APT41 GearDoor C2 via Google Drive - High-Frequency Non-Browser Connections

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•2

Detects high-frequency HTTPS network connections to Google Drive or Google APIs originating from processes that are not common web browsers or productivity software. This behavior is indicative of the GearDoor backdoor, commonly used by APT41, which leverages Google services as a command-and-control (C2) channel.