Grandoreiro C2 via Google Cloud Pub/Sub HTTPS and MQTT Cloud Relay

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•0

Detects outbound network communication and DNS queries to cloud service endpoints (Google Cloud Pub/Sub, Azure MQTT, AWS IoT) originated by non-browser and non-cloud processes, which is a technique used by Grandoreiro banking trojan variants that side-load modules to tunnel command-and-control traffic.