Old Gremlins, new methods

**OldGremlin resumed targeted phishing campaigns in March 2022 against Russian companies, using carefully crafted emails that delivered malicious Office documents hosted on Dropbox and LNK/WebDAV downloaders to deploy a custom Node.js-based backdoor named TinyFluff (successor to TinyNode); TinyFluff uses DGA and DNS tunneling for C2, supports reconnaissance, file theft, SOCKS proxying and remote code execution, and Group-IB provides detailed IOCs (domains, IPs, file hashes, and sample links) and mappings to MITRE ATT&CK.**