DropBook

ATP Sandbox Adv. Heuristics

Stats

First seen: May 2022
Last seen: September 2026

MITRE ATT&CK techniques

9 techniques across 5 tactics.

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.006Python
- T1059.003Windows Command Shell

TA0005 Stealth

T1140Deobfuscate/Decode Files or Information

TA0007 Discovery

T1082System Information Discovery
T1083File and Directory Discovery
T1614System Location Discovery
- T1614.001System Language Discovery

TA0011 Command and Control

T1102Web Service
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1567Exfiltration Over Web Service

Associated groups

G0021Molerats

Alert name variants

Alert Name	Engine
Win32.Backdoor.Dropbook	ATP Sandbox Adv. Heuristics

Related blogs

Cloud Threats Memo: Defining the Latest Dropbox Threat

October 12, 20212 min read

Cloud Threats Memo: Preventing the Exploitation of Dropbox as a Command and Control

July 8, 20211 min read

Related families

Bazar InvisibleFerret Raspberry Robin SharpStage Latrodectus