{
  "family": "cloudscout",
  "sample_count": 67,
  "category": "advanced_threat",
  "description": "CloudScout (cataloged by cybersecurity research labs under designations including Trojan:Win32/CloudScout and Backdoor.CloudScout) is a sophisticated, modular post-compromise cyber espionage framework written in C# (.NET) discovered in 2024 by ESET research. The malware is definitively attributed to the China-aligned Advanced Persistent Threat (APT) group known as Evasive Panda (also tracked as Daggerfly, Bronze Highland, and StormBamboo). Operating as specialized extension plugins for Evasive Panda's flagship MgBot backdoor, CloudScout is specifically engineered to steal web session cookies from compromised endpoints. By exfiltrating active session tokens, CloudScout enables threat actors to hijack user sessions and bypass Multi-Factor Authentication (MFA) on major cloud platforms including Google Drive, Gmail, and Microsoft Outlook without requiring user passwords. It has been deployed in targeted cyber espionage operations against government bodies and religious organizations.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/CloudScout",
    "CloudScout",
    "Backdoor.CloudScout",
    "Evasive Panda CloudScout"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the CloudScout malware framework?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "CloudScout is an advanced .NET post-exploitation tool used by Evasive Panda to steal cloud session tokens and bypass MFA."
      }
    },
    {
      "@type": "Question",
      "name": "Which threat actor operates CloudScout?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is operated by the China-aligned APT group Evasive Panda (also known as Daggerfly, Bronze Highland, or StormBamboo)."
      }
    },
    {
      "@type": "Question",
      "name": "How does CloudScout bypass Multi-Factor Authentication (MFA)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It extracts authenticated session cookies directly from web browsers, allowing attackers to access cloud accounts without credentials."
      }
    },
    {
      "@type": "Question",
      "name": "Which cloud services are specifically targeted by CloudScout?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It specifically targets Google Drive, Gmail, and Microsoft Outlook / 365 cloud environments."
      }
    },
    {
      "@type": "Question",
      "name": "How should enterprise security teams defend against CloudScout?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Enforce Conditional Access policies, shorten session token lifespans, utilize FIDO2 hardware keys, and monitor EDR process injections."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1539",
    "T1550.004",
    "T1566.001",
    "T1059.003",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1189",
      "name": "Drive-by Compromise",
      "tactic": "Initial Access"
    },
    {
      "id": "T1176",
      "name": "Browser Extensions",
      "tactic": "Persistence"
    },
    {
      "id": "T1112",
      "name": "Modify Registry",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Quarantine the endpoint to halt the active exfiltration of browsing telemetry and the downloading of further adware modules.",
    "Audit Windows Group Policies and the Registry to remove any forced extension installation policies (ExtensionInstallForcelist) created by the adware.",
    "Deploy an enterprise adware removal tool (e.g., AdwCleaner) to locate and strip the deeply embedded registry hooks and watchdog services.",
    "Force a complete reset of all installed web browsers to factory defaults to eradicate the rogue extensions and restore the homepage."
  ],
  "what_to_avoid": [
    "Do not rely solely on the browser's 'remove extension' button; Cloudscout frequently uses GPOs and watchdog services to immediately reinstall itself.",
    "Avoid ignoring the infection; adware tracking data is highly detailed and may expose corporate activities or access to internal portals."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "State-Sponsored Cyber Espionage",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2024,
  "threat_actor": "Evasive Panda (Daggerfly / Bronze Highland / StormBamboo)",
  "delivery_mechanism": [
    "MgBot Backdoor Modular Plugin Injection",
    "Spearphishing Email Campaigns",
    "Watering Hole Compromises"
  ],
  "target_platforms": [
    "Windows Server 2022",
    "Windows 11",
    "Windows 10"
  ],
  "capabilities": [
    "Cloud Session Cookie Exfiltration",
    "MFA Authentication Bypass via Session Hijacking",
    "Google Drive and Gmail Data Siphoning",
    "Microsoft Outlook Email Harvesting",
    "Modular .NET Plugin Architecture"
  ],
  "technical_analysis": {
    "file_types": [
      ".NET Framework Assembly (C#)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTPS API requests to Google Workspace and Microsoft Graph APIs using stolen bearer cookies",
      "Encrypted communication channeled through local MgBot pipe handles"
    ],
    "evasion_techniques": [
      "Executing purely as in-memory .NET plugins dispatched by parent MgBot instances",
      "Direct SQLite database parsing of browser cookie stores"
    ],
    "persistence_mechanisms": [
      "Relies on parent MgBot persistence mechanisms and scheduled services"
    ]
  },
  "impact": {
    "confidentiality": "High",
    "integrity": "High",
    "availability": "Medium",
    "scope": "Targeted enterprise espionage, mass cloud email and document exfiltration, complete MFA bypass"
  },
  "lineage": {
    "derived_from": [
      "Evasive Panda / Daggerfly Custom Espionage Toolsets"
    ],
    "variants": [
      "CloudScout-Google",
      "CloudScout-Outlook"
    ]
  },
  "iocs": {
    "file_hashes": [
      "7c8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d",
      "8d9e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e"
    ],
    "delivery": [
      "cloudscout_plugin.dll",
      "mgbot_loader.exe"
    ],
    "persistence": [
      "%ProgramData%\\MgBot\\plugins\\cloudscout.dll"
    ]
  },
  "sources": [
    {
      "name": "ESET Research (WeLiveSecurity) - CloudScout: Evasive Panda exfiltrates cloud data with stolen cookies",
      "url": "https://www.welivesecurity.com"
    },
    {
      "name": "The Hacker News - Evasive Panda Uses New CloudScout Toolset to Steal Cloud Session Cookies",
      "url": "https://thehackernews.com"
    }
  ]
}