leading to the execution of Remote Access Trojan (RAT) malware on the targeted victim’s machine. 

The attackers leverage a cloud-based infrastructure to orchestrate a multi-file attack campaign, allowing them to remotely update the malware with new functionalities, including downloading additional malware variants or exfiltrating sensitive data. 

Attackers specifically utilize LNK files, a common file type exploited in APT attacks, to initiate the infection process. 

The malicious LNK file first downloads PowerShell scripts (first.ps1 and info.ps1) from the threat actor’s cloud storage, which seem to target specific users based on their names in the filenames (e.g., SoJ****-F.txt). 

The scripts utilize token-based Dropbox authentication and steal user PC information, including OS details, anti-malware solution, boot time, machine type, processes, and the PowerShell execution policy, which is then saved locally and uploaded back to the threat actor’s Dropbox storage. 

The PowerShell script info.ps1(SoJ****-X.txt) uploads a file to Dropbox and downloads additional malware strains from Google Drive. The downloaded malware is a compressed C# (.NET) file that is executed in a fileless manner. 

Malware is XenoRAT, which can perform various malicious behaviours such as loading malware, launching and terminating processes, and communicating with a C2 server. 

The script was created by a threat actor who also uses email addresses [kumasancar@gmail.com], [effortnully@gmail.com], [tangdang77790@gmail.com], [tantanibox@gmail.com], and [swolf0512@gmail.com].

A disguised LNK file named “Police Cyber Investigation Bureau—Internet Use History (check now to keep your PC safe).html.lnk” delivers malicious PowerShell commands. 

LNK file decodes Base64-encoded commands, saves them as a temporary PowerShell script (ms_temp_08.ps1), and executes them, which downloads a decoy HTML file with the same name as the LNK file and another PowerShell script (ms_update.ps1). 

Ms_update.ps1 is then registered to run every 30 minutes using the Task Scheduler under the name “MicrosoftUpdate.”. Finally, another malicious script (first.ps1) is downloaded and executed.  

The malicious script “ms_update.ps1” downloads a file from the threat actor’s Dropbox and executes it as “info.ps1” after saving it in the victim’s temporary directory, which likely contains the actual malicious code.  

Analysis by ASEC of the Dropbox revealed various decoy documents, including university cooperation requests, business deliveries, and foreign affairs, suggesting the attacker targets specific victims potentially by using social engineering tactics with documents relevant to their field. 

Also Read:

• Microsoft Azure Vulnerability Let Attackers bypass Firewall Rules
• Beware of Fake KMSPico Activators that Delivers Vidar Stealer Malware