Product
Zoho WorkDrive
- First Reported
- Feb 26, 2026
- Latest Reported
- Jun 28, 2026
Reported Context (3)
- by Mustang Panda targeting Indian government entities, delivering new malware implants and abusing Zoho WorkDrive, a legitimate cloud storage platform commonly used in the Indian government sector. Mustang Panda Campaigns Target Indian Government and Energy Sectors With New Malware
- It receives attacker commands and exfiltrates stolen data through the OAuth2 API of Zoho WorkDrive, with two sets of OAuth authentication tokens hardcoded in the binary for this purpose. APT37 Uses Facebook Pretexting and a Tampered PDF Installer to Target Victims
- ThreatLabz discovered RESTLEAF, an initial implant that uses Zoho WorkDrive for C2 communications to fetch additional payloads, like SNAKEDROPPER. APT37 Uses Ruby Jumper Malware to Bridge Air-Gapped Networks via Removable Media
Malware (14)
People (2)
Threat Actors (6)
MITRE ATT&CK (28)
Vendors (4)
Products (14)
Tools (1)
Industries (2)
Countries (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.