RATs & Socks: Abusing Google Services
Valerio Alessandroni demonstrates how remote access trojans abuse trusted Google Cloud services and APIs for stealthy C2 communication and proxy tunneling.
Summary
Weaponizing Legitimate Cloud Infrastructure
Valerio Alessandroni explores how adversaries increasingly rely on legitimate, trusted cloud platforms to bypass perimeter network defenses, egress filtering, and domain reputation checks.
Abusing Google Services for C2 and SOCKS Proxies
The presentation walks through the mechanics of converting Google Apps Script, Google Drive, and cloud endpoints into resilient command-and-control channels and dynamic SOCKS5 proxies.
Detection and Cloud Defense Countermeasures
Alessandroni provides defensive strategies, behavioral detection rules, and telemetry analysis techniques to spot anomalous cloud API interactions inside enterprise networks.
Related talks
Main Stage·47 min
Alessandro Magnosi
Malware deployment tactic exploiting NTFS features and emulated read-only filesystems to bypass endpoint inspection.
Main Stage·45 min
RJ McDown
RJ McDown presents Obligato, a covert implant communication framework that abuses legacy Windows session architectures to decouple C2 traffic from malware processes.
Main Stage·21 min
Dimitry Snezhkov
Dimitry Snezhkov explores executing offensive tradecraft inside Intel SGX secure enclaves, hiding malware payloads and decryption keys from host EDR sensors.