01
Mustang Panda: The APT Group That Turned OneDrive Into a Command Server
Mustang Panda, the China-linked APT group, routes its command and control (C2) infrastructure through services like OneDrive, Google Drive, or Dropbox. The generated traffic is technically indistinguishable from normal corporate file synchronization: it uses the same TLS certificates, the same domains, and passes through firewalls without alerts because it is whitelisted by any organization using Microsoft 365 or Google Workspace.