21 June 2024

This rising trend is against a backdrop of continued increase in cloud app adoption in the sector, where users engage strongly with a small selection of popular apps. Tracking with this increased use of cloud apps, telecoms is the biggest victim of cloud-sourced malware by a considerable 7% margin compared to other industries.

Users in the telecoms industry upload and download files to cloud apps at a similar rate to other industries, but tend to interact with fewer cloud apps on average. The average user in telcos interacts with 24 cloud apps per month, with a strong preference for Microsoft apps. Microsoft OneDrive, Teams, and Outlook are the industry's top three most popular apps. Microsoft OneDrive is also the most popular app for uploading data, with 30% of telecom industry users uploading data to OneDrive daily, 50% more than the average across all industries. Similarly, Microsoft OneDrive is the most popular app for downloads in the telecoms industry, with 35% of users downloading from it.

The percentage of malware downloads from telco industry users fell in line with the global trend, bottoming out in the second half of 2023 and beginning to increase again in early 2024. Organisations in the telecoms industry are the biggest victims of cloud-sourced malware by a considerable 7% margin compared to other industries. Microsoft OneDrive and GitHub had the most malware downloads, followed by Outlook. The other apps in the top 10 are similar to those in other industries with only minor differences, including more malware downloads from SourceForce, the open-source software development website and Google Cloud Storage.

Among the most prevalent malware families targeting organisations in the telecoms industry were the remote access Trojan Remcos, the downloader Guloader, and the infostealer AgentTesla.

“Users in the telecoms industry tend to interact with fewer cloud apps in comparison to other verticals, yet the percentage of malware delivered from the cloud is 7 points higher than the other sectors. This indicates that employees within the sector have a more open attitude to cloud services and this inevitably reflects in a wider exposure to threats. They are more familiar with online tools such as cloud apps and this figure shows that threat actors tend to exploit this familiarity,” said Paolo Passeri, cyber intelligence principal at Netskope. “This open attitude towards online services is also visible in the malware families that target telecoms users. In comparison to other verticals, there are many more malware families targeting this sector, with a wide range of threats spanning from IoT (the omnipresent Mirai) to downloaders (BanLoad and Guloader), banking trojans (Grandoreiro), infostealers (such as AgentTesla and Redline), and phishing bait PDF documents. Interestingly many of these threats are characterised by the exploitation of authentic and well reputed cloud services throughout different stages of the attack chain: Guloader stores the encrypted payload on legitimate cloud services such as Microsoft OneDrive or Google Drive, Grandoreiro often abuses Microsoft Azure (but also AWS and Google) to deliver the final payload, and even phishing bait PDF documents are often hosted on legitimate cloud storage service to seem more realistic and legitimate.”