{
  "name": "Analysis and Detection of CLOUD#REVERSER: An Attack Involving Threat Actors Compromising Systems Using A Sophisticated Cloud-Based Malware",
  "slug": "analysis-and-detection-of-cloudreverser-an-attack-involving-threat-actors-compromising-systems-using-a-sophisticated-cloud-based-malware",
  "description": "Securonix Threat Research has uncovered a sophisticated malware campaign, dubbed CLOUD#REVERSER, that leverages popular cloud storage services like Google Drive and Dropbox for malware delivery, command execution, and data exfiltration. The infection chain starts with a phishing email containing a malicious zip attachment disguised as a Microsoft Office document. The malware employs various obfuscation techniques, including VBScript and PowerShell stages, to establish persistence, communicate with attacker-controlled servers, and dynamically fetch additional payloads. The threat actors utilize cloud platforms as conduits for executing commands and exfiltrating sensitive data while blending into normal network traffic.",
  "published": "2024-05-22T05:39:57+00:00",
  "created_at": "2024-05-22T05:39:57+00:00",
  "modified_at": "2024-05-22T05:54:10+00:00",
  "created_at_opencti": "2024-05-22T05:39:57+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-22",
    "cloud",
    "cloud#reverser",
    "phishing",
    "powershell",
    "vbscript"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "159.100.13.216"
      },
      {
        "id": "",
        "name": "f96631cdffa6ae69e5432c38778f3b93e5335a935f62939cd0094e5ccb886460"
      },
      {
        "id": "",
        "name": "f4275b0d3c4b6f3a165984b862f4890df14cc346013a22412f7288c9fdc65690"
      },
      {
        "id": "",
        "name": "beaa71057ad064e96fc9f8227a7c2a3b8d70d13e45d5908f25c066d937d5bd9d"
      },
      {
        "id": "",
        "name": "b89d6be0bcfb915492beb7ae726f815dcf289a284e650c200bda4faf5db60fa1"
      },
      {
        "id": "",
        "name": "9b9a3da9c602bf70a60cdb9b2bca6f4472222e8431b6b5ecf82b010fe274bba3"
      },
      {
        "id": "",
        "name": "91bd0f7e5af15248c1e3f2908891bbd9262753910fe4bbd61729f0c184287153"
      },
      {
        "id": "",
        "name": "8955585100f75c59472e4c2c77fcddd7422400f745ae75132c81c6144aa86824"
      },
      {
        "id": "",
        "name": "7bb7ca87149b6407e1e7c11c1a528a2e2147d3096337e3da6f6be130f76ff6ac"
      },
      {
        "id": "",
        "name": "5f0642383ca70a3fd2c4491b2826002763e90ca25a7413869fd824e7745d0465"
      },
      {
        "id": "",
        "name": "59c49f31b5f389c1c0109b0e603e2679c4f63c3f5c64432e820a50f50b80124f"
      },
      {
        "id": "",
        "name": "590353941bab80f38d77b2139bc7da6888b3dff9c8817c4b7e058f50173288bf"
      },
      {
        "id": "",
        "name": "51d758fc04d05b997c651f658cdd30819ef5cf795d4498fad919e75a320e72ea"
      },
      {
        "id": "",
        "name": "4cb1e5ca257c709154b38704c34f4f0ade5305263fb21e6142c90c10a5764d52"
      },
      {
        "id": "",
        "name": "4c37f3db024afd425301666e318c03e34f8813d21d90d95efb4018b3196d07b8"
      },
      {
        "id": "",
        "name": "09fee43f923faaa30857a09c74d96fca9354653835165a01b274cad4c24460c7"
      }
    ],
    "malware": [
      {
        "id": "76e22ae4-a72d-47cb-8196-00fbb02bba3b",
        "name": "CLOUD#REVERSER",
        "slug": "cloudreverser"
      }
    ],
    "attack_patterns": [
      {
        "id": "7671fe3e-6a85-463e-928d-16117d2f4f9b",
        "name": "T1059.006"
      },
      {
        "id": "b7c6c1ad-f183-4128-8427-3891029c73dc",
        "name": "T1539"
      },
      {
        "id": "b7ba0db0-7d4f-436f-8d5f-c431d690b048",
        "name": "T1555.003"
      },
      {
        "id": "6b2e0999-c7e8-4662-94ac-19aa8520ee46",
        "name": "T1059.003"
      },
      {
        "id": "32b33067-6566-4b8d-be80-e96f765d84de",
        "name": "T1059.001"
      },
      {
        "id": "5999052b-e9ae-49e8-9235-d9bf975c22af",
        "name": "T1547.001"
      },
      {
        "id": "eaff4611-3c78-4127-8745-726f77ed68ba",
        "name": "T1070.004"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      },
      {
        "id": "31d29704-da1c-47ea-b93f-76d368813bdf",
        "name": "T1560"
      },
      {
        "id": "fa3b8b48-d97c-4242-83a6-07d435a5a79e",
        "name": "T1041"
      }
    ]
  },
  "external_refs": [
    "https://www.securonix.com/blog/analysis-and-detection-of-cloudreverser-an-attack-involving-threat-actors-compromising-systems-using-a-sophisticated-cloud-based-malware",
    "https://otx.alienvault.com/pulse/664da14d5ec2ab2ee025ed8c"
  ]
}