ETDA สำนักงานพัฒนาธุรกรรมทางอิเล็กทรอนิกส์
Electronic Transactions Development Agency
Home > List all groups > List all tools > List all groups using tool NETVulture

Threat Group Cards: A Threat Actor Encyclopedia

Permanent link Tool: NETVulture

Description(ESET) Named NETVulture and developed in C#, this new backdoor uses OneDrive as its C&C server and relies on Microsoft Graph authentication to access the cloud storage, like a normal application using OneDrive would, in order to receive commands or exfiltrate data. We believe that the group is creating its own OneDrive accounts and not using accounts stolen from its victims.

Last change to this tool card: 10 February 2022

Download this tool card in JSON format

All groups using tool NETVulture


APT groups

XTurla, Waterbug, Venomous BearRussia1996-May 2022 HOT 

1 group listed (1 APT, 0 other, 0 unknown)

Digital Service Security Center
Electronic Transactions Development Agency

Follow us on

Facebook Twitter

Report incidents

Telephone +66 (0)2-123-1227
E-mail [email protected]