*.cloudapp.net

Phishing Download Exfiltration C&C

Attackers can use a customized subdomain of cloudapp.net to host their phishing websites.

Attackers can use a customized subdomain of cloudapp.net as their C&C server.

Attackers can add upload functionalities hosted on *.cloudapp.net and exfiltrate data on there.

Malicious tools can be stored on *.cloudapp.net and downloaded when required.

https://app.any.run/tasks/4e40f95a-4829-4901-b348-1d92b61d59c5/