{"id":11707,"date":"2026-03-25T13:13:59","date_gmt":"2026-03-25T13:13:59","guid":{"rendered":"https:\/\/events.aavar.org\/avar2025\/?page_id=11707"},"modified":"2026-03-25T13:14:00","modified_gmt":"2026-03-25T13:14:00","slug":"an-analysis-of-cloud-infrastructure-utilization-in-malware-command-and-control","status":"publish","type":"page","link":"https:\/\/events.aavar.org\/avar2025\/index.php\/an-analysis-of-cloud-infrastructure-utilization-in-malware-command-and-control\/","title":{"rendered":"An Analysis Of Cloud Infrastructure Utilization In Malware Command And Control"},"content":{"rendered":"\n[vc_row full_width=”stretch_row” el_class=”agenda-banner” el_id=”agenda_banner”] [vc_column]\n\n\n\n
\n
\n
<\/div>\n\n\n\n

AGENDA<\/p>\n<\/div>\n\n\n\n

<\/div>\n<\/div>\n\n\n\n

[\/vc_column] [\/vc_row]<\/p>\n\n\n\n

<\/div>\n\n\n\n

<— Back<\/a><\/strong><\/p>\n\n\n\n

An Analysis Of Cloud Infrastructure Utilization In Malware Command And Control<\/p>\n\n\n\n

In recent years, malware authors have increasingly favored using legitimate cloud platforms such as Telegram, Discord, Google Drive, and Dropbox as Command and Control (C2) channels. This tactic allows malware to evade traditional detection mechanisms and hide in normal user traffic.<\/p>\n\n\n\n

In this paper, we analyze real-world malware campaigns that use cloud infrastructure as a control channel, focusing on how cloud APIs are used to steal data, download payloads, and send remote commands. We will present techniques for masking and evading detection, as well as why many current security products fail to detect this method.<\/p>\n\n\n\n

In addition, we will present practical methods for detecting and mitigating these threats, including behavioral monitoring, anomaly detection, and threat hunting via cloud telemetry.<\/p>\n\n\n\n

This article aims to raise awareness among users and enterprises of this growing trend and provide specific strategies to defend against malware that exploits cloud infrastructure.<\/p>\n\n\n\n

<\/div>\n\n\n\n
\n
\n
\n
\n
\"\"<\/figure>\n<\/div><\/div>\n\n\n\n
\n

Tran Thi Hieu Ngan – CMC Cyber Security<\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n\n\n\n

Tran Thi Hieu Ngan is a Malware Researcher who began her career as a malware research intern in her third year at university. After earning her bachelor\u2019s degree, she pursued a professional path in malware research. Her work focuses on malware analysis, developing advanced detection and remediation technologies, and hunting advanced persistent threats (APT). She is committed to continuous professional development, building the expertise required to proactively safeguard against emerging cyber risks.<\/p>\n<\/div>\n<\/div>\n\n\n\n

<\/div>\n\n\n\n
\n
\n
\"\"<\/figure>\n<\/div><\/div>\n\n\n\n
\n

Bui Huy Anh – CMC Cyber Security<\/strong><\/strong><\/strong><\/strong><\/strong><\/strong><\/p>\n\n\n\n

As Head of Anti-Malware Solutions Department, a senior cybersecurity expert with extensive experience in malware research and analysis, Bui Huy Anh plays a key role in researching cyber security threat, designing and implementing advanced security solutions for enterprises, aiming to develop CMC\u2019s comprehensive cybersecurity ecosystem, aligned with international standards and capable of responding to sophisticated threats.<\/p>\n<\/div>\n<\/div>\n\n\n\n

<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

[vc_row full_width=”stretch_row” el_class=”agenda-banner” el_id=”agenda_banner”] [vc_column] AGENDA [\/vc_column] [\/vc_row] <— Back An Analysis Of Cloud Infrastructure Utilization In Malware Command And Control In recent years, malware authors have increasingly favored using legitimate cloud platforms such as Telegram, Discord, Google Drive, and Dropbox as Command and Control (C2) channels. This tactic allows malware to evade traditional detection mechanisms and hide in normal<\/p>\n

<\/div>\n

Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-11707","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11707","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/comments?post=11707"}],"version-history":[{"count":1,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11707\/revisions"}],"predecessor-version":[{"id":11710,"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/pages\/11707\/revisions\/11710"}],"wp:attachment":[{"href":"https:\/\/events.aavar.org\/avar2025\/index.php\/wp-json\/wp\/v2\/media?parent=11707"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}