APT-31 Leverages COVID-19 Vaccine Theme

Zscaler ThreatLabZ analyzes an APT-31 campaign that distributed malicious MSI installers (masquerading as COVID-19 vaccine PDFs) hosted on attacker GitHub accounts; the MSI drops a PyInstaller-packed Python binary that uses Dropbox API for C2, steals browser credentials, establishes persistence via a Run registry key, and exfiltrates data. The report includes attack flow reconstruction, decompiled Python payload, MITRE ATT&CK mapping, and extensive IOCs (MD5 hashes, filenames, GitHub URLs, LNK metadata).