Living off the Cloud: A Server-Free Approach to Malware Ops
summary
Demonstrates a working Python malware that uses Trello-based C2 and Google Drive API exfiltration to issue commands, send telemetry and upload stolen files (demo pulls X‑rays and a “How not to explode” PDF), polling every few seconds and supporting multiple victim folders. Shows pros (free, blends with allowed traffic) and cons (service downtime, API/account takedown, no SSH tunnels) and uses ChatGPT to generate and obfuscate malicious code, recommending mitigations: sanctioned app lists, tenant restriction, CASB controls, client‑type and API filtering, rate detection and DLP.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 3:47Defining the attack
- 7:16Evolution of the technique
- 12:11Cloud CNC architecture
- 16:06Live demonstration
- 24:31Analysis of the demo
- 27:29Role of AI in cyber attacks
- 36:24Defensive strategies
- 44:25Conclusion and Q&A
related talks
53mAbusing Cloud Apps 101: Command and Control
28mCyberespionage: Targeted Attacks Abusing Third-Party Cloud Services
22mMalware Hunting - Using python as an attack weapon
01h 03mEffects Malware hunting in Cloud environment
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
52mFlying Under the Radar - New Security Evasion Techniques
50mThe Anatomy of Cloud Attacks
26mWhen Models Write Malware: Defending Against On-demand Exploits