Home > List all groups > List all tools > List all groups using tool NETVulture

Threat Group Cards: A Threat Actor Encyclopedia

Names	NETVulture
Category	Malware
Type	Backdoor
Description	(ESET) Named NETVulture and developed in C#, this new backdoor uses OneDrive as its C&C server and relies on Microsoft Graph authentication to access the cloud storage, like a normal application using OneDrive would, in order to receive commands or exfiltrate data. We believe that the group is creating its own OneDrive accounts and not using accounts stolen from its victims.
Information	<https://www.welivesecurity.com/wp-content/uploads/2021/05/eset_threat_report_t12021.pdf>

Last change to this tool card: 10 February 2022

Download this tool card in JSON format

Previous: Netview
Next: NetWalker

Changed	Name	Country	Observed
APT groups
	Turla, Waterbug, Venomous Bear		1996-Dec 2023

1 group listed (1 APT, 0 other, 0 unknown)

APT groups