Cloud-Based Malware Delivery

Cloud-based malware delivery refers to the use of cloud computing infrastructure and services to distribute malicious software, such as viruses, worms, or ransomware, is distributed through cloud computing platforms or services to target systems or devices.

Malicious actors leverage the scalability, flexibility, and anonymity offered by cloud platforms to host and disseminate their malicious payloads. By utilizing cloud infrastructure, attackers can leverage dynamic IP addresses and frequently change the hosting environment, making it more difficult for security solutions to track and block their activities. This dynamic nature of cloud-based malware delivery can help evade traditional security measures.

The use of cloud-based platforms for malware delivery has been increasing due to various reasons including:

· The increasing popularity of cloud computing: Cloud computing has become increasingly popular in recent years, as businesses have moved their data and applications to the cloud. This has made it easier for attackers to target cloud-based systems.

· The growing sophistication of malware: Malware is becoming increasingly sophisticated, and attackers are using more advanced techniques to deliver malware to victims.

· The lack of awareness of cloud security risks: Many businesses are not aware of the security risks associated with cloud computing. This makes them more vulnerable to attack.

As per Check Point Reasearch analysis, Antivirus products are constantly evolving to become more sophisticated and better equipped to handle complex threats. As a result, malware developers strive to create new threats that can bypass the defenses of antivirus products. “Packing” and “crypting” services are specifically designed to resist analysis.

GuLoader is a prominent shellcode-based downloader that has been used in a large number of attacks to deliver a wide range of the “most wanted” malware.

GuLoader has been active for more than three years and is still undergoing further development. The latest version integrates new anti-analysis techniques, which results in it being significantly challenging to analyze. New GuLoader samples receive zero detections on VirusTotal, ensuring its malicious payloads also remain undetected.

GuLoader’s payload is fully encrypted, including PE headers. This allows threat actors to store payloads using well-known public cloud services, bypass antivirus protections, and keep payloads available for download for a long period of time. Despite Google’s efforts to block GuLoader’s encrypted malicious payloads, GuLoader still downloads payloads from Google Drive in most cases. The following chart shows the statistics of the different hosting services used by GuLoader over the past month.

Cloud-based delivery mechanisms can facilitate quicker adaptation of malware. Malicious actors can leverage cloud resources to analyze the effectiveness of their malware, gather information about target systems, and modify their attacks accordingly. This enables them to stay ahead of security defenses and increase their chances of successful infections.

S Mohini Ratna, Editor, VARINDIA