Threat Actors Migrating to the Cloud

Where do malware payloads come from? It’s a question with an apparently trivial answer. Usually these sit on dedicated servers owned by the campaign managers, and occasionally on a legitimate website that has been broken into and commandeered. But, as we were recently reminded, there is a third option: keeping payloads at accounts on cloud services such as Dropbox and Google Drive.

Recently, while researching the Legion Loader malware, we came across a downloader stub that, in broad strokes, did just that: downloaded a malicious payload from a well-known cloud service, and then executed it. We went loo…