Google has taken steps to ax dozens of fraudulent apps from the official Play Store that were spotted propagating Joker, Facestealer, and Coper malware families through the virtual marketplace. Here are the stories we’re paying attention to this week… Several new play store apps spotted distributing Joker, Facestealer, and Coper Malware (The Hacker News) The news about APT29 also coincides with the EU foreign service’s warning that Russian hacker groups have become “increasingly disruptive” in Europe since the start of Russia’s war in Ukraine. Unit 42 has disclosed APT29’s operations to Google and Dropbox, and both have taken actions to mitigate. Just this past May, the security firm Mandiant discovered the same hacking group utilizing Dropbox in a similar scheme that also targeted diplomats and government agencies.Īdvanced threat actors combine the use of encrypted data with ubiquitous services like Dropbox and Google Drive to hide from detection tools, the researchers said.

The latest discovery can be added onto APT29’s lengthy track record of targeting nation-states. Using this new tactic, the group has targeted several entities over the past two months, including diplomatic missions and foreign embassies in Portugal and Brazil.

TechCrunch reports that researchers at Palo Alto Networks’ Unit 42 threat intelligence team discovered APT29’s newest tactic.Ĭozy Bear is the same group responsible for the SolarWinds hack. Russian-linked hacking group APT29, also known as “Cozy Bear” or “Cloaked Ursa,” has been using Google Drive to disseminate malware. This Week’s Top Story SolarWinds attackers are using Google Drive to hide malware

Is google drive secure from ransomware