Evasive Panda Attacking Cloud Services To Steal Data Using New Toolkit

The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese government entity in early 2023, which leverages three modules, CGM, CGN, and COL, to hijack web sessions and access cloud services like Google Drive, Gmail, and Outlook. 

By stealing cookies from a victim’s browser, CloudScout can bypass 2FA and IP tracking and enable direct data retrieval from cloud storage.

However, recent security measures like Device Bound Session Credentials and App-Bound Encryption could potentially mitigate the effectiveness of this technique. 

CloudScout, a malicious tool, was used in two cyberattacks targeting Taiwan. In 2022, it was deployed to a religious institution’s network via MgBot, a botnet, while in 2023, it was found in a suspected government entity’s systems alongside the Nightdoor implant. 

Protecting Your Networks & Endpoints With UnderDefense MDR – Request Free Demo

Both incidents indicate a targeted attack on Taiwan, as evidenced by the malware’s use of Taipei Standard Time and Chinese language settings in its configuration. 

The Evasive Panda developed the CloudScout .NET malware framework around 2020, targeting multiple cloud services, including Google Drive, Gmail, and Outlook. 

The framework comprises various modules with inferred targets like Twitter and Facebook, while the core component, the CommonUtilities library, has been updated multiple times. 

Attackers selectively deploy specific modules, indicating a targeted approach. CloudScout’s emergence alongside Nightdoor and a new MgBot variant highlights Evasive Panda’s active toolkit development in 2020.

Gmck, a C++ MgBot plugin, deploys the CGM module onto compromised systems by leveraging the shared RC4 encryption key to extract browser cookies and creates a configuration file. 

This file, encrypted with the same RC4 key, is then used by CGM to access victim accounts. CGM, in turn, downloads sensitive information like emails and personal data from the compromised accounts.

CloudScout is a modular framework that leverages configuration files generated by the MgBot plugin to initiate data collection cycles.

These configuration files, which are in JSON format, contain cookie information and settings for data download, staging, and exfiltration. 

According to ESET researchers, CommonUtilities, a fundamental component of CloudScout, offers essential libraries for HTTP communication and cookie management. 

The HTTPAccess library enables modification of HTTP headers, while the ManagedCookie library handles cookie parsing and integration into HTTP requests, utilizing custom regex patterns to accommodate diverse cookie formats.

CloudScout modules share a common design, with core functionality handled by the Cloud namespace. Each module specializes in authentication and data retrieval for a specific cloud service (Gmail, Drive, Outlook), leveraging stolen cookies. 

Following the completion of the authentication process, modules simulate a web browser by employing hardcoded requests and parsers to retrieve desirable data (emails, files). 

Extracted data is then appended with custom headers for identification and encrypted before being compressed and exfiltrated. Finally, modules clean up and wait for a new configuration to initiate another cycle.    

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!