SharePoint Online: Abused as Dead-Drop C2
TWINLOOT uses SharePoint Online as a file dead-drop for tasking via the Microsoft Graph API, polling every 15 seconds for commands.
Tag: dead drop
ZOHOMURK: Zoho WorkDrive Dead Drop Malware
ZOHOMURK is a novel malware that uses hardcoded Zoho OAuth credentials to turn an attacker-controlled WorkDrive account into a dead drop for…
Teletype: Publishing Platform
Teletype is a publishing platform abused by Gamaredon as a dead drop resolver.
Rentry.co: Pastebin Service
Rentry.co is a pastebin service abused by Gamaredon as a dead drop resolver.
Write.as: Blogging Platform
Write.as is a blogging platform abused by Gamaredon as a dead drop resolver.
DEV Community: Developer Platform
DEV Community (dev.to) is a developer platform abused by Gamaredon as a dead drop resolver.
Mastodon: Social Network
Mastodon is a decentralized social network abused by Gamaredon as a dead drop resolver.
Lesma: Social Network
Lesma is a social network abused by Gamaredon as a dead drop resolver.
Nopaste.net: Pastebin Service
Nopaste.net is a pastebin service abused by Gamaredon as a dead drop resolver.
Paste.ee: Pastebin Service
Paste.ee is a pastebin service abused by Gamaredon as a dead drop resolver.