Canva-C2: SaaS Abuse Research
Investigating the abuse of legitimate cloud services for command distribution, specifically focusing on Canva Document Embeds as a C2 channel.
Technical Overview
The research identifies a critical vulnerability in trust hierarchies where legitimate SaaS embeds are utilized to relay commands to compromised endpoints. By leveraging high-reputation domains, attackers can effectively blend malicious traffic with legitimate business activity.
This protocol bypasses standard web application firewalls (WAFs) and endpoint detection and response (EDR) systems that prioritize traffic from known, trusted cloud environments. Our investigation details the persistence mechanisms and the automated polling infrastructure.
Research Focus
Trusted SaaS Abuse
Exploiting the inherent trust and high reputation of global SaaS platforms for stealthy ingress and data transfer.
Cloud-based Command-and-Control
Implementing distributed C2 infrastructure across global CDN edges, utilizing legitimate document synchronization for command relaying.
Detection Challenges
Statistical noise reduction and traffic blending techniques that defeat heuristic analysis and traditional filters.
Threat Modeling
Quantifying risk for enterprise assets facing sophisticated SaaS-based infiltration vectors.
Defensive Detection Opportunities
Strategic roadmap for SecOps teams to identify indicators of compromise within SaaS traffic without disrupting business operations.
Proof-of-Concept
Defensive Detection Opportunities
| Vector Component | Detection Indicator | Severity | Action |
|---|---|---|---|
| Embed Polling | High frequency GET requests to 'canva.com/_embed' from non-interactive system users. | CRITICAL | Network Block |
| Agent Heartbeat | Persistent encrypted local traffic between on-device processes and external cloud hooks. | HIGH | Process Kill |
| Correlation | Correlating endpoint telemetry with network events. | SIEM Check | |
| Hunting | Threat hunting across cloud service usage | SIEM Check |