Cloud storage lockers from Microsoft and Google used to store and spread state-sponsored malware

Symantec researchers presented at Black Hat that multiple nation-state and criminal groups are increasingly abusing legitimate cloud services (Microsoft Graph/OneDrive, Google Drive, GitHub) to host C2, deliver malware, and exfiltrate data; observed malware families include Grager, Moon_Tag and Onedrivetools, with infection chains using typosquatted installers, tunneled traffic (Whipweave/ORB), and automated OneDrive-based alerts and exfiltration, and Symantec published IOCs and MITRE mappings to help defenders.