⚠️ Overview

Gdrive is a Python-based remote access trojan (RAT) first documented by Palo Alto Networks Unit 42 in April 2021. The malware is operated by an unknown threat actor and abuses the Google Drive cloud storage service as its command-and-control (C2) infrastructure. It falls under the RAT category and relies on the Google Drive API for bidirectional communication.

🔧 Technical Capabilities

Gdrive uses the Google Drive API to upload and download files that contain encoded commands and exfiltrated data. The attacker creates a plaintext file on a designated Google Drive folder; the victim’s instance reads that file, executes the embedded command (e.g., download, upload, keylog, reverse shell), and writes the output back to the same service. Persistence is achieved via a Windows Registry run key, typically at HKCUSoftwareMicrosoftWindowsCurrentVersionRunGdrive. Evasion techniques include base64 encoding of payloads, using standard HTTPS traffic to googleapis.com, and dynamically generating the OAuth 2.0 token. The malware does not self-propagate; initial infection occurs through phishing emails or malicious attachments. According to MITRE ATT&CK, the technique is mapped to T1102 (Web Service for C2) and T1572 (Protocol Tunneling).

📜 History & Notable Incidents

Gdrive was first identified in early 2021 during an investigation by Unit 42 into a campaign targeting Southeast Asian organizations. No high-profile victims have been publicly named, and the malware has not been linked to any specific advanced persistent threat (APT) group, though Unit 42 noted code similarities to other Chinese-language RATs. No CVEs have been associated with Gdrive itself, as it abuses legitimate Google Drive functionality rather than exploiting software vulnerabilities.

🔍 Detection Indicators

Indicators of compromise include Python scripts (e.g., Gdrive.py or main.py) that contain hardcoded Google Drive OAuth tokens and folder IDs. Network traffic to www.googleapis.com (specifically the /upload/drive/v3/files and /drive/v3/files endpoints) with anomalous file names such as commands.txt or output.txt is suspicious. Registry persistence key HKCUSoftwareMicrosoftWindowsCurrentVersionRunGdrive is another indicator. No static hashes are publicly available because the malware is often recompiled per victim.

☠️ Risk & Impact

Gdrive can exfiltrate arbitrary files, log keystrokes, and execute system commands, leading to data theft and potential lateral movement. The primary risk is espionage or data exfiltration targeting government, military, and telecommunications sectors in Southeast Asia. Financial losses from stolen intellectual property or credential theft are possible but have not been publicly quantified.

🛡️ Mitigation

Defenders should monitor for unauthorized OAuth tokens granted to Google Drive APIs, apply application allowlisting to block untrusted Python interpreters, and deploy endpoint detection rules based on the YARA signatures provided in the Unit 42 report. Regular phishing awareness training and network segmentation can reduce the initial attack surface. Refer to the Palo Alto Networks Unit 42 blog post (April 2021) for detailed detection rules.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.