399. Threat Actors Abuse Storj to Deliver OXLOADER
Hello everyone! Attackers are increasingly using legitimate web services to host malicious files, and today we'll take a look at another example: Storj. According to this report, the attackers used malvertising to distribute the OXLOADER loader. To host the malicious payloads, they relied on the Storj service, for example: link[.]storjshare[.]io/raw/jwwvr4oskkkjsgevt774ta62ehya/ruslan/aBsvwbdas.exe As with other services of this kind, you can look for suspicious interactions with them using a query like: event_type: "dnsreq" AND dns_rname: "storjshare.io" Or you can simply block access to the service altogether - in that case, users won't be able to download the malicious files. See you soon!