Russian Hackers Leverage Oracle Cloud Infrastructure to Scaleway Object Storage

In a sophisticated cybersecurity attack uncovered this week, Russian threat actors have been observed exploiting multiple cloud service providers to deliver the notorious Lumma Stealer malware. The campaign utilizes legitimate cloud infrastructure—including Oracle Cloud Infrastructure (OCI), Scaleway Object Storage, and Tigris—to host malicious content that targets privileged users across various organizations. Security experts warn this […] The post Russian Hackers Leverage Oracle Cloud Infrastructure to Scaleway Object Storage appeared first on Cyber Security News.

May 22, 2025 - 20:30

Russian Hackers Leverage Oracle Cloud Infrastructure to Scaleway Object Storage

In a sophisticated cybersecurity attack uncovered this week, Russian threat actors have been observed exploiting multiple cloud service providers to deliver the notorious Lumma Stealer malware.

The campaign utilizes legitimate cloud infrastructure—including Oracle Cloud Infrastructure (OCI), Scaleway Object Storage, and Tigris—to host malicious content that targets privileged users across various organizations.

Security experts warn this represents a growing trend of threat actors leveraging trusted cloud platforms to bypass traditional security controls.

Fake reCAPTCHA page hosted on Tigris Object Storage (Source – CATONetworks)

The attackers employ social engineering tactics that lure victims through disguised free game downloads and fake reCAPTCHA verification pages.

These deceptive elements are strategically hosted across different cloud providers, creating a distributed attack infrastructure that proves difficult to detect and mitigate.

Once users interact with these seemingly legitimate elements, they unknowingly initiate a complex infection chain that ultimately delivers the Lumma Stealer malware.

CATO Networks researchers identified the campaign through their threat intelligence operations, noting the sophisticated use of multiple cloud providers as a deliberate tactic to enhance the attack’s resilience.

“By distributing malicious components across Oracle Cloud Infrastructure, Scaleway, and Tigris, the attackers create redundancy that helps them maintain persistence even if one hosting location is discovered and blocked,” explained Guile Domingo, SOC Analyst at Cato Networks.

The attack’s technical sophistication is evident in its multi-stage approach. Initial compromise begins when users encounter malicious links, often through phishing emails or compromised websites.

These links direct victims to cloud-hosted content that appears legitimate but contains hidden malicious code.

The attackers specifically target privileged users who may have access to valuable organizational data or credentials, making this campaign particularly dangerous for enterprises.

Analysis of the attack infrastructure reveals an extensive network of malicious domains and URLs spread across multiple cloud providers.

Particularly concerning is the attackers’ ability to maintain persistent access to victims’ systems through advanced techniques like DLL search order hijacking, which allows the malware to establish itself securely on infected systems.

Infection Mechanism: The Path to Compromise

The infection process begins when victims interact with either disguised free game downloads or fake reCAPTCHA verification forms.

Detection timeline of a disguised free game download (Source – CATONetworks)

The game download scenario involves a seemingly legitimate software installation that secretly delivers malicious components.

The user believes they’re downloading popular gaming software, but instead receive an archive containing the Lumma Stealer malware.

Detection timeline of a fake reCAPTCHA hosted in Tigris Object Storage (Source – CATONetworks)

Similarly, the fake reCAPTCHA challenges hosted in Tigris Object Storage trick users into engaging with malicious content.

URLs such as “fly.storage.tigris.showing-next-go.html” and similarly structured addresses on Oracle Cloud (objectstorage.ap-seoul-1.oraclecloud.com) and Scaleway (datastream-dist.s3.pl-waw.scw.cloud) host these verification challenges that ultimately lead to malware infection.

When users interact with these elements, the system downloads a ZIP archive (identified as “DOwnl0@d Comp!3t3 L@t3st PC Setup.zip”) containing a signed executable (“setup[.]exe”).

This legitimate-appearing executable then executes the Lumma Stealer from memory, allowing it to harvest credentials, cryptocurrency wallets, and other sensitive information without being detected by traditional security solutions.

The attackers further enhance their chances of success by using DLL search order hijacking via a malicious MpGear.dll file.

This technique ensures the malware loads automatically when certain legitimate applications are launched, providing persistence on infected systems and allowing continuous data exfiltration over extended periods.

Security professionals recommend implementing advanced threat detection systems capable of identifying suspicious cloud-hosted content, maintaining strict access controls for privileged users, and deploying comprehensive endpoint protection solutions to mitigate the risk posed by this and similar campaigns.

Equip your SOC team with deep threat analysis for faster response -> Get Extra

Read More

Tags:

Previous Article

Gujarat Teen Behind 50+ Cyberattacks During ‘Operation Sindoor’ Arrested

Next Article

Halo Security Achieves SOC 2 Type 1 Compliance, Validating Security Controls for...

Related Posts

Weaponized Google Calendar Invites Delivers Malicious P...

May 14, 2025 0

PoC Published For Fortinet 0-Day Vulnerability That Bei...

May 23, 2025 0

10 Best NGINX Monitoring Tools – 2025

May 17, 2025 0

Name

Email

Comment