Attackers hide command and control in trusted cloud services
Cited cases include Gridtide on Google Sheets, SesameOp via OpenAI APIs, and a reported Intune wipe at Stryker.
34
Product
Microsoft Graph API
- Mentions · 7d0
- Mentions · 30d1
- All mentions3
- First seenAug 18, 2026
- Last mentioned9d ago
Timeline
3 articles · newest firstTWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Ontinue disclosed TWINLOOT, a Python implant hiding C2 in SharePoint dead drops and Teams TURN relays, harvesting credentials and pivoting via reverse SOCKS5.
60
Cavern C2 Uses DNS and Google Apps Script to Blend Into Legitimate Traffic
Kaspersky details Iranian Cavern Manticore's expanded C2 framework using DNS and Google Apps Script, plus APT42's TAMECAT spyware in nuclear-sector phishing.
58
Appears with
- Microsoftvendor · 2
- SharePoint Onlineproduct · 1
- Microsoft Edgeproduct · 1
- SesameOpmalware · 1
- UNC2814threat actor · 1
- Group-IBvendor · 1
- Google Sheetsproduct · 1
- Handalathreat actor · 1
- Ontinueorganization · 1
- TWINLOOTmalware · 1
- Cavernmalware · 1
- Gridtidemalware · 1
- Strykervictim · 1
- Microsoft Intuneproduct · 1
- APT42threat actor · 1
- HOLLOWGRAPHmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.