Threat Group Cards: A Threat Actor Encyclopedia Archived: 2026-04-05 22:21:02 UTC Home > List all groups > List all tools > List all groups using tool NETVulture Tool: NETVulture Names NETVulture Category Malware Type Backdoor Description (ESET) Named NETVulture and developed in C#, this new backdoor uses OneDrive as its C&C server and relies on Microsoft Graph authentication to access the cloud storage, like a normal application using OneDrive would, in order to receive commands or exfiltrate data. We believe that the group is creating its own OneDrive accounts and not using accounts stolen from its victims. Information Last change to this tool card: 10 February 2022 Download this tool card in JSON format All groups using tool NETVulture Changed Name Country Observed APT groups   Turla, Waterbug, Venomous Bear 1996-2024   1 group listed (1 APT, 0 other, 0 unknown) Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3e6e9854-ece9-4a08-bd07-e39aa507a423 https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=3e6e9854-ece9-4a08-bd07-e39aa507a423 Page 1 of 1