WIP26 Espionage | Threat Actors Abuse Cloud Infrastructure in Targeted Telco Attacks

By Aleksandar Milenkoski, Collin Farr, and Joey Chen, in collaboration with QGroup

Executive Summary

• A new threat cluster we track as WIP26 has been targeting telecommunication providers in the Middle East.


• We assess it is likely that WIP26 is espionage-related.


• WIP26 relies heavily on public Cloud infrastructure in an attempt to evade detection by making malicious traffic look legitimate.


• WIP26 involves the use of backdoors, dubbed CMD365 and CMDEmber, which abuse Microsoft 365 Mail and Google Firebase services for C2 …

abuse attacks backdoors chen cloud cloud infrastructure cluster cmd365 collaboration detection espionage executive infrastructure making malicious malware analysis middle east public public cloud public cloud infrastructure qgroup targeting telco telecommunication telecommunication providers threat threat actors traffic wip26