In the first quarter of 2021, cybercriminals sent 52 million malicious messages using storage services such as Office 365 , Azure, OneDrive , SharePoint, G-Suite, and Firebase.
During the pandemic, criminals used the cloud to hide phishing scams from trusted Microsoft and Google services.
Security researchers at Proofpoint discovered 7 million malicious emails sent from the Microsoft 365 service and 45 million sent from Google infrastructure in the first three months of 2021 alone.
They also report that malicious users used Office 365, Azure , OneDrive, SharePoint, G-Suite, and Firebase services to send emails, as well as to attack hosts.
The publication states:
"The volume of malicious messages from these trusted cloud services exceeded the volume of botnets in 2020, and the trusted reputation of these domains, such as outlook.com and sharepoint.com, increases the difficulty of detection."
Since a breach of one account could give access to more others, ProofPoint estimated that 95% of organizations were targeted in cloud attacks and more than half of them were successful. In addition, more than 30% of the organizations that were breached "experienced post-access activity such as file management, email promotion and OAuth activities".
Once intruders have credentials, they can enter an organization's emails, locate affiliates and significant others, to convincingly send phishing emails.
Proofpoint gave many examples of emails that tried to trick users into giving out their information or serving malware.
Proofpoint research clearly shows that intruders use popular cloud communication tools to spread malicious emails and target people using Microsoft and Google infrastructure.
Breaking accounts in the cloud can be combined with serving ransomware, with disastrous results.
So securing cloud services should be a top priority for security companies.
George is still wondering what he is doing here….
