NETVulture
Description
(ESET) Named NETVulture and developed in C#, this new backdoor uses OneDrive as its C&C server and relies on Microsoft Graph authentication to access the cloud storage, like a normal application using OneDrive would, in order to receive commands or exfiltrate data. We believe that the group is creating its own OneDrive accounts and not using accounts stolen from its victims.
Names
| Name |
|---|
| NETVulture |
Category
Malware
Type
- Backdoor
Information
Other Information
Uuid
3e6e9854-ece9-4a08-bd07-e39aa507a423
Last Card Change
2022-02-10