Web Services (T1584.006)
Web Services [T1584.006]
Last updated
Web Services [T1584.006]
Last updated
Name: Web Services
ID: T1584.006
Tactics:
Technique:
Web Services () is a sub-technique of the MITRE ATT&CK framework under the broader category of Resource Development (T1584). Attackers leverage web services to host malicious content, command-and-control (C2) infrastructure, phishing pages, or malware payloads. By utilizing legitimate third-party web hosting services, cloud providers, or content delivery networks (CDNs), adversaries can mask their malicious activities, making detection and attribution more challenging.
Attackers commonly exploit legitimate web hosting platforms and cloud services to deploy their infrastructure and deliver malicious payloads. Key technical details include:
Use of Legitimate Web Services:
Attackers frequently register accounts with reputable hosting providers (e.g., AWS, Azure, Google Cloud, GitHub Pages, Heroku) to host malicious content.
Legitimate web services provide reliable uptime, SSL/TLS certificates, and domain reputation, reducing suspicion and evading security controls.
Command-and-Control (C2) Infrastructure:
Adversaries deploy web-based C2 servers on cloud infrastructure to control infected endpoints remotely.
HTTP/S-based communications are used to blend malicious traffic with legitimate web traffic.
Hosting Malicious Payloads:
Attackers upload malware payloads, scripts, or exploit kits onto cloud storage services or web hosting platforms.
URLs pointing to legitimate cloud storage providers (such as Dropbox, Google Drive, AWS S3) are used to evade URL filtering and domain blacklisting.
Phishing and Credential Harvesting:
Attackers create phishing pages hosted on legitimate web services, leveraging trusted domain names and SSL certificates.
These pages mimic authentic login portals, tricking users into submitting credentials or sensitive information.
Obfuscation and Anonymity:
Attackers may use multiple layers of web services, proxies, and CDNs to obscure their true origin and evade detection.
Domain fronting or similar techniques may be employed to hide malicious traffic behind legitimate services.
Attackers employ web services at various stages of cyber-attacks, including:
Initial Access:
Hosting phishing pages or malicious payloads for spear-phishing campaigns.
Distributing malware via legitimate cloud storage links.
Execution and Delivery:
Delivering scripts, binaries, or exploit kits hosted on cloud services to target endpoints.
Providing payloads via legitimate-looking URLs to bypass email security gateways.
Command-and-Control (C2):
Establishing persistent communication channels between compromised systems and attacker-controlled infrastructure hosted on cloud platforms.
Exfiltration and Data Theft:
Uploading stolen data to cloud storage platforms to evade traditional detection methods and simplify data retrieval.
Persistence and Infrastructure Redundancy:
Utilizing cloud services to ensure high availability, redundancy, and rapid re-deployment of malicious infrastructure after takedowns.
Detection of malicious use of web services involves multiple approaches and tools, including:
Network Traffic Analysis:
Monitoring outbound HTTP/S traffic to known cloud hosting providers and analyzing for anomalous patterns or unusual data transfers.
Identifying unusual frequency, timing, or volume of communications with cloud-based endpoints.
Domain and URL Analysis:
Inspecting URLs and domains for suspicious naming conventions, unusual subdomains, or unexpected hosting providers.
Employing URL reputation services, threat intelligence feeds, and sandboxing solutions to identify malicious content hosted on legitimate cloud platforms.
Endpoint Detection and Response (EDR):
Monitoring endpoint processes and scripts that initiate outbound connections to suspicious cloud-hosted resources.
Analyzing logs for unusual script execution or file downloads from cloud storage services.
Cloud Access Security Brokers (CASBs):
Deploying CASBs to monitor and control access to cloud services, detect anomalous user behavior, and identify malicious uploads or downloads.
Threat Intelligence and IoCs:
Leveraging threat intelligence feeds to identify known malicious infrastructure hosted on legitimate web services.
Indicators of Compromise (IoCs) include:
Suspicious URLs or subdomains hosted on trusted cloud providers.
Unusual SSL certificates or certificate issuers.
Known attacker-controlled cloud storage accounts or IP addresses associated with malicious activities.
Early detection of malicious web services usage is critical due to the following impacts:
Reduced Visibility and Attribution Difficulty:
Legitimate cloud services inherently mask malicious traffic, complicating detection and attribution efforts.
Attackers can quickly shift infrastructure across multiple cloud providers, making tracking and takedowns challenging.
High Risk of Successful Phishing Attacks:
Users are more likely to trust links hosted on reputable cloud services, increasing the likelihood of successful credential theft and initial compromise.
Rapid Malware Distribution:
Cloud services provide high availability and bandwidth, enabling attackers to distribute malware rapidly and at scale.
Persistent and Reliable C2 Infrastructure:
Attackers benefit from robust infrastructure and uptime guarantees, ensuring persistent control over compromised systems.
Data Exfiltration and Breach Implications:
Attackers leverage legitimate cloud storage platforms for exfiltration, bypassing traditional data loss prevention (DLP) solutions, increasing risk of data breaches and regulatory penalties.
Early detection allows organizations to mitigate these risks promptly, minimize potential damage, and disrupt attacker infrastructure before significant harm occurs.
Real-world examples demonstrating malicious use of web services include:
APT29 (Cozy Bear) Domain Fronting:
Leveraged legitimate cloud services (such as Google App Engine and Azure) via domain fronting techniques to hide C2 traffic.
Enabled persistent, stealthy communication channels with compromised targets, complicating detection and attribution.
FIN7 Phishing Campaigns:
Hosted phishing pages on legitimate cloud providers (AWS, Google Cloud) to harvest credentials from targeted organizations.
Distributed malware payloads via cloud storage services, evading traditional email filtering and URL blacklisting.
Magecart Attacks:
Injected malicious JavaScript code hosted on legitimate CDNs and cloud storage providers into compromised e-commerce websites.
Exfiltrated customer payment card data to attacker-controlled cloud storage accounts, bypassing typical detection mechanisms.
Operation Cloud Hopper (APT10):
Utilized legitimate cloud services to host malware payloads and maintain persistent C2 infrastructure.
Conducted extensive espionage campaigns targeting managed service providers (MSPs) and their clients, leveraging trusted cloud infrastructure to evade detection.
Gootloader Campaigns:
Hosted malicious JavaScript payloads on compromised legitimate websites and cloud storage platforms.
Delivered secondary malware payloads (e.g., ransomware, banking Trojans) through trusted cloud URLs, increasing infection rates and bypassing security controls.