APT Attacks Using Cloud Storage

AhnLab ASEC details a targeted malware campaign in which threat actors host decoy documents and malicious scripts on cloud storage (Dropbox, Google Drive). Victims are lured by .LNK shortcut files that run Base64-encoded PowerShell, which downloads additional scripts, registers scheduled tasks for persistence, and ultimately loads a customized XenoRAT payload in-memory; the RAT provides C2 access (159.100.29.122:8811), data collection/exfiltration, and remote control. The report provides multiple IoCs (MD5s, C2 URL, attacker email addresses) and recommends caution with file extensions and cloud-hosted content.