Abuse of Google Drive Download URLs for Malicious Payload Delivery

Threat actors are increasingly leveraging the trusted infrastructure of Google Drive to host and distribute malicious payloads, including malware such as Matanbuchus. By crafting specific download URLs that include the 'export=download' and 'confirm=no_antivirus' parameters, attackers intentionally bypass Google's automated virus scanning mechanisms for large files. This technique allows malicious files to be delivered directly to victims via a platform that is typically trusted by enterprise security policies and web filters. Defenders must monitor process execution logs to identify browser-based or command-line utility-based downloads that contain these specific URL parameters, as they represent an active attempt to deliver payloads while subverting standard cloud-based security controls.

Attack Chain

1. Attacker stages a malicious payload (e.g., installer or script) on a Google Drive account.
2. Attacker configures the file permissions to public access and generates a shareable download link.
3. Attacker modifies the URL to include 'export=download' and 'confirm=no_antivirus' to bypass Google's security checks.
4. Victim is lured via phishing or social engineering to click the malicious URL.
5. The victim's browser or a command-line tool (curl/wget) executes the download request.
6. Endpoint security logs record the process command line containing the bypass parameters.
7. The file is saved to the local filesystem for execution.
8. Final objective is achieved through the execution of the downloaded malicious payload.

Impact

Successful exploitation allows for the delivery of malware directly to endpoints while evading native cloud security scanning. This facilitates the initial access or secondary payload deployment stages of an attack, potentially leading to system compromise, data exfiltration, or further lateral movement within an organization.

Recommendation

Prioritize the detection of file download activity originating from Google Drive that attempts to explicitly skip security scanning.

• Deploy the provided Sigma rule to identify command-line activity containing 'confirm=no_antivirus'.
• Monitor logs for unauthorized use of command-line tools like curl or wget to reach cloud storage providers.
• Educate users on the risks of clicking links from untrusted sources, even if they point to reputable domains like drive.google.com.
• If the environment does not rely on external cloud storage for business, consider blocking access to specific 'export=download' patterns at the proxy or gateway level.