OneDriveDoor
OneDriveDoor is a backdoor used by the China-linked APT31 espionage group. It is explicitly described as using Microsoft OneDrive for command-and-control (C2) communication, allowing the actor to blend malicious traffic with legitimate cloud service usage and complicate detection. Reporting places its use within a broader APT31 campaign targeting Russia’s IT sector, especially contractors and integrators supporting government agencies, with activity observed from at least late 2022 and intensifying in 2024–2025. The wider intrusion set involved targeted phishing, archive-based lures, DLL sideloading, credential theft, local file discovery, and collection of sensitive data from sources such as browsers and Windows Sticky Notes. The malware is associated with APT31, also tracked as Judgment Panda, TA412, and Violet Typhoon. High-confidence details in the provided content do not include specific OneDriveDoor persistence mechanisms, file paths, or standalone indicators of compromise beyond its use of Microsoft OneDrive as C2.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A backdoor malware used by APT31 that leverages Microsoft OneDrive for command-and-control (C2) communications, enabling covert remote access and data exfiltration.
Backdoor that uses Microsoft OneDrive as its command-and-control channel.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.