Threat Research

APT43’s Multi-Level Dropbox Commands and TutorialRAT

Genians-Korea
APT43 Behind the Scenes Multistage Dropbox Commands and TutorialRAT

◈ Executive Summary  

  • Impersonating policy conferences, advisory meetings, surveys, and lecture notifications  
  • Initial access starts with legitimate emails, utilizing responsive spear-phishing strategies  
  • Utilizing multistage attack chain of legitimate Dropbox and TutorialRAT attacks  
  • Confirmed as an extension of APT43 group’s BabyShark threat campaign  
  • Preemptive identification possible through Genian EDR’s XBA anomaly detection technology     

Full Report: https://www.genians.co.kr/blog/threat_intelligence/dropbox

Tags: PHISHING, EDR, INITIAL ACCESS

Check this following Post also