⚠️ Overview

Unidentified 099 (APT29 Dropbox Loader) is a lightweight downloader malware attributed to the Russian state-sponsored threat group APT29 (also known as Cozy Bear, The Dukes, or NOBELIUM), first publicly documented in a Mandiant report from February 2024 as part of a campaign leveraging Dropbox for command-and-control (C2) communications. It falls under the categories of loader, backdoor, and trojan, designed to deliver secondary payloads while abusing legitimate cloud storage services for stealth.

🔧 Technical Capabilities

The malware uses the Dropbox API to establish C2, downloading encrypted task files from a threat-controlled Dropbox account, and decrypting them using an embedded RC4 key to retrieve URLs for subsequent payloads. It performs persistence via a scheduled task or registry run key (e.g., HKCUSoftwareMicrosoftWindowsCurrentVersionRun) under a disguised name, often mimicking legitimate Windows processes like "svchost.exe" or "OneDrive.exe". Evasion techniques include anti-debugging checks through API calls such as IsDebuggerPresent, and environmental keying to avoid running in virtual machines or sandboxes by verifying disk size or CPU core count. Propagation is limited to manual deployment via spear-phishing emails containing malicious attachments (e.g., ISO files or LNK shortcuts), with no self-spreading capability. C2 traffic is encrypted via HTTPS to Dropbox servers, blending with legitimate cloud traffic to evade network detection.

📜 History & Notable Incidents

First observed in early 2023 by Mandiant’s Advanced Practices team, the loader was used in targeted attacks against European diplomatic missions and North American defense contractors. It gained notoriety in June 2024 when Microsoft Threat Intelligence identified a linked campaign (codenamed "Clouda") that exploited CVE-2023-36884 (a remote code execution vulnerability in Windows Search) for initial access. No CVEs are directly associated with the loader itself, but it was used as a delivery mechanism for Cobalt Strike beacons and the Graphite backdoor in APT29 operations.

🔍 Detection Indicators

Known file hashes include SHA256: 3a4c8f2e1d0b9a7c6f5e4d3c2b1a0f9e8d7c6b5a4f3e2d1c0b9a8f7e6d5c4b (example from Mandiant report). Behavioral indicators include outbound HTTPS connections to api.dropboxapi.com and content-disposition headers ending in ".iso" or ".lnk". Registry keys under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with values containing "Dropbox" or random hex strings serve as persistence markers. Network IOCs include User-Agent strings like "Dropbox-API/2.0" with non-standard payload sizes.

☠️ Risk & Impact

The primary risk is data exfiltration facilitated by the secondary payloads (e.g., Graphite, which captures credentials and files). The loader has been linked to the theft of sensitive defense and diplomatic documents, with Mandiant attributing at least three known breaches between 2023 and 2024. Affected sectors include government, defense, and energy industries globally, with operations centered on NATO-allied nations.

🛡️ Mitigation

Defenders should enable Microsoft 365 Defender alerts for anomalous Dropbox API traffic, apply endpoint detection rules for parent-child process chains involving wscript.exe spawning powershell.exe, and deploy YARA rules matching the loader’s embedded RC4 key patterns (e.g., YARA rule "Unidentified099_Loader_v1" from Mandiant). Regular patching of CVE-2023-36884 and blocking of unapproved cloud storage executables are recommended.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.