{"id":1231,"date":"2016-08-02T07:23:54","date_gmt":"2016-08-02T07:23:54","guid":{"rendered":"https:\/\/antivirus.comodo.com\/blog\/?p=1231"},"modified":"2025-06-19T17:16:26","modified_gmt":"2025-06-19T11:46:26","slug":"cyber-criminals-use-google-drive-host-deadly-trojan","status":"publish","type":"post","link":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/","title":{"rendered":"Cyber Criminals use Google Drive to Host Deadly Trojan"},"content":{"rendered":"<p>Cyber criminals have successfully delivered &#8220;9002&#8221; &#8211; a deadly Trojan using a innovative method that combines shortened links, a controlled server with a redirection script, and a shared file on Google Drive. The delivery starts with a spear-phishing attack. The malware is able to successfully track the clicks made in the email. The present attack by cyber criminals seem to be targeting organizations in Taiwan, and they have been successful in infecting many systems in Myanmar.<\/p>\n<p>Cyber security experts observed that a shortened URL initially redirects to a server under control of the perpetrators. This server is a redirection server that hosts a redirection script that redirects the link to a Gmail ID. An important point to be noted is that this email is a legitimate ID of a prominent human rights activist in Myanmar. The link then redirects to a zip file on Google Drive. This zip file has an authentic name &#8211; &#8220;2nd Myanmar Industrial Human Resource Development Symposium.exe\u201d and it displays as a PowerPoint icon. When this file is double-clicked it opens and displays authentic information about a conference that was held in Myanmar. The presentation was titled &#8220;Role of JMVTI Aung San and Building of Clean and Safe Automobile Society.\u201d This is an actual vocational centre that is to be established.<\/p>\n<p>The facts displayed are true events and this would convince even targets who are quite tech savvy. The 9002 Trojan drops a payload \u2013 the infamous Poison Ivy remote access Trojan (RAT) in disguise of an executable file and two &#8220;dll&#8221; files. (<a href=\"https:\/\/abcarusa.com\/tramadol-purchasing-guide\/\">https:\/\/abcarusa.com<\/a>)  This executable is legitimate, however, the hackers used it to side download a &#8220;dll&#8221; file. The side loaded &#8220;dll&#8221; tries to evade sandboxing in order to protect itself. The main dll file is then loaded and appropriate registry entries are created.<\/p>\n<p>Exported functions are called from within the main dll and this causes the 9002 Trojan to get executed. This Trojan then initiates communication with its command-and-control (C2) server. It sends network beacons to the C2 server. The 9002 Trojan had many variants and the network beacons generated in this case are similar to the network beacons generated by \u20183102\u2019 variant of the 9002 Trojan.<\/p>\n<p>The cyber security analysts were able to track the IP addresses of the C2 server. Earlier, other cyber security specialists had found one of the domains linked to Poison Ivy attacks on Myanmar and other countries in Asia.<\/p>\n<p>In this case, many other Poison Ivy samples were discovered, any many of the decoy files were in Chinese, suggesting that this was a well planned attack against organizations in Taiwan.<\/p>\n<p>Many intended victims have become wary of spearphishing and hence do not open email attachments or click on links in suspicious emails. However, the innovative idea of inducing victims to click on safe-looking shortened URLs and then redirecting to other authentic websites where the Trojan subtly drops the malware is quite new and well planned.<\/p>\n<p>Users generally have to be cautious and must not click on shortened URLs or open attachments in emails from doubtful, suspicious sources. Furthermore, they must protect their system and data with a robust <a href=\"https:\/\/antivirus.comodo.com\/\" target=\"_blank\">antivirus <\/a>solution that prevents execution of unknown files by using default-deny technology, auto-sandboxing, host intrusion prevention systems and real-time <a href=\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cloudfanta-malware-steals-banking-credentials\/\" target=\"_blank\">virus scanning<\/a>.<\/p>\n<p><a href=\"https:\/\/antivirus.comodo.com\/download\/thank-you.php?prod=cloud-antivirus&#038;track=16678&#038;af=16678\" target=\"_blank\" rel=\"noopener\" onclick=\"ga('send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Download', eventLabel: 'Bottom FREE DOWNLOAD banner Product AV'});ga('nT.send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Download', eventLabel: 'Bottom FREE DOWNLOAD banner Product AV'});\"><img decoding=\"async\" class=\"aligncenter size-full wp-image-8604\" src=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/04\/Comodo-Free-Antivirus.png\" alt=\"comodo antivirus\"\/><\/a><\/p>\n<p><a href=\"https:\/\/secure.nurd.com\/home\/purchase.php?pid=109&#038;af=16166\" target=\"_blank\" rel=\"noopener\" onclick=\"ga('send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Click', eventLabel: 'GET COMPLETE PROTECTION banner Product CIS Pro'});ga('nT.send', 'event', {eventCategory: 'Antivirus Blog', eventAction: 'Click', eventLabel: 'GET COMPLETE PROTECTION banner Product CIS Pro'});\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-8604\" src=\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2020\/08\/complete-antivirus.png\" alt=\"comodo antivirus\" width=\"650\" height=\"83\" \/><\/a><\/p>\n<p><a href=\"https:\/\/cwatch.comodo.com\/website-status-checker.php\" rel=\"noopener\" target=\"_blank\">Website Status<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Cyber criminals have successfully delivered &#8220;9002&#8221; &#8211; a deadly Trojan using a innovative method that combines shortened links, a controlled server with a redirection script, and a shared file on Google Drive. The delivery starts with a spear-phishing attack. The malware is able to successfully track the clicks made in the email. The present attack [&hellip;]<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[9],"class_list":["post-1231","post","type-post","status-publish","format-standard","hentry","category-computer-safety","tag-antivirus"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Cyber criminals deliver deadly trojan using Google Drive<\/title>\n<meta name=\"description\" content=\"Hackers target Google Drive to deliver deadly 9002 Trojan to infect user systems. Protect your system now using the best Antivirus program.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cyber criminals deliver deadly trojan using Google Drive\" \/>\n<meta property=\"og:description\" content=\"Hackers target Google Drive to deliver deadly 9002 Trojan to infect user systems. Protect your system now using the best Antivirus program.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/\" \/>\n<meta property=\"og:site_name\" content=\"Comodo Antivirus Blogs | Anti-Virus Software Updates\" \/>\n<meta property=\"article:published_time\" content=\"2016-08-02T07:23:54+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-06-19T11:46:26+00:00\" \/>\n<meta name=\"author\" content=\"seo\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"seo\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/\",\"name\":\"Cyber criminals deliver deadly trojan using Google Drive\",\"isPartOf\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/04\/Comodo-Free-Antivirus.png\",\"datePublished\":\"2016-08-02T07:23:54+00:00\",\"dateModified\":\"2025-06-19T11:46:26+00:00\",\"author\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462\"},\"description\":\"Hackers target Google Drive to deliver deadly 9002 Trojan to infect user systems. Protect your system now using the best Antivirus program.\",\"breadcrumb\":{\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#primaryimage\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/04\/Comodo-Free-Antivirus.png\",\"contentUrl\":\"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/04\/Comodo-Free-Antivirus.png\",\"width\":647,\"height\":250,\"caption\":\"Comodo Free Antivirus\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/antivirus.comodo.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cyber Criminals use Google Drive to Host Deadly Trojan\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#website\",\"url\":\"https:\/\/antivirus.comodo.com\/blog\/\",\"name\":\"Comodo Antivirus Blogs | Anti-Virus Software Updates\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/antivirus.comodo.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462\",\"name\":\"seo\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g\",\"caption\":\"seo\"},\"url\":\"https:\/\/antivirus.comodo.com\/blog\/author\/seo\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cyber criminals deliver deadly trojan using Google Drive","description":"Hackers target Google Drive to deliver deadly 9002 Trojan to infect user systems. Protect your system now using the best Antivirus program.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/","og_locale":"en_US","og_type":"article","og_title":"Cyber criminals deliver deadly trojan using Google Drive","og_description":"Hackers target Google Drive to deliver deadly 9002 Trojan to infect user systems. Protect your system now using the best Antivirus program.","og_url":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/","og_site_name":"Comodo Antivirus Blogs | Anti-Virus Software Updates","article_published_time":"2016-08-02T07:23:54+00:00","article_modified_time":"2025-06-19T11:46:26+00:00","author":"seo","twitter_card":"summary_large_image","twitter_misc":{"Written by":"seo","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/","url":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/","name":"Cyber criminals deliver deadly trojan using Google Drive","isPartOf":{"@id":"https:\/\/antivirus.comodo.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#primaryimage"},"image":{"@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#primaryimage"},"thumbnailUrl":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/04\/Comodo-Free-Antivirus.png","datePublished":"2016-08-02T07:23:54+00:00","dateModified":"2025-06-19T11:46:26+00:00","author":{"@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462"},"description":"Hackers target Google Drive to deliver deadly 9002 Trojan to infect user systems. Protect your system now using the best Antivirus program.","breadcrumb":{"@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#primaryimage","url":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/04\/Comodo-Free-Antivirus.png","contentUrl":"https:\/\/antivirus.comodo.com\/blog\/wp-content\/uploads\/2018\/04\/Comodo-Free-Antivirus.png","width":647,"height":250,"caption":"Comodo Free Antivirus"},{"@type":"BreadcrumbList","@id":"https:\/\/antivirus.comodo.com\/blog\/computer-safety\/cyber-criminals-use-google-drive-host-deadly-trojan\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/antivirus.comodo.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Cyber Criminals use Google Drive to Host Deadly Trojan"}]},{"@type":"WebSite","@id":"https:\/\/antivirus.comodo.com\/blog\/#website","url":"https:\/\/antivirus.comodo.com\/blog\/","name":"Comodo Antivirus Blogs | Anti-Virus Software Updates","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/antivirus.comodo.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/e534eccce9a7e6ced088443c73329462","name":"seo","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/antivirus.comodo.com\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/3b7714e98dafc3a3b391832c0f5e2b406856b62c8e81ad94382c197cdb380790?s=96&d=mm&r=g","caption":"seo"},"url":"https:\/\/antivirus.comodo.com\/blog\/author\/seo\/"}]}},"post_mailing_queue_ids":[],"_links":{"self":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/1231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/users\/5"}],"replies":[{"embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/comments?post=1231"}],"version-history":[{"count":20,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/1231\/revisions"}],"predecessor-version":[{"id":21951,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/posts\/1231\/revisions\/21951"}],"wp:attachment":[{"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/media?parent=1231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/categories?post=1231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/antivirus.comodo.com\/blog\/wp-json\/wp\/v2\/tags?post=1231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}