Winnti APT group docks in Sri Lanka for new campaign - Malwarebytes Threat Intelligence Report

Malwarebytes Threat Intelligence documents a multi-stage Winnti (APT41) campaign active in August that targeted Sri Lankan government entities via a lured ISO ('economic assistance.iso'). The attack used signed legitimate executables for DLL sideloading to run a malicious DLL (DBoxAgent) that communicates with Dropbox as C2 to exfiltrate data and drop additional components (SerialVlogger, vlog.ipdb) which decrypt and load a KeyPlug backdoor providing remote control via WebSockets; the report includes technical analysis, multiple decoding routines, and IOCs.