VERY IMPORTANT

Malwarebytes has identified several payloads being dropped in this campaign, including a backdoor that was new to us that they call DBoxAgent due to its use of Dropbox as a command-and-control server. Victimology analysis helped them to confirm their assumption of the Winnti threat group behind this attack with the KeyPlug malware used as final payload.