Russian APT29 Hackers Use Online Storage Services, Drop Box and Google Drive
Summary: Unit 42 reports that the Russian SVR-linked APT29 group, tracked as Cloaked Ursa, used DropBox and then Google Drive to host malware in phishing campaigns targeting Western diplomatic missions between May and June 2022. The lures were PDFs named Agenda.pdf that linked to an EnvyScout HTML dropper, which used HTML smuggling to write a malicious ISO file to the target's drive and ultimately deliver a Cobalt Strike payload.
Why it matters: The group's shift to Google Drive and DropBox means the delivery path runs through services your users and filters already trust, and the ISO only executes after a user double-clicks it, so endpoint controls and user behavior are the remaining line of defense.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026