How Hackers Host C2 Servers on Google Infrastructure (Google Sheets & Drive)

Tech Stories Tech Brief By HackerNoon

This story was originally published on HackerNoon at: https://hackernoon.com/how-hackers-host-c2-servers-on-google-infrastructure-google-sheets-and-drive.
A guide on how to use Google Workspace's Drive and Sheets (formerly G-Suite) to communicate and exfiltrate information natively Drive and Sheets.
Check more stories related to tech-stories at: https://hackernoon.com/c/tech-stories. You can also check exclusive content about #gc2, #security, #cybersecurity, #edr, #endpoint-detection-response, #youtubers, #hacking, #hackernoon-top-story, #hackernoon-es, #hackernoon-hi, #hackernoon-zh, #hackernoon-vi, #hackernoon-fr, #hackernoon-pt, #hackernoon-ja, and more.
This story was written by: @grantcollins. Learn more about this writer by checking @grantcollins's about page, and for more stories, please visit hackernoon.com.
Reading through my weekly security news and stumbled on a Bleepingcomputer article about using Google Workspace's Drive and Sheets (formerly G-Suite) to communicate and exfiltrate information natively Drive and Sheets. I thought this was a clever project because: You do not have to set up any particular domains, servers as most C2 frameworks do. (And many defense tools maintain a dynamic list of malicious domains, IPs, etc). This doesn't use common C2 and red team frameworks, such as Cobalt Strike, SilverC2, or Brute Ratel. This program and traffic only interact with Google's domains (*.google.com) to make detection more difficult for tools.