Exploiting Legit APIs For Covert C2: A New Perspective On Cloud-based Malware Operations

The talk starts from a simple problem: traditional command-and-control infrastructure is easy to spot. Unfamiliar domains, unusual TLS server names and poor IP reputation get flagged by sandboxes, EDR, firewalls and deep packet inspection. The speaker argues that attackers and red teams can avoid this by routing C2 through widely trusted web services that most networks already allow.

The middle of the talk surveys these services. A Telegram bot used to receive stolen logins from a phishing page targeting government staff in Kazakhstan serves as an early example. Slack and Discord webhooks, GitHub issues and comments, Bitbucket webhook descriptions, VirusTotal file comments and Telegram bot messages are then shown as carriers for system information, files and commands, often Base64-encoded. Most require only a token, which can be rotated or revoked to maintain persistence. Further cases include an IoT camera API, Azure DevOps work items, and an Xbox messaging flaw that let messages reach users without a friend relationship; Microsoft has since fixed that bug.

The closing advice is that the traffic itself looks ordinary, so detection has to rely on context. The speaker suggests inventorying approved API tokens and treating calls to legitimate services made with unrecognised tokens as suspicious, alongside heuristic analysis and deeper packet inspection. No complete mitigation is offered, and generative AI APIs are flagged as a likely next channel.