ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Report
Search
Home > List all groups > List all tools > List all groups using tool NETVulture

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: NETVulture

NamesNETVulture
CategoryMalware
TypeBackdoor
Description(ESET) Named NETVulture and developed in C#, this new backdoor uses OneDrive as its C&C server and relies on Microsoft Graph authentication to access the cloud storage, like a normal application using OneDrive would, in order to receive commands or exfiltrate data. We believe that the group is creating its own OneDrive accounts and not using accounts stolen from its victims.
Information<https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf>

Last change to this tool card: 10 February 2022

Download this tool card in JSON format

All groups using tool NETVulture

ChangedNameCountryObserved

APT groups

 Turla, Waterbug, Venomous BearRussia1996-Dec 2023 

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]