Trend Micro analyzed a targeted attack against a Taiwanese government entity which used a variant of the PlugX RAT that abuses the Dropbox service. The trick was adopted by attackers to mask the malicious traffic and make hard the detection by law enforcement and security firms. The use of Dropbox aids in masking malicious traffic in the network because this is a legitimate website for storing files and documents. This is the first instance weve seen this technique of using Dropbox to update its C&C settings in the cases we analyzed related to targeted attacks.”]