Cybereason noted that even if this specific CC account were disabled, it would be trivial for the hackers to create a new account and leave the service playing whack-a-mole. While Cybereason has informed Dropbox of the RAT using its service, so far the company has yet to take action. 'This method of communication is an interesting Operational Security solution, making it difficult to trace the threat actor's infrastructure by utilizing a public service such as Dropbox.'

'The C2 communications this malware implements are quite unique, as they rely on 'cold files' being saved to a remote Dropbox, instead of a common interactive session,' the report said. One feature of the campaign, dubbed 'Operation GhostShell' by Cybereason, that stuck out to the research team was the way ShellClient receives its commands - the malware downloads instructions from stored files rather than opening up a remote shell connection. By running checks every two seconds via the Dropbox API, the malware is able to receive commands and transfer files without being detected by network monitoring tools. 'The authors of ShellClient invested a lot of effort into making it stealthy to evade detection by antivirus and other security tools by leveraging multiple obfuscation techniques and recently implementing a Dropbox client for command and control (C2), making it very hard to detect,' the researchers said.Īmong the more interesting tactics employed by the group is the use of the Dropbox file storage service as a command and control platform. The group's primary attack tool is a remote access trojan (RAT) dubbed 'ShellClient.' The tool covertly compromises systems and moves laterally around networks without being detected by antivirus software. 'This is supported by the fact that there are very few samples found in the telemetry or in-the-wild since 2018, in contrast to commodity malware that can usually be found in abundance.' 'The intrusions analyzed by Cybereason suggest that the motivation is cyber espionage against a very small set of carefully selected targets,' Cybereason researchers Assaf Dahan, Daniel Frank, Tom Fakterman and Chen Erlich wrote in the report.

Cybereason noted that it is possible the MalKamak cyberespionage group is a subset of one of the larger Iran-backed advanced persistent threat (APT) operations, either Chafer APT (aka APT39) or Agrius APT.

What is a dropbox for hackers