Cloud Tools as Command & Control: How Slack, Discord, Outlook Became APT Infrastructure

Chinese APT abused Slack, Discord, Outlook, file.io for command & control. How legitimate cloud services defeat traditional incident detection—and how to r

Cloud Tools as Command & Control: How Slack, Discord, Outlook Became APT Infrastructure

A Chinese APT group targeting Mongolia discovered something that makes network defense nearly impossible: legitimate cloud services are better infrastructure than custom command-and-control servers.

Instead of building malware with hardcoded C2 domains (which defenders block), they abused Microsoft Outlook, Slack, Discord, and file.io as communication channels. The advantage isn't just evasion—it's operational resilience. Cloud services scale, have built-in redundancy, and are almost impossible to block without breaking business functionality.

Why Cloud Tools Make Perfect C2 Infrastructure

Traditional APT C2 servers have problems:

Sinkhole-able: A single domain can be taken offline
Detectable: Network IDS can fingerprint command patterns
Attributable: Hosting infrastructure leads back to attackers
Fragile: If the primary C2 fails, the operation is compromised

Cloud-based C2 using legitimate services has none of these problems:

Widespread legitimate traffic: Millions of organizations use Slack daily. Slack messages to unknown channels blend into background noise.
Built-in encryption: Slack, Discord, and cloud file services use TLS. Network-level inspection sees only encrypted traffic to legitimate platforms.
Plausible deniability: Defenders can't block Slack without breaking email and collaboration. Organizations won't do it.
Redundancy and scale: If one channel is detected, attackers switch to another. Discord, Slack, Outlook, file.io—all can serve the same purpose.

The Attack Pattern: Abuse, Don't Build

The Chinese APT group's workflow:

1. Initial compromise: Spear-phishing or supply-chain attack on Mongolian government target

2. Cloud service abuse:

Create Slack workspace and invite compromised user account
Attacker joins same workspace with fake account
Post commands in encrypted channel (Slack DMs are end-to-end)
Malware polls Slack for new messages
Responses posted back to same Slack channel or file.io

3. Discord usage:

Similar pattern but with server-based C2
Discord bots can be weaponized to relay commands
File uploads to Discord bypass normal file monitoring

4. Outlook abuse:

Compromised account's mailbox monitored for incoming emails
Commands hidden in subject lines or email body
Responses sent back as reply or forwarded to attacker account

5. file.io leverage:

Temporary file hosting that auto-deletes after first download
Perfect for exfiltrating sensitive documents
No logs, minimal attribution surface

Why Detection Fails

Threat hunters look for:

Suspicious domains
Unusual port activity
Known malware signatures

They see instead:

Slack API calls (legitimate application traffic)
HTTPS to Discord (encrypted, indistinguishable from real Discord users)
Outlook email syncing (expected behavior on compromised device)
file.io downloads (could be anything)

The signals that would trigger alerts on custom C2 (repeated connections to unknown IPs, suspicious domain registration, DNS query patterns) don't exist when using cloud infrastructure.

Real-World Impact: Mongolia Election Systems Targeted

Mongolia's government systems were the target, suggesting this wasn't espionage for financial gain but political intelligence gathering. The sophisticated C2 setup implies:

Long-term persistence goals (not smash-and-grab)
Need for reliable command execution over weeks or months
Expectation that traditional C2 would be detected

Using cloud services means Mongolian defenders faced a dilemma: block Slack and Discord globally (economically unfeasible) or accept that C2 activity looks identical to legitimate traffic.

What Actually Catches Cloud-Based C2

1. Behavioral monitoring: Track which users and devices interact with cloud services and when. A desktop that's never used Slack suddenly joining a Slack workspace is anomalous.

2. API fingerprinting: Slack's legitimate client uses specific API calls in specific sequences. Malware using Slack's APIs often calls them out of order (e.g., reading messages before joining a channel).

3. Exfiltration volume: Even cloud-based C2 eventually moves data. file.io transfers of unusually large files to unknown IPs (file.io relays to attacker infrastructure) is detectable.

4. Credential usage analysis: If a compromised user's Slack account is active at times they're not working, that's a detection opportunity.

5. Cloud access anomalies: Logging into Slack from unusual locations or with unusual frequency is detectable through cloud provider logs.

Why This Changes Everything

Cybersecurity has operated on an assumption: "Defenders control the network; attackers hide in the noise."

But when attackers abuse legitimate infrastructure, that assumption breaks down. Defenders can't filter Slack without breaking productivity. They can't block Discord because remote workers need it. Outlook is infrastructure itself.

This forces a fundamental shift: instead of relying on network detection to catch C2, organizations must:

Monitor user behavior against their normal patterns
Inspect cloud provider audit logs (Slack API access, Discord server activity)
Watch for data exfiltration through cloud services
Assume C2 will use legitimate channels and focus on detecting the behavior of C2, not the traffic patterns

Defense Implications

For development teams building secure systems:

Assume attacker C2 won't be detectable on the network layer
Build applications that don't phone home over unexpected channels
Monitor what cloud services your code connects to
Implement code review checks that flag unexpected Slack, Discord, or file.io API calls

For infrastructure teams:

Cloud service logs are now your primary C2 detection surface
Audit which users and systems have access to cloud platforms
Monitor for service abuse (unusual workspace creation, channel activity, file transfers)
Treat cloud API access with the same scrutiny as network access

Vouch's security analysis catches patterns where code establishes unexpected connections to cloud services or encodes commands in seemingly legitimate traffic. If malware is using Slack for C2, the code that implements it needs to authenticate, parse responses, and execute commands—and those patterns can be detected before the attack runs.

The future of APT operations isn't custom malware and custom C2. It's weaponizing the infrastructure defenders depend on.