Malware uses Google Docs to communicate with control hub
A new iteration of backdoor trojan Makadocs is capable of hiding its command-and-control (C&C) server communications by abusing a legitimate Google Docs function.
Symantec researchers discovered that the malware used Google Docs, a document sharing and editing service, as a proxy server, or intermediary step, to pass along information to C&C servers, according to a Friday blog post.
The tweaked code is even capable of comprising machines running Microsoft's Windows 8 operating system, released last month, and Windows Server 2012, the server version of Windows 8 that became generally available to the public in September. Kevin Haley, director of Symantec Security Response, told SCMagazine.com Monday that only a small number of Makadocs infections, fewer than 100, have been detected, mostly in Brazil. The individuals behind the malware apparently were just testing out the updated malware.
